If this is your first visit, be sure to check out the FAQ by clicking the link above. You may have to register before you can post: click the register link above to proceed. To start viewing messages, select the forum that you want to visit from the selection below. |
|
|
Thread Tools | Display Modes |
#1
|
|||
|
|||
Does Macrium really clone and image drives?
This post and my next one are two related problems.
I'm running Vista, but for this first problem, the OS seems less important than that the partitions are NTFS. How did Macrium Reflect clone a partition and still miss more than 1300 files? I used Macrium Reflect Free to clone (not image) the C: partition, and there were no errors reported. It's a sector by sector copy so I don't think this relates to any partcular file. Later, before changing from my current drive, which is 90% full to the other drive, where the partition is twice as big, I wanted to copy the most recently updated data files to the clone, to make it a real clone. I used XXCopy /clone but the choice of methods is less important than the result. XXCopy gave more than 1300 copy errors, all because of access problems (all of them in two directories, Windows and one other) plus another set of files and directories that were copied successfully (I forget how many there were, and I can't check now.) The problem is no longer that they weren't copied but that that they needed to be copied. I only checked 6 of them but none of the 6 were in the destination, the "clone". I suspect the other 1300 weren't there either because xxcopy wouldn't have tried to copy them if they were there. (After all, the drive had over 100,000 files and it only tried to copy 1300+.) How can that be if Macrium was making a clone? How can they call it a clone if it's missing 1300+ files? If it can't clone a drive sucessfullly, why should one think that it images drives successfully? Unfortunately, I've screwed up the whole computer, and it will be hard for probably at least a week to answer those questions of yours that require looking at the computer. But I wanted to write this up when it was fresh on my mind. |
Ads |
#2
|
|||
|
|||
Does Macrium really clone and image drives?
micky wrote:
This post and my next one are two related problems. I'm running Vista, but for this first problem, the OS seems less important than that the partitions are NTFS. How did Macrium Reflect clone a partition and still miss more than 1300 files? I used Macrium Reflect Free to clone (not image) the C: partition, and there were no errors reported. It's a sector by sector copy so I don't think this relates to any partcular file. Later, before changing from my current drive, which is 90% full to the other drive, where the partition is twice as big, I wanted to copy the most recently updated data files to the clone, to make it a real clone. I used XXCopy /clone but the choice of methods is less important than the result. XXCopy gave more than 1300 copy errors, all because of access problems (all of them in two directories, Windows and one other) plus another set of files and directories that were copied successfully (I forget how many there were, and I can't check now.) The problem is no longer that they weren't copied but that that they needed to be copied. I only checked 6 of them but none of the 6 were in the destination, the "clone". I suspect the other 1300 weren't there either because xxcopy wouldn't have tried to copy them if they were there. (After all, the drive had over 100,000 files and it only tried to copy 1300+.) How can that be if Macrium was making a clone? How can they call it a clone if it's missing 1300+ files? If it can't clone a drive sucessfullly, why should one think that it images drives successfully? Unfortunately, I've screwed up the whole computer, and it will be hard for probably at least a week to answer those questions of yours that require looking at the computer. But I wanted to write this up when it was fresh on my mind. Missing from this description, is "how many Windows Updates did you do, the minute the Macrium clone was finished" ? You are doing forensics, without "freezing" the partitions. ******* I made the exact same mistake, when I tested xxcopy when you were describing your problem. I booted the C: drive *before* I properly analyzed it. Here is the test case to run, to give your favorite cloning method a chance to work. 1) Equip a machine with a C: drive and a destination drive. It helps if you label at least one partition, to make the names a bit more manageable later. For example, my C: might be WIN7. Not all methods make it easy to control the name - cloning would create two "WIN7" labeled partitions. 2) Run the software under test from a CD. This is intended to "freeze" things during the test phase. You don't want the source drive to have any opportunity to change itself, before you get to step (5). For Macrium, use the Macrium CD. For XXCOPY, use WinPE via booting the install DVD or recovery CD. A WinPE disc gives you a command prompt to use. 3) Do your best to copy/clone. 4) Restart. 5) Boot your Linux Live DVD. Do *not* allow the source OS disk to boot, before completing the forensic data collection in step (5). Click the source and destination disks, to mount them in Linux. Open a terminal: find /media/mint/WIN7 -type d -exec ls -al -1 -d {} + /tmp/WIN7_dirs.txt find /media/mint/WIN7 -type f -exec ls -al -1 {} + /tmp/Win7_files.txt find /media/mint/DEST -type d -exec ls -al -1 -d {} + /tmp/DEST_dirs.txt find /media/mint/DEST -type f -exec ls -al -1 {} + /tmp/DEST_files.txt Edit each of the files with gedit (graphical text editor). The name of the text editor might be "pluma" as another possibility. They use different names on the various Linux distros. Remove the root part of the file path on each line, so that the files can be diffed. Save the edited files. Then diff /tmp/WIN7_dirs.txt /tmp/DEST_dirs.txt /tmp/diff_dirs.txt diff /tmp/WIN7_files.txt /tmp/DEST_filess.txt /tmp/diff_files.txt Copy (using file sharing), the six files you have created in /tmp, over to some other Windows machine. The contents of /tmp are in RAM, and will not survive a reboot of any kind. They must be copied somewhere for safe keeping. 6) At your leisure, look at the six files using Wordpad in Windows. Do a "save" to correct the Linux line endings. You can now use Notepad on any of them, once Wordpad has "laundered" them. 7) The end result should be, a very small number of differences in the diff_* files. For the test to work, you want to select timestamp preservation. Macrium would do this. xxcopy does it with /tc . If you boot C: after step (5), expect the file complement to change after each usage. Especially after any sort of Windows Update. Running "xxcopy" in WinPE, respects permissions. You're running as Administrator. Macrium obviously has a better recipe than that. I have no idea what account it uses (no proof). It could be using the SYSTEM account for all I know. Linux ignores Windows permissions. It should be able to visit all the parts of the partition when making the file and directory lists. Linux does pay attention to the partition type - a 0x07 NTFS will mount, a 0x27 NTFS will not. You would need to change the NTFS partition type, reboot, and then you could take an inventory of a "hidden" NTFS. For example, here is a picture of me burrowing into a 450MB hidden Recovery partition. After taking this picture, I returned the partition field to 0x27, making it hidden again. The Recovery partition has a 323MB Winre.wim file. https://s15.postimg.io/pwvs3fee3/recovery_partition.gif HTH, Paul |
#3
|
|||
|
|||
Does Macrium really clone and image drives?
On 9/8/2016 2:14 PM, Paul wrote:
micky wrote: This post and my next one are two related problems. I'm running Vista, but for this first problem, the OS seems less important than that the partitions are NTFS. How did Macrium Reflect clone a partition and still miss more than 1300 files? I used Macrium Reflect Free to clone (not image) the C: partition, and there were no errors reported. It's a sector by sector copy so I don't think this relates to any partcular file. Later, before changing from my current drive, which is 90% full to the other drive, where the partition is twice as big, I wanted to copy the most recently updated data files to the clone, to make it a real clone. I used XXCopy /clone but the choice of methods is less important than the result. XXCopy gave more than 1300 copy errors, all because of access problems (all of them in two directories, Windows and one other) plus another set of files and directories that were copied successfully (I forget how many there were, and I can't check now.) The problem is no longer that they weren't copied but that that they needed to be copied. I only checked 6 of them but none of the 6 were in the destination, the "clone". I suspect the other 1300 weren't there either because xxcopy wouldn't have tried to copy them if they were there. (After all, the drive had over 100,000 files and it only tried to copy 1300+.) How can that be if Macrium was making a clone? How can they call it a clone if it's missing 1300+ files? If it can't clone a drive sucessfullly, why should one think that it images drives successfully? Unfortunately, I've screwed up the whole computer, and it will be hard for probably at least a week to answer those questions of yours that require looking at the computer. But I wanted to write this up when it was fresh on my mind. Missing from this description, is "how many Windows Updates did you do, the minute the Macrium clone was finished" ? You are doing forensics, without "freezing" the partitions. ******* I made the exact same mistake, when I tested xxcopy when you were describing your problem. I booted the C: drive *before* I properly analyzed it. Here is the test case to run, to give your favorite cloning method a chance to work. 1) Equip a machine with a C: drive and a destination drive. It helps if you label at least one partition, to make the names a bit more manageable later. For example, my C: might be WIN7. Not all methods make it easy to control the name - cloning would create two "WIN7" labeled partitions. 2) Run the software under test from a CD. This is intended to "freeze" things during the test phase. You don't want the source drive to have any opportunity to change itself, before you get to step (5). For Macrium, use the Macrium CD. For XXCOPY, use WinPE via booting the install DVD or recovery CD. A WinPE disc gives you a command prompt to use. 3) Do your best to copy/clone. 4) Restart. 5) Boot your Linux Live DVD. Do *not* allow the source OS disk to boot, before completing the forensic data collection in step (5). Click the source and destination disks, to mount them in Linux. Open a terminal: find /media/mint/WIN7 -type d -exec ls -al -1 -d {} + /tmp/WIN7_dirs.txt find /media/mint/WIN7 -type f -exec ls -al -1 {} + /tmp/Win7_files.txt find /media/mint/DEST -type d -exec ls -al -1 -d {} + /tmp/DEST_dirs.txt find /media/mint/DEST -type f -exec ls -al -1 {} + /tmp/DEST_files.txt Edit each of the files with gedit (graphical text editor). The name of the text editor might be "pluma" as another possibility. They use different names on the various Linux distros. Remove the root part of the file path on each line, so that the files can be diffed. Save the edited files. Then diff /tmp/WIN7_dirs.txt /tmp/DEST_dirs.txt /tmp/diff_dirs.txt diff /tmp/WIN7_files.txt /tmp/DEST_filess.txt /tmp/diff_files.txt Copy (using file sharing), the six files you have created in /tmp, over to some other Windows machine. The contents of /tmp are in RAM, and will not survive a reboot of any kind. They must be copied somewhere for safe keeping. 6) At your leisure, look at the six files using Wordpad in Windows. Do a "save" to correct the Linux line endings. You can now use Notepad on any of them, once Wordpad has "laundered" them. 7) The end result should be, a very small number of differences in the diff_* files. For the test to work, you want to select timestamp preservation. Macrium would do this. xxcopy does it with /tc . If you boot C: after step (5), expect the file complement to change after each usage. Especially after any sort of Windows Update. Running "xxcopy" in WinPE, respects permissions. You're running as Administrator. Macrium obviously has a better recipe than that. I have no idea what account it uses (no proof). It could be using the SYSTEM account for all I know. Linux ignores Windows permissions. It should be able to visit all the parts of the partition when making the file and directory lists. Linux does pay attention to the partition type - a 0x07 NTFS will mount, a 0x27 NTFS will not. You would need to change the NTFS partition type, reboot, and then you could take an inventory of a "hidden" NTFS. For example, here is a picture of me burrowing into a 450MB hidden Recovery partition. After taking this picture, I returned the partition field to 0x27, making it hidden again. The Recovery partition has a 323MB Winre.wim file. https://s15.postimg.io/pwvs3fee3/recovery_partition.gif HTH, Paul Wow, that's excellent. |
#4
|
|||
|
|||
Does Macrium really clone and image drives?
I have been doing complete Windows backups since Windows
95/98 using many different programs along the way. Macrium Reflect has proved to be the easiest and most reliable by far. For at least temporary use, it can move modern Windows to different hardware, too. It is essential for doing pristine installations in addition to regular complete backups (I do not mess with incremental stuff). It makes a necessary function easier than ever before. Get yourself a fast SSD for your primary drive and a huge HDD for your conventional drive. Macrium Reflect takes care of the rest. It is a whole new world. |
#5
|
|||
|
|||
Does Macrium really clone and image drives?
I wrote:
a huge HDD for your conventional drive FWIW... That should be "a huge conventional HDD for your secondary drive". |
#6
|
|||
|
|||
Does Macrium really clone and image drives?
Are your drives all by one mfg or different brands? The reason I ask is that many mfg's offer free cloning software for their own brands. |
#7
|
|||
|
|||
Does Macrium really clone and image drives?
In microsoft.public.windowsxp.general, on Thu, 08 Sep 2016 18:12:55
-0500, Paul in Houston TX wrote: Are your drives all by one mfg or different brands? The reason I ask is that many mfg's offer free cloning software for their own brands. Good idea. I got a Seagate drive this time and when I get past the next thread, I'll see what software they have. |
#8
|
|||
|
|||
Does Macrium really clone and image drives?
In microsoft.public.windowsxp.general, on Thu, 08 Sep 2016 14:14:01
-0400, Paul wrote: micky wrote: This post and my next one are two related problems. I'm running Vista, but for this first problem, the OS seems less important than that the partitions are NTFS. How did Macrium Reflect clone a partition and still miss more than 1300 files? I used Macrium Reflect Free to clone (not image) the C: partition, and there were no errors reported. It's a sector by sector copy so I don't think this relates to any partcular file. Later, before changing from my current drive, which is 90% full to the other drive, where the partition is twice as big, I wanted to copy the most recently updated data files to the clone, to make it a real clone. I used XXCopy /clone but the choice of methods is less important than the result. XXCopy gave more than 1300 copy errors, all because of access problems (all of them in two directories, Windows and one other) plus another set of files and directories that were copied successfully (I forget how many there were, and I can't check now.) The problem is no longer that they weren't copied but that that they needed to be copied. I only checked 6 of them but none of the 6 were in the destination, the "clone". I suspect the other 1300 weren't there either because xxcopy wouldn't have tried to copy them if they were there. (After all, the drive had over 100,000 files and it only tried to copy 1300+.) How can that be if Macrium was making a clone? How can they call it a clone if it's missing 1300+ files? If it can't clone a drive sucessfullly, why should one think that it images drives successfully? Unfortunately, I've screwed up the whole computer, and it will be hard for probably at least a week to answer those questions of yours that require looking at the computer. But I wanted to write this up when it was fresh on my mind. Missing from this description, is "how many Windows Updates did you do, the minute the Macrium clone was finished" ? You are 47. So you think all 1300 files could have been added by the windows updates. I didn' t think of that, and you may be right. That would be 27 files, average, per update , and that seems like a lot, but possible and it would account for what I called a problem. doing forensics, without "freezing" the partitions. ******* I made the exact same mistake, when I tested xxcopy when you were describing your problem. I booted the C: drive *before* I properly analyzed it. Here is the test case to run, to give your favorite cloning method a chance to work. I'll do this a little later. As my next thread will show, I have even bigger problems. I'm sorry I've looked so stupid here and I hope it won't keep people from taking my next thread seriously. Thanks. Micky 1) Equip a machine with a C: drive and a destination drive. It helps if you label at least one partition, to make the names a bit more manageable later. For example, my C: might be WIN7. Not all methods make it easy to control the name - cloning would create two "WIN7" labeled partitions. 2) Run the software under test from a CD. This is intended to "freeze" things during the test phase. You don't want the source drive to have any opportunity to change itself, before you get to step (5). For Macrium, use the Macrium CD. For XXCOPY, use WinPE via booting the install DVD or recovery CD. A WinPE disc gives you a command prompt to use. 3) Do your best to copy/clone. 4) Restart. 5) Boot your Linux Live DVD. Do *not* allow the source OS disk to boot, before completing the forensic data collection in step (5). Click the source and destination disks, to mount them in Linux. Open a terminal: find /media/mint/WIN7 -type d -exec ls -al -1 -d {} + /tmp/WIN7_dirs.txt find /media/mint/WIN7 -type f -exec ls -al -1 {} + /tmp/Win7_files.txt find /media/mint/DEST -type d -exec ls -al -1 -d {} + /tmp/DEST_dirs.txt find /media/mint/DEST -type f -exec ls -al -1 {} + /tmp/DEST_files.txt Edit each of the files with gedit (graphical text editor). The name of the text editor might be "pluma" as another possibility. They use different names on the various Linux distros. Remove the root part of the file path on each line, so that the files can be diffed. Save the edited files. Then diff /tmp/WIN7_dirs.txt /tmp/DEST_dirs.txt /tmp/diff_dirs.txt diff /tmp/WIN7_files.txt /tmp/DEST_filess.txt /tmp/diff_files.txt Copy (using file sharing), the six files you have created in /tmp, over to some other Windows machine. The contents of /tmp are in RAM, and will not survive a reboot of any kind. They must be copied somewhere for safe keeping. 6) At your leisure, look at the six files using Wordpad in Windows. Do a "save" to correct the Linux line endings. You can now use Notepad on any of them, once Wordpad has "laundered" them. 7) The end result should be, a very small number of differences in the diff_* files. For the test to work, you want to select timestamp preservation. Macrium would do this. xxcopy does it with /tc . If you boot C: after step (5), expect the file complement to change after each usage. Especially after any sort of Windows Update. Running "xxcopy" in WinPE, respects permissions. You're running as Administrator. Macrium obviously has a better recipe than that. I have no idea what account it uses (no proof). It could be using the SYSTEM account for all I know. Linux ignores Windows permissions. It should be able to visit all the parts of the partition when making the file and directory lists. Linux does pay attention to the partition type - a 0x07 NTFS will mount, a 0x27 NTFS will not. You would need to change the NTFS partition type, reboot, and then you could take an inventory of a "hidden" NTFS. For example, here is a picture of me burrowing into a 450MB hidden Recovery partition. After taking this picture, I returned the partition field to 0x27, making it hidden again. The Recovery partition has a 323MB Winre.wim file. https://s15.postimg.io/pwvs3fee3/recovery_partition.gif HTH, Paul |
#9
|
|||
|
|||
Does Macrium really clone and image drives?
micky formulated the question :
In microsoft.public.windowsxp.general, on Thu, 08 Sep 2016 18:12:55 -0500, Paul in Houston TX wrote: Are your drives all by one mfg or different brands? The reason I ask is that many mfg's offer free cloning software for their own brands. Good idea. I got a Seagate drive this time and when I get past the next thread, I'll see what software they have. Seagate and Maxtor used to have MaxBlast which was a free version of Acronis. It would work if at least one of the drives involved was one of theirs. The name might have changed since then. |
#10
|
|||
|
|||
Does Macrium really clone and image drives?
In message , FromTheRafters
writes: micky formulated the question : In microsoft.public.windowsxp.general, on Thu, 08 Sep 2016 18:12:55 -0500, Paul in Houston TX wrote: Are your drives all by one mfg or different brands? The reason I ask is that many mfg's offer free cloning software for their own brands. Good idea. I got a Seagate drive this time and when I get past the next thread, I'll see what software they have. Seagate and Maxtor used to have MaxBlast which was a free version of Acronis. It would work if at least one of the drives involved was one of theirs. The name might have changed since then. IIRR (I am perfectly happy with Macrium 5 free, so no longer pay much attention), some of those would work if one of the drives _in the system_ was one of theirs - it didn't have to be either of the ones you were xxxing between. (This assumes a system that can _have_ three drives connected, of course.) I may be remembering wrong(ly) about that, of course. -- J. P. Gilliver. UMRA: 1960/1985 MB++G()AL-IS-Ch++(p)Ar@T+H+Sh0!:`)DNAf Veni Vidi Visa [I came, I saw, I did a little shopping] - Mik from S+AS Limited ), 1998 |
#11
|
|||
|
|||
Does Macrium really clone and image drives?
J. P. Gilliver (John) was thinking very hard :
In message , FromTheRafters writes: micky formulated the question : In microsoft.public.windowsxp.general, on Thu, 08 Sep 2016 18:12:55 -0500, Paul in Houston TX wrote: Are your drives all by one mfg or different brands? The reason I ask is that many mfg's offer free cloning software for their own brands. Good idea. I got a Seagate drive this time and when I get past the next thread, I'll see what software they have. Seagate and Maxtor used to have MaxBlast which was a free version of Acronis. It would work if at least one of the drives involved was one of theirs. The name might have changed since then. IIRR (I am perfectly happy with Macrium 5 free, so no longer pay much attention), some of those would work if one of the drives _in the system_ was one of theirs - it didn't have to be either of the ones you were xxxing between. (This assumes a system that can _have_ three drives connected, of course.) I may be remembering wrong(ly) about that, of course. You and Char Jackson are probably both correct, as the message when it doesn't work is: "To use the product, at least one Seagate or Maxtor device should be installed in your system." IMO it hardly matters when the OP has stated a Seagate drive is involved, but for the sake of completeness I believe you are correct. I didn't use it for cloning, but along with Macrium for making disk images with type diversity in case one didn't work later when trying to restore. |
Thread Tools | |
Display Modes | |
|
|