Article ref. no.: FS-FBS-20070810-I01
Last revised: 28 October 2014
Version : 2.2
Operating system backup
This article explains how to create backups of an operating system which is already installed and running. It discusses the differences between drive/partition image backups and file system backups. It describes, step by step, how to create a backup task in order to safely back up the entire operating system, including all installed software, drivers and user information.
Drive (or partition) image
Most programs used to create so-called partition or drive images copy information sector by sector. This kind of backup copy is an exact image of the source drive or partition – hence the name: drive or partition image. However, with more computers to back up this can be burdensome. Some programs require the operator to sit at the computer (no remote backup options) and to shut down the operating system prior to the backup procedure (those programs usually have their own operating system or run under MS-DOS), which causes work downtime. Often the entire drive is backed up regardless of whether it contains any significant information (files) or not. And while creating one backup copy immediately after operating system installation and configuration is feasible, periodical differential or incremental backups to include the operating system in its most updated version are virtually impossible done in this way. In addition, frequent sector reorganization will also be a problem of differential or incremental drive (partition) image backups.
Drive image backups and sector reorganization
The principle of differential or incremental backups is simple – only whatever information has changed since the last full or differential backup is included. As a result, the time needed to create subsequent backup copies is greatly reduced, load on the computer network decreases along with the demand for disk (tape) space to store backup copies . What is an excellent method for file system backups does not function equally well for drive sector backups. The reason for this is the reorganization of information stored in different sectors even if file content itself does not change. Defragmentation is the best example of this.
Fig. 1 Defragmentation changes the drive`s image
Defragmentation is the reorganization of sector information so that a file which occupies more than one sector (a cluster) can be stored in a contiguous manner in adjacent sectors (prior to defragmentation contents of any file can be spread all over a partition). The aim is to speed up disk operations but this, from the point of view of a partition image backup program, is a modification of data: a sector which previously contained a byte string has been modified and now contains other information. Therefore, a differential backup after defragmentation will be virtually as big as a complete backup.
Creating a drive or partition image, however, is not the only way to secure information on a computer. File-based backups can also be used for file restore and disaster recovery purposes.
Virtually every modern operating system uses files as the principal form of storing information on a drive. Programs, drivers, system register, databases and documents are all stored in files which can physically occupy one or more sectors on a drive. The operating system and applications running under it do not read or write information by accessing those sectors directly. This is done through the file system, which greatly simplifies all high-level disk operations. Windows supports both FAT and NTFS system partitions.
Open and locked files
One of the most important issues which make file system backups of operating systems difficult is the file locking mechanism available on most operating systems. File locking mechanisms service to protect data and its structure. Access to a file can be locked (through the operating system) by a process which is already accessing or has created the file. So if an application or the operating system opens any files on an exclusive basis, no other application (such as the backup software) will be allowed to open the file to back it up. Because during operation the operating system locks access to several files (especially the system register), operating system backup without special low-level mechanisms bypassing such access restrictions is not possible. However, if we have an application to read such restricted files, operating system backup on the file system level is not only possible but can prove more functional and faster than drive sector backups.
Backups of open files using the Ferro Backup System
Backing up a running operating system would not be possible without being able to read, and thus make copies of, both open and locked files. The Open Files Manager (OFM) included in the Ferro Backup System reads such files by directly accessing the drive and bypassing the operating system. For more information on backups of locked and open files see "Backup of open and locked files" .
Fig. 2 Open and locked files backup
Thus, in order to ensure that the operating system is fully backed up, we need to switch on the “Open/locked files backup” function located in the Workstation Settings window in the Advanced tab.
Prior to starting the operating system backup, we need to choose which files are to be backed up and which skipped. A backup copy which we want to use to restore a functional operating system must include all file types starting from programs, libraries and drivers to application settings, operating system configuration (register) and user documents.
Fig. 3 Backup of all drives
Those files may be located both in the main folder of the system partition, the system folder, the Program Files and Documents And Settings subfolders and other locations defined by the user, as well as on other partitions or drives. Therefore, the best way to choose files and folders to be backed up is to check the option “All local hard drives” or selected volumes. With such an extensive backup range we need to select files and folders to be skipped, mainly to exclude the temporary folders of the web browser and temporary files of the operating system itself.
The frequency of operating system backups will depend on what we want to achieve. If we want to have a backup copy of a “fresh” operating system as installed and configured we can use the “only on demand” functionality. If we prefer to have a backup copy done at the latest possible moment prior to a potential failure, the frequency of backup tasks must be increased. If we already have a dedicated task for backing up user data, operating system backups can probably be carried out only once a week. Statistically, the majority of failures occur during power up. Therefore, you should also consider switching on the “Backup before shutdown” option. When this is on, backups will be performed regardless of the backup schedule (depending on the selected option) when the user shuts the computer down. You should also remember to turn this off on older computers which do not support APM/ACPI, because after the backup is complete, the computer will not shut down automatically.
After selecting the backup range and schedule, you should consider which backup type will be the best for you. Ferro Backup System offers three backup options: full backup, differential backup and file fragment differential backup. Full backups are only recommended for making a backup copy directly after installing and configuring the operating system. This will enable us to restore a “fresh” operating system in case of failure. If you decide to schedule frequent operating system backups (on a weekly basis or more often), it will be better to choose differential backup or file fragment differential backup, which are much faster and do not place as much load on the local network as the full backup. If need be, we will be able to restore the entire operating system from a date of our choice starting from the first backup (which may contain a “fresh” system) to the last backup completed prior to a failure. File fragment differential backup is recommended for computers with files larger than 20 MB (database files, mail files). For more details on the differences between differential backups and file fragment differential backups see the manual "Options tab - setting backup properties".
Turning backup encryption on or off will ultimately depend on each company’s information confidentiality policy. It should be noted, however, that encryption slows down the backup process several times and causes a corresponding slowdown of the restore process as well. If, however, encryption is absolutely necessary, you should consider whether the backup process should not be split into two (or more) tasks: operating system backup including applications and settings, and confidential user information backup. Ferro Backup System offers three encryption algorithms: Rijndael, Serpent and Twofish. Twofish being the fastest and Serpent the slowest.
Operating system backup
A newly-installed Windows 98 contains approximately 3,000 files, which occupy in total over 300 MB on the drive. Each new Windows version takes more and more disk space: Windows 2000 – 9 thousand files (1 GB), Windows XP – 12 thousand files (1.8 GB), Vista – 36 thousand files (8 GB). The first (complete) system backup takes from 2 minutes (Windows 98) to 15 minutes (Vista).
|System||Number of files [thousands]||Backup size [GB]||Backup time [min]||Average transfer speed [MB/s]|
|Windows 98 SE||3,1||0,31||1,9||2,72|
|Windows XP HE||12||1,8||5,5||5,45|
|Windows Server 2003 EE||10||1,5||4,3||5,81|
|Windows Vista HB||36||6,9||15||7,67|
|Windows 7 Enterprise||47||8,5||18||7,87|
|Windows Server 2008 R2 Standard||57||7,7||15||8,55|
|Windows 8 Pro||94||9,6||19||8,42|
|Windows Server 2012 R2||78||11||18||9,47|
Table 1. Backup times for different Microsoft Windows versions
This does not include the bulk of installed applications and user files. On a typical office computer there are approximately 5,000 additional application files and 3,000 user files.
The average transfer speed with such backups (with encryption on) is ~50 Mb/s.
Diagram. 1 Comparison of backup speeds for different Microsoft Windows versions
Subsequent differential backups are completed several times faster than the first, original backup. The backup process does not significantly affect the computer’s speed, and so the user should not experience any reduced comfort of work while performing typical office operations.
The operating system or additional components may be installed on one or several partitions or drives. A full or differential copy performed using Ferro Backup System can be used to restore a working operating system including all settings.
For details on operating system restoration, see the second section of the article "Restoring the operating system from a backup copy".