Windows XP Backup

Windows XP Backup provides a large amount of options to backup, restore and repair your system. Backups are typically written to one or more tapes, examples being DLT and DAT drives, but Windows Backup also provides the option to backup to a file, which then can be written to removable storage such as a CD, DVD, or a network share.

One of the main improvements of Windows Backup in Windows XP is the volume shadow copy technology. This allows a point-in-time copy of an entire volume including all open files such as system files and open databases. The same technology is also used in Windows 2003 to provide a similar function as the Recycle Bin, allowing users to restore deleted or corrupted files on network shares. For more information about this feature read the Windows 2003 Shadow Copy Volumes TechNotes.

Windows XP Backup can be started from the Start Menu by clicking Backup in All Programs|Accessories|System Tools. When it is run for the first time, the Backup or Restore Wizard starts by default. The wizard allows you to easily create a backup of your documents and settings, all users’ documents and settings, the entire computer, or a selection of files and/or folders. Additionally the wizard allows a restore with the default options by selecting a backup file. To perform backups and restores with specific options click the Advanced Mode when the wizard starts, which will open the Backup Utility.

The Backup Utility has a Welcome tab with three buttons to start an advanced Backup Wizard, an advanced Restore Wizard, or the Automated System Recovery (ASR) Wizard. The tasks performed by these wizards will be explained in the following paragraphs.

Backup

The Backup tab of the Backup Utility allows you to create and schedule backup jobs. Select the files and folders you want to back up, and on the bottom left, select the backup destination and provide a name for the media or file.

To start the backup, click the Start Backup button on the right bottom of the Backup tab. The Backup Job Information dialog box will appear as depicted below.


Provide a name for the backup job, a label and choose what should be done when the media already contains data. The option Allow only the owner and the Administrator access to the backup data is only available when Replace the data on the media with this backup is selected.

The Advanced button opens the Advanced Backup Option dialog box as shown below:

Selecting the option Back up data that is in Remote Storage backs up data that has been designated for Remote Storage. If you select this option, Remote Storage reparse points (placeholder files) are backed up. Remote Storage data can only be restored on an NTFS volume.

The option Verify data after backup allows you to verify that the backup is exactly the same as the original data. This usually has a huge impact on the time it takes to perform a backup.

The option If possible, compress the backup data to save space allows you to compress tape backups. This option is available only if you have a tape drive attached to your computer that supports data compression.

The option Automatically back up system protected files with the System State allows you to include all system files that are in your systemroot directory (i.e. c:\Windows) in addition to the files that are included with the System State data by default.

The option Disable volume shadow copy disables the point-in-time shadow copy method and reverts to the pre-Windows XP backup method. If this option is disabled, files that are in use or open might be skipped.

Select one of the following under Backup Type: copy, daily, differential, incremental, or normal. To understand the various common backup types, first you'll have to know about the archive file attribute. If a file has this attribute it means it has changed since the archive attribute was turned off. An archive attribute can be turned off by performing certain types of backup, or manually by using the 'attrib' command line utility or Windows Explorer for example. The table below lists the most common backup types:

Click OK after setting the advanced options to return to the Backup Job Information dialog box, where you can either start the backup immediately or schedule it to run at a future date and time. When you schedule the backup job, you will be prompted to save the current selection of files and folder, and you will need to provide a user account and password to run the job. This account must have sufficient permissions to backup the selected files and folders, and will become the owner of the backup. The Scheduled Job Option dialog box will open where you can provide a name for the job and one or more schedules. The Task Scheduler service will schedule and run the backup job. When the backup job is completed you will be able to view a report that shows a summary log of the backup job performed.

Backup jobs can also be created and scheduled from the Schedule tab of the Backup Utility. It provides a large calendar where you can select a day and click the Add Job to start the advanced Backup Wizard allowing you to backup the entire computer, a file and folder selection, or the System State Data.

Restore

The Restore and Manage Media tab of the Backup Utility allows you to restore backups and manage backup media. The latter includes formatting, erasing, and naming tapes as well as maintaining catalogs.

To restore a backup, select the backup on disk, tape, or other media, select the Restore Location and press the Start Restore button. You can choose to restore the files to their original location, an alternate location, or a single folder. When you choose to restore the backup to a single folder, the directory structure will be lost, thus all files will be placed in the same folder.

When you click the Start Restore button, the Confirm Restore dialog box appears as depicted below:

In most cases you’ll click ok to start the restore, but in some situations you may want to set Advanced Restore Options by clicking the Advanced button.

The Restore security option is enabled by default and only available if the backup is from an NTFS volume in Windows XP and you are restoring it to an NTFS volume in Windows XP. If you disable this option, security settings for files and folders, such as permissions, ownership, and audit entries, will not be restored.

The option Restore junction points, and restore file and folder data under junction points to the original location restores the junction points on your hard disk and the data that the junction points point to. If you are restoring a backup of a mounted drive and the data on it this option must be enabled.

The option When restoring replicated data sets, mark the restored data as the primary data for all replicas allows you to ensure that restored File Replication service (FRS) data is replicated to your other servers to ensure that other servers participating in the replicated data set do not overwrite the restored data because it is older.

The option Restore the Cluster Registry to the quorum disk and all other nodes ensures that the cluster database is replicated to all nodes in a server cluster.

The option Preserve existing volume mount points prevents any volume mount points you have created on the partition or volume prior to the restore from being overwritten. Disable this option if you want to restore the volume mount points from backup.

After you have set the advanced options, click OK, and then click OK again to start the restore. At the end of the restore you will be able to view a report showing a summary log of the restore operation.

Automated System Recovery

When the operating system does not start and the logon screen does not appear, you should first try to access and repair the system by booting in Safe Mode or using the Last Known Good configuration. If that does not work, you can try Automated System Recovery (ASR) as a last resort.

An ASR backup set is created by using the ASR Wizard in Backup. The wizard backs up the system state, system services, and all disks associated with the operating system components. It also creates a file containing information about the backup, the disk configurations (including basic and dynamic volumes) and how to accomplish a complete restore.

To use ASR to restore the system, you need to press F2 when prompted for ASR in the text-mode portion of setup. You will need to provide the floppy disk that contains the file created by the ASR Wizard, the media containing the actual data backup, and the Windows XP Installation CD. First, the volumes and partitions required to start the computer are recreated, and after a minimal version of Windows is installed, ASR will restore the backup created by the ASR wizard.

System State Data

The System State Data includes the registry, COM+ Class Registration database, and boot files. As mentioned earlier, the Advanced Options of a backup job allow you to include all system files under Windows File Protection that are in your systemroot directory (i.e. c:\Windows), if you back up the System State Data. This allows you to create a comprehensive backup of ‘just’ the operating system. To create a backup of the System State Data you can either run the Backup Wizard or use the Backup Utility. On the Backup tab of the Backup Utility, select the System State Data as depicted below, and click Start backup.

You must be an administrator on the local computer to back up and restore System State data. You can only backup the System State data on the local computer, not on a remote computer.

In case you want to restore the System State Data on a running computer, you should use the Backup Utility and perform the restore like you would perform a basic restore. Just select the System State Data from the backup file or media and click Start restore.

Ntbackup.exe

Windows XP also includes the command-line utility Ntbackup.exe. This utility can only be used to backup data, not to restore data. It can be used to create backups by running it from the command-prompt, but more often it is used in batch files.

Click the following link for more information about NTbackup.exe:
How to Use Command Line Parameters With the "Ntbackup" Command

Last Known Good configuration

There are several other methods available to repair your system without having to perform a restore from backup. The Last Known Good configuration is one of them. Those who took CompTIA’s A+ OS, Windows NT 4, the 70-210, or the 70-215 exam, know the Last Known Good configuration very well. It is one of Microsoft’s favorite exam topics.

The Last Known Good configuration is a backup copy of the current configuration stored in the registry key HKLM\System\CurrentControlSet and is updated when a user shuts down the system after successfully logging on. Restoring the information from this registry key can repair your system, for example when you added a driver that prevents the operating system from loading.

So when you changed the configuration of your system and the OS fails to load after you restart the computer, you should press F8 when you see the message Please select the operating system to start, and select the Last Known Good Configuration from the Windows Advanced Options Menu. The Last Known Good configuration is only useful if you have not logged on yet. When you logon and shut down or restart the system, the current configuration will become the Last Known Good configuration.

Safe mode

If you still cannot start Windows, and you already tried the Last know Good configuration, you can try to boot Windows in Safe Mode. In Safe mode, Windows loads only the mouse, monitor, keyboard, mass storage, and base video drivers. Only the default system services are started and there is no support for networking. This allows you to troubleshoot the system if it does not start normally. For example, you can remove installed drivers and devices, view log files, repair the registry, and run System Restore. A common situation in which you should start in Safe Mode is when Windows XP doesn't start because of incorrect video drivers or settings. In Safe Mode, the default VGA driver (vga.sys) is used with display settings 640 x 480 with 16 colors.

Many services and programs are not available in Safe Mode. For example the Removable Storage services that is used to provide access to tape devices and other storage devices, cannot be started in Safe Mode, hence you cannot perform a backup or restore from tape. Only accounts with administrative permissions on the local machine can log on to Windows XP in safe mode.

To use a Safe Boot option, choose the appropriate type of Safe Mode from the Windows Advanced Options Menu, which can be accessed by pressing F8 when the computer starts or when the boot menu appears. Besides the standard Safe Mode option, there are several other types of Safe Mode available:

- Safe Mode with Networking, loads all of the essential services and drivers required to support networking. This can be useful if you need to download drivers or tools to repair the system.
- Safe Mode with Command Prompt, is the same as safe mode but starts the command prompt (cmd.exe) instead of the GUI.
- Use Last Known Good Configuration, starts Windows by using a previous configuration, and as described earlier, is available from this menu.
- Enable VGA Mode, starts Windows with a resolution of 640 x 480 using the current video driver, instead of the standard Vga.sys driver that is normally used in safe mode. This option can be used if you changed the display settings and set the resolution too high for your monitor.
- Debugging Mode, starts Windows in debugging mode, allowing you to sent debugging information across a serial cable to another computer running a debugger.
- Enable Boot Logging, enables logging when the computer is started in a Safe Mode. The information will be stored in the Ntbtlog.txt file in the %SystemRoot% folder.

System Restore

System Restore can be used to restore your computer to a previous state, if a problem occurs, without losing your personal data files (such as MS Office files, Internet history, pictures, favorites, and e-mail). System Restore monitors changes to the system and some application files, and automatically creates periodic restore points. These restore points allow you to revert the system to a previous state. They are created daily and when significant system events occur (i.e. when an application or driver is installed). You can also create and name your own restore points at any time.

System Restore is available from the System Tools start menu folder (Start|All Programs|Accessories|System Tools). When you run System Restore you can either restore your computer to a previous time or create a restore point:

When the restore completed, you should check if the system is indeed fixed. If you start System Restore after having performed a restore, there will be an option called Undo my last restoration.

The System Restore tab of the System Properties, depicted below, allows you to configure System Restore settings per volume, or turn it off entirely. To turn off System Restore for the system drive, you need to turn it off for all individual volumes first. The Settings button allows you to configure the maximum amount of disk space available for restore points, with a maximum of 12% of the volume’s total size.

Device Driver Roll Back

If you changed the driver for a device and the system becomes unstable, but you are able to boot to the GUI, you can use Device Driver Roll Back to reinstall the previous driver. To restore the previous driver of a device, in Device Manager right-click the device and click Properties, and click the Roll Back Driver button on the Driver tab.

Recovery Console

If the computer hangs during or after startup and you cannot boot in safe mode, you can try to repair the system by using the Recovery Console. If you haven’t added the Recovery Console to the boot menu by using the winnt32.exe /cmdcons command, you need the Windows XP Setup CD and choose Recovery Console by pressing R when prompted during the text-mode setup stage. Use the local Administrator account’s password to gain access.

You can perform any of the following tasks in the Recovery Console to repair your computer:
• Enable or disable drivers or services to start at startup.
• Copy files from the Windows Setup CD or other removable media.
• Create a new boot sector and new master boot record (MBR).
• Create and format partitions on drives.

The following limited set of commands is available in the Recovery Console:

• Attrib
• Batch
• Bootcfg
• CD (Chdir)
• Chkdsk
• Cls
• Copy
• Del (Delete)
• Dir
• Disable
• Diskpart
• Enable
• Exit
• Expand
• Fixboot
• Fixmbr
• Format
• Help
• Listsvc
• Logon
• Map
• MD (Mkdir)
• More/Type
• Net use
• Rd (Rmdir)
• Ren (Rename)
• Set
• Systemroot

For more information about how to use the Recovery Console:
- Description of the Windows XP Recovery Console
- HOW TO: Install and Use the Recovery Console in Windows XP