XP Backup provides a large amount of options to backup, restore
and repair your system. Backups are typically written to one or
more tapes, examples being DLT and DAT drives, but Windows Backup
also provides the option to backup to a file, which then can be
written to removable storage such as a CD, DVD, or a network share.
of the main improvements of Windows Backup in Windows XP is the
volume shadow copy technology. This allows a point-in-time
copy of an entire volume including all open files such as system
files and open databases. The same technology is also used in Windows
2003 to provide a similar function as the Recycle Bin, allowing
users to restore deleted or corrupted files on network shares. For
more information about this feature read the Windows
2003 Shadow Copy Volumes TechNotes.
XP Backup can be started from the Start Menu by clicking Backup
in All Programs|Accessories|System Tools. When it is run
for the first time, the Backup or Restore Wizard starts
by default. The wizard allows you to easily create a backup of your
documents and settings, all users’ documents and settings,
the entire computer, or a selection of files and/or folders. Additionally
the wizard allows a restore with the default options by selecting
a backup file. To perform backups and restores with specific options
click the Advanced Mode when the wizard starts, which will
open the Backup Utility.
Backup Utility has a Welcome tab with three buttons
to start an advanced Backup Wizard, an advanced Restore
Wizard, or the Automated System Recovery (ASR) Wizard.
The tasks performed by these wizards will be explained in the following
Backup tab of the Backup Utility allows you to
create and schedule backup jobs. Select the files and folders you
want to back up, and on the bottom left, select the backup destination
and provide a name for the media or file.
start the backup, click the Start Backup button on the
right bottom of the Backup tab. The Backup Job Information
dialog box will appear as depicted below.
Provide a name for the backup job, a label and choose what should
be done when the media already contains data. The option Allow
only the owner and the Administrator access to the backup data
is only available when Replace the data on the media with this
backup is selected.
The Advanced button opens the Advanced Backup Option
dialog box as shown below:
the option Back up data that is in Remote Storage backs
up data that has been designated for Remote Storage. If you select
this option, Remote Storage reparse points (placeholder files) are
backed up. Remote Storage data can only be restored on an NTFS volume.
option Verify data after backup allows you to verify that
the backup is exactly the same as the original data. This usually
has a huge impact on the time it takes to perform a backup.
The option If possible, compress the backup
data to save space allows you to compress tape backups. This
option is available only if you have a tape drive attached to your
computer that supports data compression.
option Automatically back up system protected files with the
System State allows you to include all system files that are
in your systemroot directory (i.e. c:\Windows) in addition to the
files that are included with the System State data by default.
option Disable volume shadow copy disables the point-in-time
shadow copy method and reverts to the pre-Windows XP backup method.
If this option is disabled, files that are in use or open might
Select one of the following under Backup Type:
copy, daily, differential, incremental, or normal. To understand
the various common backup types, first you'll have to know about
the archive file attribute. If a file has this attribute
it means it has changed since the archive attribute was turned off.
An archive attribute can be turned off by performing certain types
of backup, or manually by using the 'attrib' command line utility
or Windows Explorer for example. The table below lists the most
common backup types:
up every selected file, regardless of the archive attribute
setting, and clears the archive attribute.
up every selected file, regardless of the archive attribute
setting. Does not clear the archive attribute.
up every selected file that has changed that day, regardless
of the archive attribute setting. Does not clear the archive
Backs up only those files created or changed since the last
normal or incremental backup, and clears the archive attribute.
This method is used in combination with a periodic full backup.
For example, a Normal/Full backup on Mondays and an incremental
backup on the remaining days of the week. In case of a restore,
you will need the last normal backup as well as all
incremental backups since the last normal backup.
up only those files created or changed since the last normal
or incremental backup, but does not clear the archive attribute.
This method is also used in combination with a periodic full
backup. For example, a Normal/Full backup on Mondays and a differential
backup on the remaining days of the week. In case of a restore,
you will need the last normal backup and the last differential
Click OK after setting the advanced options to
return to the Backup Job Information dialog box, where
you can either start the backup immediately or schedule it to run
at a future date and time. When you schedule the backup job, you
will be prompted to save the current selection of files and folder,
and you will need to provide a user account and password to run
the job. This account must have sufficient permissions to backup
the selected files and folders, and will become the owner of the
backup. The Scheduled Job Option dialog box will open where
you can provide a name for the job and one or more schedules. The
Task Scheduler service will schedule and run the backup
job. When the backup job is completed you will be able to view a
report that shows a summary log of the backup job performed.
Backup jobs can also be created and scheduled from
the Schedule tab of the Backup Utility. It provides
a large calendar where you can select a day and click the Add
Job to start the advanced Backup Wizard allowing you
to backup the entire computer, a file and folder selection, or the
System State Data.
Restore and Manage Media tab of the Backup Utility
allows you to restore backups and manage backup media. The latter
includes formatting, erasing, and naming tapes as well as maintaining
restore a backup, select the backup on disk, tape, or other media,
select the Restore Location and press the Start Restore
button. You can choose to restore the files to their original location,
an alternate location, or a single folder. When you choose to restore
the backup to a single folder, the directory structure will be lost,
thus all files will be placed in the same folder.
you click the Start Restore button, the Confirm Restore
dialog box appears as depicted below:
most cases you’ll click ok to start the restore, but in some
situations you may want to set Advanced Restore Options
by clicking the Advanced button.
Restore security option is enabled by default and only
available if the backup is from an NTFS volume in Windows XP and
you are restoring it to an NTFS volume in Windows XP. If you disable
this option, security settings for files and folders, such as permissions,
ownership, and audit entries, will not be restored.
The option Restore junction points, and restore file and folder
data under junction points to the original location restores
the junction points on your hard disk and the data that the junction
points point to. If you are restoring a backup of a mounted drive
and the data on it this option must be enabled.
The option When restoring replicated data sets, mark the restored
data as the primary data for all replicas allows you to ensure
that restored File Replication service (FRS) data is replicated
to your other servers to ensure that other servers participating
in the replicated data set do not overwrite the restored data because
it is older.
The option Restore the Cluster Registry to the quorum disk and
all other nodes ensures that the cluster database is replicated
to all nodes in a server cluster.
The option Preserve existing volume mount points prevents
any volume mount points you have created on the partition or volume
prior to the restore from being overwritten. Disable this option
if you want to restore the volume mount points from backup.
After you have set the advanced options, click OK, and then click
OK again to start the restore. At the end of the restore you will
be able to view a report showing a summary log of the restore operation.
Automated System Recovery
When the operating system does not start and the
logon screen does not appear, you should first try to access and
repair the system by booting in Safe Mode or using the Last
Known Good configuration. If that does not work, you can try
Automated System Recovery (ASR) as a last resort.
An ASR backup set is created by using the ASR
Wizard in Backup. The wizard backs up the system state, system
services, and all disks associated with the operating system components.
It also creates a file containing information about the backup,
the disk configurations (including basic and dynamic volumes) and
how to accomplish a complete restore.
use ASR to restore the system, you need to press F2 when prompted
for ASR in the text-mode portion of setup. You will need to provide
the floppy disk that contains the file created by the ASR Wizard,
the media containing the actual data backup, and the Windows XP
Installation CD. First, the volumes and partitions required to start
the computer are recreated, and after a minimal version of Windows
is installed, ASR will restore the backup created by the ASR wizard.
System State Data
System State Data includes the registry, COM+ Class Registration
database, and boot files. As mentioned earlier, the Advanced
Options of a backup job allow you to include all system files
under Windows File Protection that are in your systemroot
directory (i.e. c:\Windows), if you back up the System State Data.
This allows you to create a comprehensive backup of ‘just’
the operating system. To create a backup of the System State Data
you can either run the Backup Wizard or use the Backup
Utility. On the Backup tab of the Backup Utility,
select the System State Data as depicted below, and click
You must be an administrator on the local computer
to back up and restore System State data. You can only backup the
System State data on the local computer, not on a remote computer.
case you want to restore the System State Data on a running computer,
you should use the Backup Utility and perform the restore
like you would perform a basic restore. Just select the System
State Data from the backup file or media and click Start
XP also includes the command-line utility Ntbackup.exe.
This utility can only be used to backup data, not to restore data.
It can be used to create backups by running it from the command-prompt,
but more often it is used in batch files.
the following link for more information about NTbackup.exe:
to Use Command Line Parameters With the "Ntbackup" Command
Last Known Good configuration
There are several other methods available to repair
your system without having to perform a restore from backup. The
Last Known Good configuration is one of them. Those who
took CompTIA’s A+ OS, Windows NT 4, the 70-210, or the 70-215
exam, know the Last Known Good configuration very well. It is one
of Microsoft’s favorite exam topics.
The Last Known Good configuration is a backup copy
of the current configuration stored in the registry key HKLM\System\CurrentControlSet
and is updated when a user shuts down the system after successfully
logging on. Restoring the information from this registry key can
repair your system, for example when you added a driver that prevents
the operating system from loading.
So when you changed the configuration of your system
and the OS fails to load after you restart the computer, you should
press F8 when you see the message Please select the operating
system to start, and select the Last Known Good Configuration
from the Windows Advanced Options Menu. The Last Known
Good configuration is only useful if you have not logged on yet.
When you logon and shut down or restart the system, the current
configuration will become the Last Known Good configuration.
If you still cannot start Windows, and you already
tried the Last know Good configuration, you can try to boot Windows
in Safe Mode. In Safe mode, Windows loads only the mouse,
monitor, keyboard, mass storage, and base video drivers. Only the
default system services are started and there is no support for
networking. This allows you to troubleshoot the system if it does
not start normally. For example, you can remove installed drivers
and devices, view log files, repair the registry, and run System
Restore. A common situation in which you should start in Safe Mode
is when Windows XP doesn't start because of incorrect video drivers
or settings. In Safe Mode, the default VGA driver (vga.sys) is used
with display settings 640 x 480 with 16 colors.
Many services and programs are not available in
Safe Mode. For example the Removable Storage services that is used
to provide access to tape devices and other storage devices, cannot
be started in Safe Mode, hence you cannot perform a backup or restore
from tape. Only accounts with administrative permissions on the
local machine can log on to Windows XP in safe mode.
To use a Safe Boot option, choose the
appropriate type of Safe Mode from the Windows Advanced Options
Menu, which can be accessed by pressing F8 when the computer
starts or when the boot menu appears. Besides the standard Safe
Mode option, there are several other types of Safe Mode available:
- Safe Mode with Networking, loads all of the essential
services and drivers required to support networking. This can be
useful if you need to download drivers or tools to repair the system.
- Safe Mode with Command Prompt, is the same as safe mode
but starts the command prompt (cmd.exe) instead of the GUI.
- Use Last Known Good Configuration, starts Windows by
using a previous configuration, and as described earlier, is available
from this menu.
- Enable VGA Mode, starts Windows with a resolution of
640 x 480 using the current video driver, instead of the standard
Vga.sys driver that is normally used in safe mode. This option can
be used if you changed the display settings and set the resolution
too high for your monitor.
- Debugging Mode, starts Windows in debugging mode, allowing
you to sent debugging information across a serial cable to another
computer running a debugger.
- Enable Boot Logging, enables logging when the computer
is started in a Safe Mode. The information will be stored in the
Ntbtlog.txt file in the %SystemRoot% folder.
can be used to restore your computer to a previous state, if a problem
occurs, without losing your personal data files (such as MS Office
files, Internet history, pictures, favorites, and e-mail). System
Restore monitors changes to the system and some application files,
and automatically creates periodic restore points. These restore
points allow you to revert the system to a previous state. They
are created daily and when significant system events occur (i.e.
when an application or driver is installed). You can also create
and name your own restore points at any time.
Restore is available from the System Tools start menu
folder (Start|All Programs|Accessories|System Tools). When
you run System Restore you can either restore your computer
to a previous time or create a restore point:
When the restore completed, you should check if the system is indeed
fixed. If you start System Restore after having performed
a restore, there will be an option called Undo my last restoration.
System Restore tab of the System Properties, depicted
below, allows you to configure System Restore settings
per volume, or turn it off entirely. To turn off System Restore
for the system drive, you need to turn it off for all individual
volumes first. The Settings button allows you to configure
the maximum amount of disk space available for restore points, with
a maximum of 12% of the volume’s total size.
Device Driver Roll Back
you changed the driver for a device and the system becomes unstable,
but you are able to boot to the GUI, you can use Device Driver
Roll Back to reinstall the previous driver. To restore the
previous driver of a device, in Device Manager right-click
the device and click Properties, and click the Roll
Back Driver button on the Driver tab.
If the computer hangs during or after startup and
you cannot boot in safe mode, you can try to repair the system by
using the Recovery Console. If you haven’t added
the Recovery Console to the boot menu by using the winnt32.exe
/cmdcons command, you need the Windows XP Setup CD and choose Recovery
Console by pressing R when prompted during the text-mode setup
stage. Use the local Administrator account’s password to gain
You can perform any of the following tasks in the Recovery Console
to repair your computer:
• Enable or disable drivers or services to start at startup.
• Copy files from the Windows Setup CD or other removable
• Create a new boot sector and new master boot record (MBR).
• Create and format partitions on drives.
The following limited set of commands is available in the Recovery
• CD (Chdir)
• Del (Delete)
• MD (Mkdir)
• Net use
• Rd (Rmdir)
• Ren (Rename)
For more information about how to use the Recovery
of the Windows XP Recovery Console
TO: Install and Use the Recovery Console in Windows XP