Backing up the entire XP Pro system state

Topic

New Reply

I back up my system on a regular basis. I just tried restoring it to a new hard disk (simulating a hard disk crash) and discovered that my backup program, Retrospect, saves the system state but omits MetaBase.bin, the IIS database that’s part of the system state.

I want to ensure that my backups (which, by preference, do not use imaging) include the entire XP Pro system state. I’ve encountered differing definitions and deficient implementations of system state backup. NTBACKUP.EXE, for instance, can back up system state, and it includes MetaBase.bin, but it neglects the user hives, NTUSER.DAT and UsrClass.dat. ERUNT.EXE backs up the hives in system32config and the user hives, but it neglects MetaBase.bin. As I already mentioned, Retrospect backs up the same hives as ERUNT, but it, too, neglects MetaBase.bin.

The system state also includes the “COM+ Class Registration database”, but for Windows XP, its location and the backup method are confusing. IIUC, MS states here that this database is backed up with the registry. OTOH, MS has a knowledge base article here that explains how to rebuild this database from scratch and files in %windir%Registration are included.

What’s a sure-fire method to back up the entire XP Pro system state? Will backing up the registry, including the user hives, and MetaBase.bin be sufficient?

TIA for any help.

regards, Andy

P.S.: I posted this message to the Microsoft Community | Windows XP | Repair and Recovery forum here, but received no useful responses.

P.P.S.: I also posted a similar message in the Retrospect Professional forum here. Unsurprisingly, no one from Retrospect would even admit that the program has a deficiency.

Reply | Quote

Replies

Maybe you should be taking this up with the company with whom you’ve chosen to create backups with. [Retrospect]

Reply | Quote

i am just a wimpy wuss beginner so what do i know
as i prefer to avoid problems than try to fix them later

i would do it the easy way and image the drive
external hds are so cheap there is no reason not to do that now

why would you prefer to not do it the easy sure way by imaging ?
what benefit is tehre to the other method??

Reply | Quote

Yes, I agree, imaging would be ideal, especially for an OS like Windows XP where one could potentially place it on a DVD disk.

But if one is having an issue with a specific 3rd party application, like Retrospect, one should first take any tech issues up with them.

It will always be a “crap shoot” when attempting to seek support on forums such as these, unless there are multiple users of the same software
who know how to troubleshoot and debug such issues. That will likely be very rare.

Reply | Quote

My question can be separated from the backup method/program.

Here it is again:

What’s a sure-fire method to back up the entire XP Pro system state?

I suspect that backing up the registry, including the user hives, and MetaBase.bin will be sufficient. Can someone confirm and link to a source?

regards, Andy

Reply | Quote

The sure-fire way? Image it.

Regular backup programs are for saving a copy of data but do a bad job of saving a system state due to locked in-use files. A friend of mine used Retrospect for data and it failed that too. I would not recommend it.

My routine now is Image the system with an established well-recommended program. (Win7 its built in. Acronis for prior) Backup the data to Zip format and not a proprietary format. Zip can always be accessed, whatever the circumstance, even a dead OS. (using Cobain these days) I based this routine on Fred’s advice. (though I think he just images it all now)

You may disagree on Imaging but its the nature of the technology. It’s not opinion. ONLY imaging is able to save the complete System state because its not blocked by locked files, like the example you gave. You don’t state why you don’t like images (proprietary formats that died?) but it sure sounds like you do it the hard way.

BTW – did you know Ghost is an Imaging tool? Perhaps your issue is you’re using too old a version.

Reply | Quote

Y’all can use any old Mickey Mouse backup program you like, but……

When your main hard drive shoots craps (crashes, dies, smokes, etc. ) you will need two things to do a full recovery.

1. You must have your Backup/Restore program on some bootable media, so you can boot up your computer, with a brand new (blank) hard drive in it.

2. Your backup image must contain everything that was on your old hard drive’s C partition, including the boot sector, MBR, and all of Windows, data, etc. In short….’Everything’.

Doing anything less is foolhardy and a total waste of your time.

The number of really good backup programs that can do everything I’ve mentioned above is getting longer every year.

Personally I still use a program that was the only one of its kind in 1997 when it was first written. It’s DOS based so will run nicely from any DOS boot disk or Flash Drive. It’s was updated last in 2005 and will back up and restore any OS to date, including Windows 8. It’s “Ghost 11.5”.

Since it can create compressed backup image files, several can be stored on a single external drive or any one backup can be burned to DVD’s.

OP, it sounds like you need to change your backup program and maybe change your whole outlook on doing backups in general.

I’ve been setting up Backup routines for Banks, Corps and home users for about 30 years, so I do know from which I speak.

If I loose a file, I can always extract it from a Ghost Backup Image file using the Ghost Explorer program. I’ve not lost even one file in the past 25 years.

Good Luck!
The Doctor

Reply | Quote

I sure would have appreciated an answer to my question.

you said:

Doing anything less is foolhardy and a total waste of your time.

I do not agree (but you’re certainly free to use your time as you see fit).

I, too, have considerable experience with backups and restores. I also know about imaging and use it when appropriate. It is certainly one way to restore a system, but it’s not the only way. (I certainly understand it’s your way.)

To restore Windows, one needs two things: the files and the system state. If one backs them up, one can restore Windows without an image. And yes, I’ve done it. I’d be interested to find out more about system state backup, since the information on the web is sparse and the performance of backup programs is (often) deficient.

I realize your approach is to image everything and sidestep my question about how to back up system state.

I suggest we agree to disagree.

I still hope to find an answer to my question: What’s a sure-fire method to back up the entire XP Pro system state? Will backing up the registry, including the user hives, and MetaBase.bin be sufficient?

regards, Andy

Reply | Quote

I don’t think you will find too many folks around who actually use that method of backup, especially on such an old operating system as XP.

Reply | Quote

… especially on such an old operating system as XP

XP is a valid OS that allows me to launch the apps I own, the hardware I’ve connected, and the utilities I need to manage the OS. “Old” is, IMHO, irrelevant. (Unsupported will indeed be relevant, but that’s on next year’s agenda.)

I’d be tempted to update my question for post-XP OS’s, but then it would be moved from this forum.

I’ll repeat the question, ever hoping that someone who knows about system state can answer it:

What’s a sure-fire method to back up the entire XP Pro system state? Will backing up the registry, including the user hives, and MetaBase.bin be sufficient?

regards, Andy

Reply | Quote

You could try ShadowSpawn (the XP version is #3 on the list), but you’ll really need to do some work to prove what it backs up.

I use it (now on Windows 7) to back up my Outlook PST while it is open, using Robocopy on the ‘virtual drive’ that ShadowSpawn creates. You’ll probably find an example in the documentation. Come back if you need more.

BATcher

Plethora means a lot to me.

Reply | Quote

Thanks very much for the suggestion. It looks very promising.

I’d never heard of ShadowSpawn. For info, the documentation is here. Also, for info, the drive letter on the command line is any unused (available) letter.

regards, Andy

P.S.: I’m still looking for a more explicit answer to my question: What’s a sure-fire method to back up the entire XP Pro system state? Will backing up the registry, including the user hives, and MetaBase.bin be sufficient?

Reply | Quote

PCDr,

Hello… Although I have no idea why anyone would want to do such …there are many articles on how to XP Pro system state backup… I also have and use XP Pro SP-3 … great little program … With a full OS image ( takes about 2 minutes ) With Acronis 2010 v7046 with verification …i ask you what’s the point ? “Just Askin”.. Not understanding???? :cheers: Regards Fred

Reply | Quote

A Google search for “XP Pro system state backup” is not what I had in mind when I asked for an answer to the question found in my previous posts. I’m familiar with many of those web pages. In my previous messages in this thread, I listed some of the inconsistencies they contain. (NTBACKUP.EXE, for instance, doesn’t save the user hives when backup of “system protected files” is unselected, which surprised me. When is a registry hive not a registry hive?)

I was hoping to be enlightened about XP system state and learn how it is best backed up so it can be fully restored.

with a full OS image… i ask you what’s the point ?

An image is a copy of a system at a point in time. Unfortunately, it doesn’t include versioning. I have backups that go back years. I can find versions of my data and my registry during all that period. I have used the versioning to retrieve old data and to test the effects of registry changes on OS behavior. I’ve identified all sorts of problems that way, some in hotfixes, others in programs, drivers and utilities.

Imaging is a terrific tool, but it’s not the only way to save files. Again, if one has copies of the files and can restore the system state, file-based backup is a very suitable alternative.

regards, Andy

Reply | Quote

An image is a copy of a system at a point in time. Unfortunately, it doesn’t include versioning. I have backups that go back years. I can find versions of my data and my registry during all that period. I have used the versioning to retrieve old data and to test the effects of registry changes on OS behavior. I’ve identified all sorts of problems that way, some in hotfixes, others in programs, drivers and utilities.

Andy,
Hello… Guess that I’m just too dense to get this …However , just want to offer a few

1. Any “pay for” Imaging software will image any piece of your OS that you want ( File Folder, etc) See screenshot

2. Any and every time that i “Hosed” my OS it was cause i did something stupid, or installed some program that didn’t play well with the rest of my programs…

3. So why would i want to try to play… Find which bit trashed the OS? …. Just Recover to some previous time before… That’s my version of “Versioning”

4. “Try and Decide ” is a good program (part of Acronis) that does just what it says… try it out first …if it doesn’t work out ….Just “discard changes

5. Total Un-Install [/url] program takes a “Snapshot” before you install something ….so you can then go back to where you were before you messed with something…

6. Kind of reminds me of the story … a guy goes into the Dr’s office and asks …”hey doc” ….whats the best way to put crabs in my underwear? The Doc looks at him and thinks for a second and says… There are lots of ways …but they all end the same ….Ouch!

:cheers: Regards Fred

Reply | Quote

Just Plain Fred,

I appreciate your preference for imaging. I just have a few comments, which point to your numbered items in message #19:

2. I don’t use images on my primary system. (I do use images on other systems and for my corporate clients.) The last time I thought I’d “hosed” my OS, I booted to an alternate OS, swapped registries, and started up again. (The problem was finally traced to a badly designed ATI Radeon driver. Good story for another post.)

3.

So why would i want to try to play… Find which bit trashed the OS?

I learn a lot that way. It’s the problem-solving that keeps me in the business.

4.

“Try and Decide ” is a good program (part of Acronis)

Too bad it’s from Acronis.:(

As part of my testing, I started with an empty hard drive and partitioned it with Acronis Disk Director 11. I moved the hard disk to the target PC and installed XP Pro from a CD. Files were copied, the PC rebooted, and… nothing. No error. Nothing.

I lost hours with this. (Glad it was only a test.) It turned out that if the hard drive was partitioned with Disk Director, the disk would not boot after restart during the XP Pro install. If the same hard drive was partitioned either with PartitionMagic 8 or via the XP install CD, the install completed normally. This is repeatable on this hard drive on this particular PC.

I then went to the Acronis site and found lots of complaints about Disk Director. All kinds of problems, some similar to my own. I also read the reviews at Amazon.com here. Some were quite negative and technically explicit.

I decided never to use Disk Director on another system, mine or a client’s. A also decided never to purchase another Acronis product, no matter the accolades it receives. (Don’t take it personally.)

6.

a guy goes into the Dr’s office and asks …”hey doc” ….whats the best way to put crabs in my underwear?

I’ve got a similar story.

A guy goes into a Windows Secrets forum and asks, “Hey, what’s the best way to make a reliable backup of Windows XP system state?”

Oh, right, you’ve heard that one.

regards, Andy

Reply | Quote

Too bad it’s from Acronis.:(

As part of my testing, I started with an empty hard drive and partitioned it with Acronis Disk Director 11. I moved the hard disk to the target PC and installed XP Pro from a CD. Files were copied, the PC rebooted, and… nothing. No error. Nothing.

also decided never to purchase another Acronis product, no matter the accolades it receives. (Don’t take it personally.)

Andy,
Hello.. I think that i understand now what it is your doing with backups… Just wanted to reply with a few comments

1. If you install XP from a disk to a new(Newer) PC … Likely the drivers for the hard drives will be wrong …IDE vs AHCI … so no boot, been there done that…

2. I completely agree about Acronis… That’s why I’m sticking with Macrium Reflect Pro and Acronis 2010 v7046 ( have 2012 and 2013 ) tried em and will not use them again.. Whoever pushed that software out the door must have been drunk…. 2010 works with all my OS’s XP, Vista, “7” 32 64 Macrium as well .

3. However … you did not comment on Acronis “System State Function” ….did you see my screen shot with their comments about it?

4. If you wish i would be willing to test it out for you … for me there was never any reason to …so i never tried fooling with it … If it works I’m sure that you could still find a copy of it “Out There”..

5. Glad you didn’t take my “Crab Story” personally…. :cheers: Regards Fred

Reply | Quote

Just Plain Fred,

The numbers refer to your message #25.

1.

Likely the drivers for the hard drives will be wrong

Acronis liked that explanation, too, in their forum replies, but that can’t explain the “Disk Director 11” problem. FOA, I was substituting a hard disk that was, in fact, identical to my current hard disk and for which there are no special drivers. Secondly, please note that when I partitioned the hard disk with either PartitionMagic 8 or the XP Pro install CD, the installation occurred without hindrance. It was only when I used Disk Director that the install froze after the first reboot.

so no boot, been there done that

Actually, no boot due to the use of a single partitioning program and no boot without any error message, I’ve only been there once, and I never want to revisit. I will never purchase the Acronis brand again.

3.

you did not comment on Acronis “System State Function”

Well, I sorta did. If Acronis is not capable of delivering a partitioning product that partitions correctly, I could never trust them to back up system state. Anything Acronis claims to do I will view skeptically. BTW, I’m not stating that their True Image product doesn’t work, but I will hew to the last sentence in my previous paragraph.

4.

If you wish i would be willing to test it out for you

Thanks for the cue, since that neatly brings me back to my question in this thread, “What’s a sure-fire method to back up the entire XP Pro system state? Will backing up the registry, including the user hives, and MetaBase.bin be sufficient?”

If we know how to back up system state, we can test the Acronis backup method. Otherwise, I’m no better off than I am now, wondering whether I’ve backed up all of it. IAC, I certainly couldn’t take Acronis’ word for it.

regards, Andy

Reply | Quote

The numbers refer to your message #25.

Acronis liked that explanation, too, in their forum replies, but that can’t explain the “Disk Director 11” problem. FOA, I was substituting a hard disk that was, in fact, identical to my current hard disk and for which there are no special drivers. Secondly, please note that when I partitioned the hard disk with either PartitionMagic 8 or the XP Pro install CD, the installation occurred without hindrance. It was only when I used Disk Director that the install froze after the first reboot.

Hi Andy,
Just my final thought on this …XP Pro Installation disk give the opportunity to install the correct drivers when installing the XP OS to a new system

1. The “F6” option but you have to have a “Floppy” and a driver disk….otherwise it only has IDE Drivers…So the OS won’t boot with your BIOS set for AHCI.

2. There are two ways that i know of to get the correct drivers ( AHCI) to load. One is to “Slipstream” them into the OS using nLite… or use a Imaging program to insert them into the OS at boot time with programs like Acronis, or Macrium bare metal install

3. If your new PC Bios is set to AHCI (SATA) you will not be able to boot the XP OS because of the lack of drivers for the Hard Drive. the XP OS only has IDE natively …Or at least my XP install disk does.

Hope this thread has helped you in some way … I will explore the “Acronis System state” function as soon as i finish here… :cheers: Regards Fred

Reply | Quote

Just Plain Fred,

Thanks for your input. (We’re digressing from the main subject.)

If my hard disk required special drivers under XP Pro (provided at the F6 prompt), the install could not have succeeded after partitioning with PartitionMagic 8 or the XP Pro install CD without the same drivers. But it did succeed and I never ever provided drivers via F6.

FWIW, I have not configured AHCI in the BIOS. I don’t use it under XP Pro. During my testing, Acronis Disk Director 11 was solely responsible for the boot failure during the XP Pro install.

regards, Andy

Reply | Quote

In 30 years, I’ve never heard anyone use the term “System State”.

What exactly are you talking about? Be specific!

Reply | Quote

@PCDr:

Andy, I can’t answer you specific question: “will backing up the registry including user hives and Metabase.bin be a sure fire way to backup the XP Pro system state” because I would have expected just the backing up the registry as in NTBackup to do that. Clearly, from your tests, that’s not the case which is quite a surprise and a concern to me.

However, would low level access to the built in System Restore points do what you need? Could you use something like System Restore Explorer to mount or manipulate a restore point to backup the system state?

I think System Restore Explorer may have issues with XP, so might not be capable; but like Batcher in post #11 , I’m thinking what you need is access to the VSS Snapshots.

Reply | Quote

Tinto Tech,

would low level access to the built in System Restore points do what you need?

you need is access to the VSS Snapshots

One, or both, techniques might work, but it’s like swatting a fly with a sledgehammer. If I can somehow get a list of what files comprise the XP system state, I can then ensure that I back up those files. Sure, I could also back up restore points in System Volume Information, but it’s probably not adding anything useful to the files I already back up.

As it stands now, I back up files and what my backup program considers to be the system state. I then back up the registry (via NT’s old REGBACK.EXE or ERUNT.EXE), add MetaBase.bin, and use NTBACKUP.EXE to make a small (< 20 MB) system state backup that excludes protected system files. It's scripted, so it runs itself.

If I need to restore the OS, my strategy is to restore the files, restore the registry and MetaBase.bin, and then start up. All the rest is insurance if something goes wrong. Which brings me back to my question about a sure-fire way to back up the XP system state so nothing does go wrong. (In my tests, my strategy worked fine, but I could be missing something. For instance, how would one test that the "COM+ Class Registration database" is intact?)

regards, Andy

Reply | Quote

I don’t think there’s an easy way to validate a COM+ catalog. From what I understand, it’s not exposed to the OS for standard manipulation; I believe you have to use the COM+ Administration Library to gain access to the catalog because it’s a hybrid of registry and COM+ database.

While reading up on this (a useful technical refresher at the same time), was reminded of the COM+ replication utility COMREPL.

On the other hand, while it may be that using VSS tools would be like using a sledgehammer to crack a nut, I suspect that with the dearth of information readily available, that route may presently be among the limited number of options to guarantee a reliable and robust system state backup. My feeling is that it may be just one of those uneasy compromises.

Having said that, absense of evidence is not evidence of absense and I would be quite interested if you are successful in determining a reliable and robust mechanism.

Reply | Quote

PCDr : Not sure if it the same thing, but you could do a search for “Get XP-Mode working after restoring Windows 7 system drive image” which I had initiated inside this forum. Or just search for all posts using my name – this should take you to the link. I am posting the link – but am not sure whether it will work for you as it might be linked to my name.

http://windowssecrets.com/forums/showthread//153356-Get-XP-Mode-working-after-restoring-Windows-7-system-drive-image?p=899816#post899816

HTH

Mike Dee

Reply | Quote

DrWho,

System State has been defined by Microsoft here and here. (Look for the parts that begin “System state consists of the following:”) You’ll notice that the definitions, though similar, are not identical. That’s fairly common with “system state.” No two sources ever quite agree on exactly what it contains. Every source includes the registry. It also contains a myriad of other components. One of my favorites is “COM+ Class Registration database,” which is invariably cited without providing a good definition of where it’s found or what it does. (I’m in no way implying it doesn’t do anything. The citations, which are not numerous, just parrot the same information.)

IAC, I had thought for years that backing up the XP system state with my backup program would suffice in case of a need to restore the OS. It turns out that my backup program overlooked one (critical) component of system state, MetaBase.bin, the database for IIS 5.1. It may be overlooking other system state components. That started my quest to learn more about how to reliably back up the system state so that it can be reliably restored. Unfortunately, there isn’t much information about system state backup. (FWIW, I may have discovered a bug in the backup program, which has been around for roughly a decade.)

HTH.

regards, Andy

Reply | Quote

You really don’t have to worry about what’s in the backup, if….

you use a known and trusted Hard Drive Backup program that starts at Bit Zero and copies every bit of info on your hard drive out to the very last bit. That’s known as a “Bit Copier” that doesn’t give a hoot what the bit is….. it just copies it.
I use “Ghost, 11.5” run from a DOS boot disk. It copies every bit, skipping empty sectors. So when I do a restore, every file is written back to the hard drive, in perfect, Un-Fragmented condition, with NO spaces between files.

Then when I have to do a restore, every bit is put back just like it was copied….warts and all.

That’s why I do a massive cleanup on my C drive before I ever do a backup, so I’m not copying junk.

If doing backups, it’s pointless to try to decide what you want to backup. Just get it all.
Because, when you’re trying to restore your OS and data to a new (blank) hard drive, you’re going to need EVERYTHING anyway. Eh?

Hi Fred!

Doc

Reply | Quote

But….Consider if all you are interested in is the System State, a few copies of a system image and your data safe and sound on a network store somewhere.

If I can deploy a previously saved golden image of the OS, plus the System State, and my data is be on a SAN somewhere, why would I want to have 100’s of GB or more in multiple copies of the OS floating around.

An effective method is to hold one or two copies of the OS as an image, then much smaller multiple copies of the System State.

Take an example: Say 40GB for two copies of the OS and applications, plus perhaps 10GB for 100 versions of the system state going back in time. Compare that to 100 disk images at 10GB each = 1TB of data. Even if the example is way out and it takes 20, 30, or even 100GB to store 100 versions of system state, the disk cost saving is huge.

I don’t know if Andy (PCDr) is planning this for a business environment, but now imagine 500 PC’s with multiple versions of System State. Would you prefer to ask the CIO for 500TB of storage for multiple OS images, or 40GB for two images and a 5TB for 500 sets System States from client PC’s on the network.

Full disk imaging is a great tool, but it isn’t the solution to everything.

Reply | Quote

DrWho,

I understand your backup strategy. I use a different strategy. I favor file-based backup over imaging. I’m asking a single question in this thread, “What’s the best way to back up the XP system state?”

Just the same, I’ll digress a bit.

If I followed the strategy you propose, I’d have one, or a few, system images. I prefer to have copies of changed files, the system state included.

If I want to restore my system to what it was three weeks, months, or years ago, I can. If I want to find a file that I created three weeks, months, or years ago, I can. (I was recently frustrated when I looked for a file that was present five years ago. Unfortunately, I was backing up to DLT tape at that time and that drive and its tapes are long gone.)

Images are terrific for my corporate customers, who need to be able to get a new PC prepared quickly that meets company specs and who need to be able to restore a damaged PC to the same specs before it’s returned to the user. I’ve been instrumental in developing written imaging procedures for such customers that are followed at a number of sites.

My needs are different, so I use a different backup strategy.

During my testing with XP Pro, my strategy appeared to work correctly. My nagging doubts are the reason for my post. If I can’t get better info about how to back up XP system state, I’ll maintain my strategy without the benefit of independent confirmation of system state integrity.

I do believe that I would have been technically and professionally negligent had I not asked the question in this forum.

regards, Andy

Reply | Quote

Tinto Tech,

Thanks for the link to COMREPL (Com+ Replication). I would have preferred a link to COMCOPY.

one of those uneasy compromises

I believe you’re right. My current backup strategy falls into this category.

would be quite interested if you are successful in determining a reliable and robust mechanism

If that happens, I’ll append to this thread, if it’s still open.

regards, Andy

Reply | Quote

DavidFB,

Imaging has been discussed in this thread. Please look at messages 3 – 6, 19, 20, 23, & 24.

Regular backup programs are for saving a copy of data but do a bad job of saving a system state due to locked in-use files.

Backup programs that I use have no problem saving in-use files. I take issue, then, with your statement.

A friend of mine used Retrospect for data and it failed that too.

I’m sorry to hear about your friend’s experience. I have had no problems accessing the data that’s been backed up by Retrospect.

Zip can always be accessed, whatever the circumstance, even a dead OS

True, but the first step I take when I restore my OS is to reinstall my backup program, so the proprietary format is not an issue. I also use on-line backup for certain files that I need off site.

Imaging [is] the nature of the technology. It’s not opinion.

In my opinion, it is opinion.

ONLY imaging is able to save the complete System state

Could you provide a source for your statement? If it can be demonstrated that system state can’t be backed up, then file-based backup won’t work. (I don’t believe you’re going have an easy time of proving what you said.)

You don’t state why you don’t like images

I never said it. I did state why I back up files and the system state instead of imaging in message #24.

regards, Andy

Reply | Quote