Desktop Image software (windows 10)

[dmot]

I know Steve has mentioned software that he uses to image his system, I don't recall that software and I don't remember if the software he uses does what I'm looking for.

I would like to automate a weekly/monthly/etc 'image/snapshot' that I can manually save to network storage after the ISO/Image file has been created on the PC that I am imaging.

I'd like to be able to easily recover this image if needed. Here is my current scenario. My PC was running fine, something happened (not sure what, exactly) and a certain program stopped functioning, but it had been working the previous day. I didn't do any updated, but between that program working and not working, windows rebooted with updates. I assume something with the update was the issue for this program to stop functioning. Anyway, I decided a system restore would be the best option and attempted to restore to the previous restore point but that didn't seem to work and I got stuck with a generic blue screen message and an auto repair failed.

This was not a mission critical PC and reinstalling windows and a few apps was not a big deal, but it did take some time and getting things adjusted to how I like took longer than I thought it would have/should have, which is why I'm looking for imaging software.

Free is always good, but I don't mind paying for something if the cost is reasonable as long as it isn't subscription based.

I know I can use something like clonezilla, but I don't think that it something that I can run in the OS. I'm looking for a windows based program that can see my C drive and make an exact copy of the drive and with the exported/created file, I can keep a local copy on my computer in addition to me creating a manual backup. In my scenario, I don't make many changes to this specific PC, even if I had a 6 month old image, using that for recovery would have worked, but I plan to create an image at least once a month.

Thanks.

 

[dmot]

I found this after posting

Steve's Software Picks - The Official TWiT Wiki

wiki.twit.tv

Data Recovery / Backup
Image for Windows - is a drive image backup and restore solution that provides a way to completely backup all your hard drive's data and operating systems

Drive Snapshot - inexpensive "whole partition imaging" utility that runs INSIDE Windows. It can make an offline snapshot image of an online running partition.

Jungle Disk - The #1 cybersecurity suite for main street. Jungle Disk is secure backup and storage, plus password management, a cloud firewall, and VPN for small business.

Edit-

https://twitter.com/x/status/869380252547534848

Image for Windows is what Steve used/uses.

 

[dmot]

Image for Windows

Drive image backup and restore software that is affordable, reliable, and easy to use. Copy/clone drives, migrate to new systems, and more.

www.terabyteunlimited.com

I don't fully understand the restore process, can someone comment on this?

Image for Windows provides an easy and convenient way to completely backup all your hard drive’s data, programs and operating systems. Your backups can be saved directly to external USB and FireWire™ drives, to internal or network drives, and even directly to CD, DVD, or BD. The suite includes an easy-to-use MakeDisk wizard for creating a recovery boot disk. To restore your data, programs and operating systems back to the way they were when the backup was created, simply boot the recovery disk and restore the partition(s) or drive(s) you need to recover. It’s that easy.

Does this mean I would need to create a MakeDisk recovery boot disk and keep that on a USB drive or somewhere other than the PC I'm backing up and if I need to restore to a previous image/backup I would boot off of the MakeDisk recovery boot drive?

 

[PHolder]

MakeDisk recovery boot

You use their tools to do both backup and recovery. I think you can make the recovery disk in advance of needing it, and it will then be useful for recovering using a backup made earlier.

Maybe see here: https://www.terabyteunlimited.com/howto/image-for-windows-first-things-first-make-a-boot-disk/

 

[dmot]

You use their tools to do both backup and recovery. I think you can make the recovery disk in advance of needing it, and it will then be useful for recovering using a backup made earlier.

Maybe see here: https://www.terabyteunlimited.com/howto/image-for-windows-first-things-first-make-a-boot-disk/

Ok, thanks, I will take a look at that. I'm fairly certain that this software will do what I need based off of what I recall from Steve's podcast and what they have on their site, but since it has been a while, I figured it wouldn't hurt to post on here to ask and see what others are also using.

I know Steve has mentioned it several times, one of the times it was brought up was after a windows update deleted the files from the user account folder. That's why Steve mentioned his backup method.

 

[Lob]

Macrum Reflect free version
Veeam does similar free tiers but I found it buggy.

 

[JimWilliamson]

No experience with software that dmot listed.

I have used (and often still use - client depending) Windows Image backup (built into Windows). Windows Image has failed me but it's baked in and available. My preferred OS image backup is Macrium's Reflect. Reflect is free for both home and commercial use. Commercial use "free" requires a registration with Macrium where you'll get (at least I did) two polite sales calls from them/resellers. I like Reflect enough that I purchased a license for my main system. The Reflect software was able to open / use a Windows Image backup file where Windows Image would not restore a file it created in a backup. Bottom line - Reflect is solid / works wonderfully. Making a "boot disk" for a bare metal restore of a reflect backup is easy as it is handled within the software (no need to separately download items from other web sites to put together the boot media).

While I well enjoy Reflect and many aspects of it, I have never used it for incremental or differential backups. I only process full OS images.

Non-Windows is ConeZilla (linux boot) or GPartEd (Gnome Partition Editor) but those are a different OS / not what you're looking at.

 

[rfrazier]

Here are a few thoughts from someone who's better with talking about backups than doing them.

First, this list of @Steve 's favorite stuff here on this forum is probably more up to date than the wiki mentioned.

https://forums.grc.com/threads/my-favorite-utilities-gadgets-services.163/

The aforementioned Jungledisk recommendation is probably a bit dated, although I still use it from @Steve 's recommendation years ago. JD made some changes in management and pricing that I didn't like.

Note that in this favorite stuff list, Sync Thing and sync.com are mentioned.

Backing up a Windows drive while running can be problematical. Sometimes open files won't copy properly. Windows has a volume shadow copy service that tries to fix this. Note also that if your backup drive, or network share, is always attached, then a virus could get in and destroy not only your system drive but also the backup.

The BEST way, but the least convenient, to run a backup is to shut down the system and then run the backup with a utility or hardware. It's a good idea to check your drive for errors before backing it up.

If you IMAGE a drive, that means you copy all the data on the drive with a utility like Image for Windows, Clonezilla, etc., generally compress it but not always, and place this giant 1 TB etc. blob somewhere on a storage device or network. The blob may be broken into pieces if needed depending on the storage. Note that, in the modern world, CD's and DVD's are pretty worthless for this as even a BluRay DVD only stores about 50 GB. 1 TB is 1000 GB. If you need to restore the image, you have to run the utility somehow, either from a CD or USB drive for example. You then have to get access to the blob(s). That might be relatively easy if the storage is directly attached to the PC and might be harder if it's on a network share. Then you'll have to decompress the blob and restore it to your system drive, which will OVERWRITE what's there. It will retrograde the system to the date of the backup, unless you restore to a new blank drive. YOU WILL LOSE all new data unless you restore to a new blank drive and save the system drive that failed. Yes, I'm being repetitive. A properly restored image should restore the OS and data and create a bootable system.

It's always a good idea to choose the setting to verify that the blob matches the source drive after the backup and better yet to do a test restore to a junk drive to make sure the restore works.

If you CLONE a drive, that means you've created an exact identical backup drive. This can be problematical if you end up with the two identical drives, including ID numbers, on the system at the same time. This can confuse the OS as to which drive it's booting from. In that case, you want to shut down the whole system after making a backup and remove the backup drive. Then boot from the main system drive and make sure it's happy.

If you've cloned your drive, then bringing your backup online is easy peazy. Just remove your bad system drive and clearly label it. Put in your cloned backup drive, boot up and go. You will still be missing any data past the date of the backup. You should be able to put the original system drive which went bad in an external USB enclosure and transfer data which had accumulated since the backup. If you swap too many system PC pieces too fast, Windows can get snarky about licensing if it finds itself waking up in too many different "PC's". Usually hard drive swaps are not a problem.

May favorite backup method, which fatal flaw is I don't do it often enough, is to use a hard drive cloner dock.

This is a physical device which copies SATA hard drives. You shut down your system, remove the hard drive, CLEARLY LABEL IT as SOURCE, and put in the SOURCE slot of the dock. You TRIPLE check that you have the SOURCE drive in the SOURCE slot. Then you put your BACKUP drive, which may look identical, but which should also be clearly labeled, into the BACKUP or DESTINATION slot. WHATEVER drive is in the BACKUP or DESTINATION slot WILL BE ERASED. Once your comfy with it, press the CLONE button and walk away for 5 hours or so. When it's done, you should have two identical drives.

Boot up the backup drive and test it. If all is good, shut it down and stash it away.

Reinstall your source drive in your computer and boot it and test it then continue your work.

An online backup is an excellent way to continually backup data that changes between your image or clone backups.

Hope all that helps. Saying all this is one thing and doing it is another.

May your bits be stable and your interfaces be fast. Ron

 

[JimWilliamson]

`don't know if I mentioned this in a thread prior. RFrazier's comment on online backup and virus infection causes me to post the note.

Yes, locally attached live (online) backup destinations do hold risk of being compromised (virus / malware or perhaps electronic power spike). In scant little research on virus / malware infection I have read that they (typically?) look for drive-letter-access to files. Yes, this can readily change by the programmer of a virus / malware and is not set in stone. In that, some backup programs can access a locally attached physical device via volume ID as well as the typical drive letter.

SyncBack (Free) [by 2BrightSparks] is one of these programs where I use the Volume ID method fairly frequently. It's also handy when desiring to ALWAYS backup to one physical USB attached device no matter if its driver letter changes.* The Windows Workstation service needs to be running for this feature to be used (EDIT: I tested this on a Win11 system and Workstation service was NOT required - I specifically disabled / stopped the service and restarted - verified off - volumeID access worked as desired). The command prompt MountVol program is handy to see the volume ID for a particular drive letter. DiskMgmt.msc is used to REMOVE a drive letter from a volume - the drive disappears from being visible in Explorer (and hopefully any malware that might infect a system).

For usage, where SyncBack might backup to H:\BackupStuff I run MountVol and see that H: has a volume ID of "\\?\Volume{f645fa49-cd6d-11e7-9bd0-806e6f6e6963}\" I substitute the volume ID in place of "H:\". I then run a backup, while the volume is visible via drive H and when all looks good I'll use DiskMgmt.msc to remove the drive letter from the volume. I might then re-run a backup to ensure it works as desired.

H:\BackupStuff
\\?\Volume{f645fa49-cd6d-11e7-9bd0-806e6f6e6963}\BackupStuff

* Sometimes a client might have a desire to use a USB attached flash drive for a small backup (quickbooks company file perhaps) but the drive letter might change. Using the volume ID method offers a reliable backup option no matter what drive letter the device is given at mount.


RFrazier - A consideration on your consistent image backup comment. Consider adding a "set-it-and-(mostly)-forget-it" software image backup scheduled task into the system. Have the image backup drop to a local device that's always available. Perhaps weekly or maybe only 2x per month. No, it's not an offline bare metal backup but it's an easy thing to set and have it out there. You can still tend your bare metal clone when you get to it. Should something bad happen, the online local image file is but an extra option to help out of a jam if your bare metal is older than you desire.

I'm finding this configuration of use with systems that have a solid state drive (OS) plus mechanical storage drive (often a small SSD for OS and larger mechanical for data). If the mechanical data drive has ample free space, I shrink its partition by a bit more than the size of the SSD and create an "Z: OS-Backup" volume at the tail end of the mechanical drive. I'll then have Macrium Reflect or Windows Image do a weekly backup to this volume (often labeled at the end of the alphabet). I don't bother doing any specific "backup" of this backup volume - though it could easily be backed up by any file backup program as the files are not in use. Should the main OS be damaged (OS corruption / virus / drive failure), I boot from either a Windows setup device to restore the image or boot from a Macrium Reflect boot device to restore the backup. FWIW

 

[rfrazier]

RFrazier - A consideration on your consistent image backup comment. Consider adding a "set-it-and-(mostly)-forget-it" software image backup scheduled task into the system. Have the image backup drop to a local device that's always available. Perhaps weekly or maybe only 2x per month. No, it's not an offline bare metal backup but it's an easy thing to set and have it out there. You can still tend your bare metal clone when you get to it. Should something bad happen, the online local image file is but an extra option to help out of a jam if your bare metal is older than you desire.

Not a bad idea. I never said I was good at running backups, especially across multiple computers. I do have JungleDisk running every night doing incremental backups of all data. I could mostly get things back by restoring the clone then restoring the JungleDisk volume. Still, I'm sure there's always room for improvement.

Ron

 

[Dave]

Not a bad idea. I never said I was good at running backups, especially across multiple computers. I do have JungleDisk running every night doing incremental backups of all data. I could mostly get things back by restoring the clone then restoring the JungleDisk volume. Still, I'm sure there's always room for improvement.

Ron

Random thought... couldn't you effectively have an off-line backup by putting an external backup drive enclosure on a "smart" plug/outlet that is scheduled to only be powered up during a weekly backup window?

 

[Darcon]

Random thought... couldn't you effectively have an off-line backup by putting an external backup drive enclosure on a "smart" plug/outlet that is scheduled to only be powered up during a weekly backup window?

The problem with this is fire. A fire would consume the original data and the backup.

 

[PHolder]

fire

3 2 1 Three copies, two different media, one offsite. The offsite copy is to save your bacon from a frying pan (on fire.)

 

[JimWilliamson]

The problem with this is fire. A fire would consume the original data and the backup.

If nothing else, this is good for a few chuckles.

Me before internet backup was common...
www.JimWilliamson.net/misc/2002-03-17-media-protection/

Separately, a neighbor was a bookkeeper at a garden nursery. The building was a gorgeous two story wooden barn looking building. The office, in the building, was a typical 3x8 folding table with two "pizza box" Packard Bell computers running Quickbooks (Win9x era IIRC). Next to the card table was an old/classic, heavy, 5' tall safe. Data/QBooks backups were via a tape drive (DC-2120 I think). I helped them get configured with backups. The bookkeeper/neighbor said "what do I do with the tapes - put them into the safe?" I said, no, drop it into your purse and take it home. If left in the safe, it could get hot enough to melt the tape. Many months later I get a phone call at 6am... "THE PLACE IS TO THE GROUND, BUT I HAVE MY PURSE.

That day, we went out to a local store and purchased a replacement computer and tape drive. With Quickbooks installed the tape was restored and they had their corporate data. A day later, once people were allowed to visit the site, I went to where the office was. It was about 3 to 4 inches of ash. The safe had been removed (I never had a peek inside of it). In the ash I found the steel ring that was the underside of the table and the steel legs of the table. I found the steel "pizza box" U-shaped bottom chassis for each computer. Picking them up I blew out the ashes. Aluminum (the hard drive and platters) was a melted blob in the steel case. Copper, from the motor windings, did not melt but were bundles that were somewhat 'un-sprung' bundles of copper. The data - 100% eradicated - except for that offsite backup the bookkeeper took home in her purse.

A comment back from the first thought of "what to do with the tape backup"... Drop it into your purse and take it home - if your home burns - we'll make a new tape at the office. If the office burns we'll restore the tape. If BOTH are destroyed, we're likely not on this earth any more and we won't care. Hopefully, the third will never happen ;-)

 

[Dave]

The problem with this is fire. A fire would consume the original data and the backup.

"Dans ses écrits, un sage Italien
Dit que le mieux est l'ennemi du bien."

I was not suggesting that this was perfect, or even close to ideal. I was just putting forth an idea that might be one step better than online backup. Ransomware has been known to take out live backups. It had just occurred to me that powering down the external media would take it offline, if not offsite.



And while we are sharing backup catastrophe stories... A friend of mine tells a, possibly apocryphal, story from when he was a night operator in a computer room, back in the days of the big, round, 300Meg packs. He had his dog with him and the dog started going crazy at this particular wall. When he went to calm the dog, he put his hand on the wall and practically burned his hand. He called the fire department and moved the most recent backup set from the storage rack outside... where they were hit by a fire truck.

 

[rfrazier]

Random thought... couldn't you effectively have an off-line backup by putting an external backup drive enclosure on a "smart" plug/outlet that is scheduled to only be powered up during a weekly backup window?

An interesting idea. I guess the time window for a virus attack would be limited that way. But, I'm not sure the drive would like being shut down if it's mounted. Linux is kind of famous in my mind for trashing drives when you do that. So, you trash your backup drive. If you could figure out a way to dismount before the power cut and remount after the power's up, it might work. BUT, if you never connect your backup drive unless you've shut down the computer and booted a backup utility, there's no chance for virus attack. BUT, it requires human intervention.

May your bits be stable and your interfaces be fast. Ron

 

[Ralph]

For a fairly small amount of critical data I keep a copy on an encrypted micro SD card I keep on my keychain. Nothing on it changes too often so it doesn't need updating much. Not good for large changing backups, but perfect for those critical files.

 

[rfrazier]

micro SD

You might want to keep at least two of them and use quality name brand SD cards. Also, be aware that solid state memory devices can lose data if left sitting for long periods of time without power.

May your bits be stable and your interfaces be fast. Ron

 

[Ralph]

Your point is well taken. I keep those files on a couple different devices for that reason. I don't think I ever actually ran into a 'bit rot' problem on solid state media, maybe because of periodic updates. All my recent memory card purchases have been name branded high endurance cards. I used to carry an encrypted USB stick with a built in keypad to unlock it, It was kind of large and the protective cover kept falling off. If lost I wasn't worried about the files, a few wrong tries at the pass code and it would erase itself. I was more concerned about the cost of replacing it.

Micro SD cards were too small and easy to loose. I couldn't find a tiny carrying case for one that I liked. Fortunately some people posted their 3D printer designs for the purpose. I printed a few different ones and put them on key chains empty to see how they held up in day to day carry. I found one I liked. Now, worse case if it broke off my key chain I would be out a few pennies of plastic and $10 for the card.