Learn more about system image backup

First published on TECHNET on Oct 31, 2009

<This is the second post in a blog series on backup and recovery offerings in Windows 7. >

In the last post, we’ve briefly mentioned that Windows 7 offers both the ability to backup individual folders and to create a system image of your computer, and how they could be used to protect your personal and system files. In this post we’ll focus on system image backup to give you an in depth view on how the technology works, and how the configuration of your OS may affect the image and the implications during recovery.

What is a system image and how does it work?

Just as a brief recap, a system image is in essence a snapshot of an entire drive(s). The backup is done in block level (as opposed to file level) increments and includes all user and system files, configuration data and applications that are present on the drive, plus information regarding disk layout and boot entries. The image can be used to recover a working Windows if your hard disk ever fails, or if you simply want to reimage your OS to an earlier point in time.

During the first backup, the backup engine scans the source drive and copies only blocks that contain data into a .vhd file stored on the target, creating a compact view of the source drive. The next time a system image is created, only new and changed data is written to the .vhd file, and old data on the same block is moved out of the VHD and into the shadow copy storage area. Volume Shadow Copy Service is used to compute the changed data between backups, as well as to handle the process of moving the old data out to the shadow copy area on the target. This approach makes the backup fast (since only changed blocks are backed up) and efficient (since data is stored in a compact manner). When restoring the image, blocks will be restored to their original locations on the source disk. If you want to restore from an older backup, the engine reads from the shadow copy area and restores the appropriate blocks.

Creating a system image

As mentioned in the previous posts, when configuring Windows Backup, a system image is automatically included in the scheduled backup if the backup target is formatted with NTFS file system and has sufficient space. This system image contains only the critical drives that are required for Windows to operate. Examples of critical drives include system volume, boot (OS) volume, and the volume where the Windows Recovery Environment is installed (typically the same as boot volume on a default installation of Windows 7). As seen from the example below, the System Reserved drive, which is the system volume, and the C: drive that represents the boot volume are both included. The G: drive on the other hand, which is purely a data drive, is not included. To back up any data from G:\, you can select the drive or its folders from the tree view above to create a file-based backup.

Using the Windows Backup wizard above is the simplest way to protect your data and system, since the backups will be created automatically on a schedule. However if you want to create an advanced system image that also includes additional data drives on top of the critical drives, or if you want to save a custom system image to an alternate location (e.g. to a set of DVDs that you can easily carry with you on a trip), you can create such images on an ad hoc basis using the “Create a system image” task link on the Backup and Restore control panel.

The steps to create an advanced system image are very similar to creating the regular scheduled backup. First, select where you would like to save the image, which can be the same as or different from the target for the regular scheduled system image backup. Then you can select which drives should be included in the image. Some drives are selected by default since they are required for Windows to run and must be included in the image. However you are free to select any additional drives to include.

After a final confirmation of the source and the target, you are good to go.

Command-line options

Wbadmin.exe is the command line utility for creating system images and supports all functionalities available from the wizard and more. Using wbadmin and task scheduler together you can create advanced system image on a scheduled basis. For more information regarding the wbadmin subcommands, type “wbadmin help” from a command prompt or visit MSDN (note that some subcommands on MSDN are only available for Windows Server 2008 backup).

There are no differences in the system image created using a wizard or command line tool, and you will be able to restore the images using the same procedures (more on system image recovery in a later post). However, the configurations of your source and target disks do have implications on the ability to backup and restore the image. We’ll explore this some more in the next section.

Considerations while creating a system image

Since system image is a critical feature to ensure availability of your system and data after a disaster, it is important to understand how some of the advanced configuration on your system may affect your options during restore.

1. Choosing the backup target

System image is supported on internal\external disks, optical removable media, and network locations (Business edition or above). Aside from the usual tradeoffs when picking a storage location such as performance and reliability, here are some additional recommendations to consider for picking a system image backup target:

• Do not store the image on the same physical disk as the OS – If the hard disk ever fails, you’ll lose both your OS and the backup.


• Do not store the image on a dynamic disk – a system image stored on a dynamic disk will provide limited functionality during restore. Specifically, the restore will be supported only if the partitioning on the source disk has not been changed. Therefore if your hard disk failed and is replaced with new hardware, you will not be able to restore the image.


• Support for multiple images – As mentioned above, when a new system image is created, older data will be moved to the shadow copy storage area if it’s available. NTFS formatted internal or external hard disks supports Volume Shadow Copy, hence they support storing multiple versions of backup image. We recommend that the size of the target disk should be at least 1.5 times of the size of the source drive(s) to allow enough space for storing older versions of backup. Network share and optical media, on the other hand, do not support shadow copy. Therefore only one system image per computer can be stored at a time (as the .vhd file). Any newer backup created will replace the older backup.


• Use a dedicated backup disk - Older backup that are stored in the shadow copy area on the target may be deleted as space runs out. The amount of churn that happens on the target is one factor that contributes to this deletion. Therefore to ensure the older backups can be kept for a longer period of time, try not use the backup disk for other purpose.

More information regarding differences between backup on hard disk, optical media and network locations can be found in Help and Support.

2. Configuration on the source disk(s)

When a system image is created, it captures the data of (at least) all critical drives on the source disks, and also information regarding the state of all disks and partitions that are present in the system in case partitions need to be recreated during restore. Therefore the layout of the disks at the time of backup will have implications on what is included in the backup and also the options available for restore.

• Disk layout when dual booting Windows 7 with an earlier operating system – Depending on how the two OS are installed, the earlier operating system may be residing on a drive considered critical for Windows 7 and therefore will be mandatorily included in the system image for Windows 7. For example, if the computer originally has Windows Vista installed on the (C:) drive which serves as both the boot and system volume, then Windows 7 will automatically make use of (C:) as its system volume as well. This makes (C:) a critical volume for Windows 7 and must be backed up. However this also means that the all data associated to Windows Vista will be included. To avoid including an earlier OS in the Windows 7 image, you will need to create a separate system partition to be shared by both OS. We’ll be posting an article soon on how this can be done.


• Create a new image after a disk layout change ­– During system image recovery, the UI will check if the current layout on the disk matches the layout information captured in the backup. If it matches, then it will allow restoring only the data in the critical partitions without formatting and recreating partitions on the entire disk. However if the layout has been changed, then it will need to recreate the partitions using information from the backup, which means formatting the entire disk and potentially deleting any non-critical partitions and their data. Therefore it’s recommended that if you ever change the disk layout on your computer, you should create a new system image to allow for a more flexible recovery experience.

3. Multiple machines environment or dual boot machine

• Use different computer names - System images are identified by computer name, and are stored in separate folders with the corresponding computer name on the backup target. If you have two computers with the same name and you use the same backup target for both, the system image of the second computer will overwrite the first one (If the backup target supports shadow copy, this means the older backup will be moved to the shadow copy storage area and may be lost as space runs out). This is especially important if you have created a system image of an earlier OS (e.g. Windows Vista) and then upgraded to Windows 7 using the same computer name, the Vista image may be lost.


• Do not access the backup disk with Pre-Windows Vista OS – Pre-Windows Vista OSes (e.g. Windows XP) do not support the current shadow copy mechanism, and will cause shadow copies to be deleted if it attempts to access a target with shadow copies present. In this case, all older backup (except the latest image stored in the .vhd file) will be lost.

If you have any questions regarding your specific configurations, do not hesitate to leave a comment or visit our forum for support.

-- Windows Backup team