19 replies to this topic

[Vortex]

With many thanks to Olof Lagerkvist, strarc can backup a full Windows installation including NTFS permissions, timestamps and file attributes.

 

http://www.ltr-data.....html/#CmdUtils

 

strarc can be used to do an on-line backup of Windows using the volume shadow service.

 

I coded a tool named vscopy similar to Microsoft's volume shadow copy client vshadow.exe :

 

Volume shadow copy creator for Windows XP \ Server 2003 \ 7 V1.0

 

http://vortex.masmco...s/vscopy101.zip

 

For the moment, only the 32-bit version of vscopy is available for Windows XP, 2003 and Windows 7

 

Other alternatives are MS volume shadow copy client from various SDKs and the one from SourceForge :

 

http://vscsc.sourceforge.net

 

Using my volume shadow copy creator, I was able to perform an on-line backup of my Windows XP SP3 installation with strarc.exe :

D:\>vscopy.exe C: V: wait.bat

Volume shadow copy path = \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1

 

wait.bat :

Pause

vscopy takes three parameters. The first indicating the partition to get the volume shadow copy. The second is the symbol of the volume shadow copy and the third is the batch \ script \ executable file to process the volume shadow copy.

 

The second command-line prompt :

strarc.exe -cd:V:\ -e:pagefile.sys \\fileserver\backup\winxpsp3.sa

The pagefile is excluded. Through a a pipe symbol, bzip2 can compress the backup stream.

 

Naturally, you can add this line to the batch file wait.bat

 

V is the symbol of the volume shadow copy. strarc created successfully the backup on the network share. Restoring is easy from a Windows PE environment :

 

Formatting partition C and connecting to the network share :

net use Z: \\fileserver\backup

Restore backup :

strarc.exe -xd:C:\ Z:\winxpsp3.sa

The restored Windows XP system restarted without any error message.

 

The -j parameter of strarc can be used to backup the junction points of Vista,7,8, Server 2008 \ 2012 

[erwan.l]

This is an old thread but still was useful to me.

I thought I would share how strarc can be used with netcat and therefore backup files over the network.

On the "server" side : nc -v -l -p 9000 -e "strarc -cd:x:\my_folder\"
On the "client " side : nc 192.168.1.1 9000 > dump.sa (update the IP obviously with your "server" IP).

This can probably be combined with bzip2/gzip/7zip(?) using the dos pipe (i.e "|") but being rather weak there I will leave that to others and will lamelessly use stdin/stdout with netcat for now (i.e ">").

EDIT:
on the client side, you can compress on the fly with: nc 192.168.1.1 9000 | 7z a backup.7z -si - or nc 192.168.1.1 9000 | bzip2 -z > backup.gz

[Olof Lagerkvist]

Thanks both of you for your useful "how-tos" for strarc!

 

Just one thing about the original post, you do not need to assign a drive letter for a shadow copy volume if you are backing up using a shadow copy. In the above example, V:\ can be replaced with the volume device path, like:

strarc.exe -cd:\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\ -e:pagefile.sys \\fileserver\backup\winxpsp3.sa

(Notice the trailing \ at the end of the volume path, so that you reference the root directory of the file system instead of the raw volume.)

[erwan.l]

Thanks both of you for your useful "how-tos" for strarc!

 

Just one thing about the original post, you do not need to assign a drive letter for a shadow copy volume if you are backing up using a shadow copy. In the above example, V:\ can be replaced with the volume device path, like:

strarc.exe -cd:\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\ -e:pagefile.sys \\fileserver\backup\winxpsp3.sa

(Notice the trailing \ at the end of the volume path, so that you reference the root directory of the file system instead of the raw volume.)

 

I have not tried yet but then I guess a volume name will work as well in the form of "\\?\Volume{e26e7b15-122a-11e7-82bf-806e6f6e6963}\" ?

[Olof Lagerkvist]

Yes exactly, that works too!

[erwan.l]

With the this command : strarc.exe -crjd:c:\ | strarc.exe -xd:d:\ , I was able (under xp) to copy all files from one disk to another in a short few mns.

The only extra step I had to perform was to take care of my boot loader on the target disk (old good grub4dos in my case) and I was able to reboot my system on this disk, without a glitch.

I could (should?) have gone for a snapshoted drive as source but did not bother.

 

The "r" parameter is a must have as it will handle loaded registry hives (locked and therefore skipped by default).

[Wonko the Sane]

With the this command : strarc.exe -crjd:c:\ | strarc.exe -xd:d:\ , I was able (under xp) to copy all files from one disk to another in a short few mns.

The only extra step I had to perform was to take care of my boot loader on the target disk (old good grub4dos in my case) and I was able to reboot my system on this disk, without a glitch.

I could (should?) have gone for a snapshoted drive as source but did not bother.

 

The "r" parameter is a must have as it will handle loaded registry hives (locked and therefore skipped by default).

Hmmm.

 

How was the Disk Signature managed? 

 

Normally you have to delete DosDevices key to let the "first boot after copy" recreate it with the "new" Disk Signature.

 

Wonko 

[erwan.l]

Hmmm.

 

How was the Disk Signature managed? 

 

Normally you have to delete DosDevices key to let the "first boot after copy" recreate it with the "new" Disk Signature.

 

Wonko 

 

Indeed, had not realised that, surprisingly, i created the part table myself (chs, hidden sectors, total sectors, ...), injected G4D boot code and "basta".

Meaning the disk id was a blank one.

And still XP booted fine.

 

I can easily reproduce the steps to double check it.

 

Edit : below the steps (from my notes) i followed and indeed ignoring the disk id part.

create a 2GB "raw" image file
mount with imdisk at offset 63
format
copy files (with strarc)
manually copy grldr+menu.lst
unmount
instal g4d to MBR 
manually create an active (0x80) ntfs (0x07) part in MBR (dummy chs, hidden sectors=63, total sectors=bs.total_sectors+1)
fix hidden sector (=63) in BS (imdisk sets to 1 by default) 

[Wonko the Sane]

Well, if you used IMDISK, then it is clear , IMDISK mounts ONLY volumes (NOT disks) at a "higher" level than Disk Manager.

 

The "target" disk (the whole disk) is never mounted (at the same time as the original), so there is no conflict with the "source" disk's signature.

 

In your case the disk signature is blank, so the XP assigns one to it and since it cannot find the disk on which it was originally installed it (evidently ) defaults to recreate on its own the MountedDevices drive lettering on the base of the newly assigned Disk Signature.

 

If you check the disk signatures of the "source" and of the "target" disks they will be different, that any NT system as soon as it finds a diskwith a blank signature writes one to it is well documented, that it can auto-fix a set of Registry keys (in case the Disk Signature in them is not available) is AFAICR "news".

 

It has to be checked whether this only works if a set of conditions apply, like "single active primary partiton that is both "System" and "Boot" volume.

 

 

Wonko

[erwan.l]

Ok, being either ignorant or sloppy, I got lucky

I used ImDisk here because XP does not handle VHD natively.

Had I been under windows 7, i would probably have used the built in VHD feature for my experiment and would then have found myself with possible disk signatures conflicts (or rather the infamous 0x7b boot error...).

There I should then add an extra step i.e reset the MountedDevices key.

 

Now, looking at it afterwards, using ImDisk to avoid disk signatures conflicts is actually convenient .

 

My XP system was a single partition.

[erwan.l]

Is there a complete list of accepted commands? Or something like "strarc --help" to get a list?

 

http://www.ltr-data....iles/strarc.txt

[erwan.l]

What is strarc's average compression ratio? Or is this wholly dependent on what is being backed up?

 

There is no compression with strarc.

But you can combine it with bzip, etc.

[Wonko the Sane]

Typically one would use a non NT system (grub4dos is more than enough, but you can use *any* Linux with dd) to restore either a copy of the whole MBR or just the Disk Signature.

The drive letter assignment in the Registry depends on two values:

1) Disk Signature
2) Offset to the partition/volume

 

So, for the first partition/volume (provided that it has the same "OS standard" offset of either 63 or 2048 sectors) there are no issues, while for following partitions/volumes the need to be at the same offset (hence also the same size) of the original.

 

So one could make a (partition based) "clone" (that Windows will anyway make non-identical by changing the Disk Signature), then use strarc to update the content of volumes file-based.

 

As long as the disk can boot to grub4dos, in case of disaster one could restore the Disk Signature (or the whole MBR) and have thus a "replacement clone".

 

As a matter of fact (sire-side note) it could be possible (at least in theory) to mount using IMDISK direct offset mounting a volume:

http://reboot.pro/to...image/?p=192170

 on a "cloned" hard disk on which the MBR "Magic Bytes" have been wiped (i.e. that won't get mounted in Windows and that would prompt for initializing in Disk Manager).

It has to be checked if the Disk Signature conflict happens even for that or only at mounting time.

 

This would have the advantage of keeping in normal state the volume(s) unmounted, mounting it/them only when needed for the strarc sync/backup [1], AND having them virtually "untouchable" by Windows and anything normally running in it, as the disk would remain uninitialized. 

 

 

Wonko 

 

[1] With the diffusion of cryptoware, keeping backup volumes mounted to drive letters has proved to be not a failsafe procedure.

[erwan.l]

@erwan.l: Next time you can just combine your answers into 1 post, no need for 2.

 

About the compression, since strarc doesn't do this natively, then I will need to install bzip from something like Cygwin (or a Windows port), then pipe from strarc to that so compression can occur? Or pipe to 7-Zip's command line utility (which supports alot of compression algorithms)?

 

Your welcome, as always

 

Native bzip can be found here (still on Olof web site).

7zip (using -si or  -so flags) can be used as well : strarc -cd:c:\folder | 7z a backup.7z -si

 

And if you look in the strarc doc which I pointed you to :

3.5 Archive compression.

The strarc program does not natively support compression of the archive it
creates or restores files from. However, because it by default uses stdin and
stdout as archive it is easy to use pipes to stream compression utilities such
as gzip och bzip2. Example:

strarc -cd:C:\ | bzip2 > D:\backup.sa.bz2

This will backup all of C: drive to a bzip2 compressed strarc archive at the D:
drive. To restore from such an archive, use bzcat the opposit way:

bzcat D:\backup.sa.bz2 | strarc -xd:C:\

This will extract all files from the bzip2 compressed strarc archive at the D:
drive back to the C: drive.

[erwan.l]

Ah here we come

I was wondering how much time it would take you to insult someone around.

DId not take long.

 

This is what I like about you : you are constant !

 

Off I go.

[Wonko the Sane]

And from now on, I will stop appending "Thanks!" to the end of most of my posts here at reboot.pro.

Wow!

What a cruel, scary way to punish people using 2 posts where 1 was enough, I am sure erwan.l (and all French, and non-French people ) will never post twice in a row again, for the utter fear of this or other form of retaliation.

 

Wonko