January 2003

Disk Imaging in Windows — Increases user productivity and permits broader range of backup devices

The aftermath of the 9/11 terrorist attack sent an earthquake-sized wakeup call to IT managers and users who discovered that backup meant more than just having tapes of the corporate servers off site. Today IT managers for companies of all sizes and individual users alike realize that having a mirror image of each PC can save hours of time-maybe even days-restoring a system should the PC hard disk drive fail.

Companies and individuals that had mirror images of disk drives found that they were able to get back up far more quickly than their counterparts who had only data backups. The massive hard drives in current retail PCs are changing the way some IT managers and individuals look at their backup strategy.

Today, simply backing up data files is no longer adequate. Users of Microsoft Windows and Office applications recognize that along with the basic program disks, there are a multitude of patches and updates to reinstall before the software is back to its "current" status. Additionally, many of today's retail PCs are sold with the programs preinstalled; often the user doesn't even get the original program disks. In cases like this, a simply copy of visible programs to a backup medium is inadequate. Additionally, data-only incremental backups are only useful if you have a base backup of the entire disk so that you can then add the incremental backups.

Users need exact duplicates of their entire hard disk drive, including the primary boot partition — where all system files and settings are stored-as well as data partitions in order to ensure they have a complete backup that can restore the drive to working order. The obvious choice is to create a mirror image of the disk-a starting place that gives you an exact copy of your disk on a CD, DVD, network drive or tape so that in the event of a hard disk failure, you can recreate exactly where you were the moment you made the backup.

From a productivity standpoint, IT managers and users alike want to be able to create this image without taking the system offline — they want to create the image while the user is still doing productive work. However, traditional backup programs that cannot copy open Windows programs are unable to accomplish this, since they forced the user to reboot to DOS in order to make an image of their system partition. From this DOS environment, the system being imaged cannot access any Windows applications, and therefore the user's productivity is zero. New technology makes lost productivity a thing of the past.

IT managers and individual users alike now can image their hard disk drives-including the all-important system partition-while the system is up and running in the Windows environment using Acronis True Image 6.0. And because the user is running Windows, they have access to all Windows-supported backup media, including DVD, CD-RW, network drives and tape. The package also fully supports the latest USB 2.0 and FireWire devices.

This is a critical distinction because by forcing the user down to DOS, the software severely limits the number and kinds of supported storage devices.

Typically, Windows applications cannot copy the system partition because they are unable to copy open files. In cases where the user's hard disk is partitioned only as one drive, that meant the user could not image their system at all from within Windows. If the disk is large enough, it could mean that the user is out of commission for hours at a time while the program chugged away at creating an image.

Leading-Edge Technology

Acronis overcomes this issue of copying open Windows files by effectively freezing a moment of time. A special filter driver layers between file system drivers and volume drivers, allowing the software to create and backup consistent views of all files, including open files. The driver is installed above the volume drivers so it can see all the read and write requests passing to a volume — or partition.

When the IT manager or user initiates imaging of the hard disk drive containing the system volume, the filter driver flushes the file system mounted to that volume; then all the operations on the system volume are temporarily frozen. Immediately thereafter, the filter driver creates a point-in-time view of the system volume and a bitmap describing the used sectors on this volume. Once the bitmap is created, the filter driver unfreezes the I/O operations on the system volume. It generally takes just several seconds to create a point-in-time view of the volume. After that, the operating system continues working as usual and the software can start imaging of the system volume.

Acronis True Image reads the sectors on the system volume according to the created bitmap. Once a sector is read, the appropriate bit in the bitmap is reset. In its turn, the filter driver continues working to hold the point-in-time view of the system volume. Whenever the filter driver sees a write operation directed at the system volume, it checks whether these sectors are not backed-up yet, if they are not, the filter driver reads a copy of the sectors that will be overwritten into a special buffer created by the software, then it allows the sectors to be overwritten. Acronis True Image backups the sectors from the special buffer so that all the sectors of the point-in-time view of the system volume will be backed-up intact. Meanwhile, the operating system continues working and the user will not notice anything unusual in their operating system functionality.

Since Windows XP supports the Universal Disk Format (UDF) file system, Acronis True Image can take advantage of this file system and create images via the UDF. Once the file system is mounted in the read/write mode, the software detects it and writes the image to a file created on this file system. If the UDF is not available in the operating system, then the backup software will burn the image directly to blank CDs. All of the popular imaging applications have at least some support for writing to CDs — although the DOS-based applications might not have support for the latest CD-RW devices. However, only programs that can call Windows-based drivers can write to DVD drives.

All products have to reboot the imaged system in order to restore an image. Again, many of the popular products reboot to DOS, just as they did when they imaged the disk in the first place. Acronis True Image, however, reboots into a customized version of Linux and presents the user with a Windows-like interface. By booting to Linux, the software is able to support the latest storage devices, such as CD-RW and writable DVD devices. After all, it wouldn't make much sense to save the image to DVD if the software couldn't restore it from it as well.

To give you an idea of the capacity differences between CD and DVD technology, popular CD-R disks today boast 700MB of capacity. A DVD-18 drive (double-sided/double-layered) supports 16GB, or nearly 23 times more capacity than the poplar blank CDs today. That's an extremely significant difference when you need to image a large disk and do not want multiple disks per volume.

The advanced technology in leading-edge imaging products work is not how they create a partition, but rather, how they image the disk. As noted above, the Acronis offering takes a bitmapped image of the disk while still in Windows and then monitors subsequent write operations. As files are written or updated, those portions of the disk are re-imaged so that a complete and up-to-date image is maintained. Products that force the user to reboot back to DOS do so because they are unable to image open files, particularly files on the system partition. Remember, when a computer is running, it has open system files even if all of the applications are closed. Being unable to image those files means that the product cannot work in the Windows environment. As a result, the user needs to use the slower, more cumbersome DOS approach.

Additionally, products in this category are differentiated by the file systems they support. All disk imaging products support the Windows file systems-File Allocation Table (FAT) 16, FAT 32, and NT File System (NTFS) — and some provided limited support for Linux file systems Ext2, Ext3 and Linux Swap, but today only Acronis supports ReiserFS, the default file system used by SuSE Linux.

To review, creating a full and complete disk image is the best way to create a backup of a system disk, be it on a Windows 2000 server or on a Windows 95/95/XP/2000 desktop. From a performance standpoint, operating in Windows is not only the fastest method, but it also allows the user to continue to be productive while the disk image is being made. A Windows/Linux backup and restore strategy is faster than simply booting down to DOS for all backup and restore operations.

It was bad enough when IT managers had to worry about their systems being hit by pernicious viruses, such as Nimda; today they realized that other catastrophic events could cause systems to crash. And consumers too realize that their systems are not immune from damage, even if they are not connected to the Internet. Backup traditionally has been thought of an insurance policy. Today, it's also part of corporate security and productivity plans.