59311: Acronis Backup: what does a disk backup store

Last update: Mi, 2016-12-21 14:22

A disk or volume backup stores a disk or a volume file system as a whole and includes all of the information necessary for the operating system to boot. It is possible to recover disks or volumes as a whole from such backups as well as individual folders or files.

Windows

A volume backup stores all files and folders of the selected volume independent of their attributes (including hidden and system files), the boot record, the file allocation table (FAT) if it exists, the root and the zero track of the hard disk with the master boot record (MBR).

A disk backup stores all volumes of the selected disk (including hidden volumes such as the vendor's maintenance partitions) and the zero track with the master boot record.

The following items are not included in a disk or volume backup:

  • The swap file (pagefile.sys) and the file that keeps the RAM content when the machine goes into hibernation (hiberfil.sys). After recovery, the files will be re-created in the appropriate place with the zero size.
  • Windows shadow storage. The path to it is determined in the registry value VSS Default Provider which can be found in the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\BackupRestore\FilesNotToBackup. This means that in operating systems starting with Windows Vista, Windows Restore Points are not backed up.
  • Deleted files, folders, blocks of data.

Linux

A volume backup stores all files and directories of the selected volume independent of their attributes, a boot record, and the file system super block.

A disk backup stores all disk volumes as well as the zero track with the master boot record.

The following items are not included in a disk or volume backup:

  • Deleted files, folders, blocks of data.

Sector-by-sector backup

With the sector-by-sector (raw mode) option enabled, a disk backup stores all the disk sectors as is at the moment of backup, independently of whether the contained data has been deleted by a user and is therefore inaccessble on the operating and file system level without special forensic research tools (capable for analysis of raw disk sectors). The sector-by-sector backup can be used for backing up disks with unrecognized or unsupported file systems and other proprietary data formats.