Does Macrium really clone and image drives?

This post and my next one are two related problems.

I'm running Vista, but for this first problem, the OS seems less
important than that the partitions are NTFS.

How did Macrium Reflect clone a partition and still miss more than 1300
files?

I used Macrium Reflect Free to clone (not image) the C: partition, and
there were no errors reported. It's a sector by sector copy so I don't
think this relates to any partcular file.

Later, before changing from my current drive, which is 90% full to the
other drive, where the partition is twice as big, I wanted to copy the
most recently updated data files to the clone, to make it a real clone.

I used XXCopy /clone but the choice of methods is less important
than the result. XXCopy gave more than 1300 copy errors, all because
of access problems (all of them in two directories, Windows and one
other) plus another set of files and directories that were copied
successfully (I forget how many there were, and I can't check now.)

The problem is no longer that they weren't copied but that that they
needed to be copied. I only checked 6 of them but none of the 6 were
in the destination, the "clone". I suspect the other 1300 weren't there
either because xxcopy wouldn't have tried to copy them if they were
there. (After all, the drive had over 100,000 files and it only tried to
copy 1300+.)

How can that be if Macrium was making a clone? How can they call it a
clone if it's missing 1300+ files?

If it can't clone a drive sucessfullly, why should one think that it
images drives successfully?

Unfortunately, I've screwed up the whole computer, and it will be hard
for probably at least a week to answer those questions of yours that
require looking at the computer. But I wanted to write this up when it
was fresh on my mind.

micky wrote:
This post and my next one are two related problems.

I'm running Vista, but for this first problem, the OS seems less
important than that the partitions are NTFS.

How did Macrium Reflect clone a partition and still miss more than 1300
files?

I used Macrium Reflect Free to clone (not image) the C: partition, and
there were no errors reported. It's a sector by sector copy so I don't
think this relates to any partcular file.

Later, before changing from my current drive, which is 90% full to the
other drive, where the partition is twice as big, I wanted to copy the
most recently updated data files to the clone, to make it a real clone.

I used XXCopy /clone but the choice of methods is less important
than the result. XXCopy gave more than 1300 copy errors, all because
of access problems (all of them in two directories, Windows and one
other) plus another set of files and directories that were copied
successfully (I forget how many there were, and I can't check now.)

The problem is no longer that they weren't copied but that that they
needed to be copied. I only checked 6 of them but none of the 6 were
in the destination, the "clone". I suspect the other 1300 weren't there
either because xxcopy wouldn't have tried to copy them if they were
there. (After all, the drive had over 100,000 files and it only tried to
copy 1300+.)

How can that be if Macrium was making a clone? How can they call it a
clone if it's missing 1300+ files?

If it can't clone a drive sucessfullly, why should one think that it
images drives successfully?

Unfortunately, I've screwed up the whole computer, and it will be hard
for probably at least a week to answer those questions of yours that
require looking at the computer. But I wanted to write this up when it
was fresh on my mind.

Missing from this description, is "how many Windows Updates did
you do, the minute the Macrium clone was finished" ? You are
doing forensics, without "freezing" the partitions.

*******

I made the exact same mistake, when I tested xxcopy when you
were describing your problem. I booted the C: drive *before* I
properly analyzed it.

Here is the test case to run, to give your favorite cloning
method a chance to work.

1) Equip a machine with a C: drive and a destination drive.
It helps if you label at least one partition, to make
the names a bit more manageable later. For example, my C:
might be WIN7. Not all methods make it easy to control
the name - cloning would create two "WIN7" labeled partitions.

2) Run the software under test from a CD. This is intended to
"freeze" things during the test phase. You don't want the source
drive to have any opportunity to change itself, before you get
to step (5).

For Macrium, use the Macrium CD.
For XXCOPY, use WinPE via booting the install DVD or recovery CD.
A WinPE disc gives you a command prompt to use.

3) Do your best to copy/clone.

4) Restart.

5) Boot your Linux Live DVD. Do *not* allow the source OS disk
to boot, before completing the forensic data collection in step (5).

Click the source and destination disks, to mount them in Linux.

Open a terminal:

find /media/mint/WIN7 -type d -exec ls -al -1 -d {} + /tmp/WIN7_dirs.txt
find /media/mint/WIN7 -type f -exec ls -al -1 {} + /tmp/Win7_files.txt

find /media/mint/DEST -type d -exec ls -al -1 -d {} + /tmp/DEST_dirs.txt
find /media/mint/DEST -type f -exec ls -al -1 {} + /tmp/DEST_files.txt

Edit each of the files with gedit (graphical text editor).
The name of the text editor might be "pluma" as another possibility.
They use different names on the various Linux distros.

Remove the root part of the file path on each line, so that
the files can be diffed. Save the edited files. Then

diff /tmp/WIN7_dirs.txt /tmp/DEST_dirs.txt /tmp/diff_dirs.txt

diff /tmp/WIN7_files.txt /tmp/DEST_filess.txt /tmp/diff_files.txt

Copy (using file sharing), the six files you have created in /tmp,
over to some other Windows machine. The contents of /tmp are in
RAM, and will not survive a reboot of any kind. They must be copied
somewhere for safe keeping.

6) At your leisure, look at the six files using Wordpad in Windows.
Do a "save" to correct the Linux line endings.

You can now use Notepad on any of them, once Wordpad has "laundered" them.

7) The end result should be, a very small number of differences
in the diff_* files.

For the test to work, you want to select timestamp preservation.
Macrium would do this. xxcopy does it with /tc .

If you boot C: after step (5), expect the file complement to
change after each usage. Especially after any sort of Windows Update.

Running "xxcopy" in WinPE, respects permissions. You're running
as Administrator.

Macrium obviously has a better recipe than that. I have no idea
what account it uses (no proof). It could be using the SYSTEM
account for all I know.

Linux ignores Windows permissions. It should be able to visit
all the parts of the partition when making the file and
directory lists. Linux does pay attention to the partition
type - a 0x07 NTFS will mount, a 0x27 NTFS will not. You would
need to change the NTFS partition type, reboot, and then you
could take an inventory of a "hidden" NTFS. For example,
here is a picture of me burrowing into a 450MB hidden
Recovery partition. After taking this picture, I returned
the partition field to 0x27, making it hidden again. The
Recovery partition has a 323MB Winre.wim file.

https://s15.postimg.io/pwvs3fee3/recovery_partition.gif

HTH,
Paul

On 9/8/2016 2:14 PM, Paul wrote:
micky wrote:
This post and my next one are two related problems.
I'm running Vista, but for this first problem, the OS seems less
important than that the partitions are NTFS.

How did Macrium Reflect clone a partition and still miss more than 1300
files?
I used Macrium Reflect Free to clone (not image) the C: partition, and
there were no errors reported. It's a sector by sector copy so I don't
think this relates to any partcular file.
Later, before changing from my current drive, which is 90% full to the
other drive, where the partition is twice as big, I wanted to copy the
most recently updated data files to the clone, to make it a real clone.
I used XXCopy /clone but the choice of methods is less important
than the result. XXCopy gave more than 1300 copy errors, all because
of access problems (all of them in two directories, Windows and one
other) plus another set of files and directories that were copied
successfully (I forget how many there were, and I can't check now.)
The problem is no longer that they weren't copied but that that they
needed to be copied. I only checked 6 of them but none of the 6 were
in the destination, the "clone". I suspect the other 1300 weren't there
either because xxcopy wouldn't have tried to copy them if they were
there. (After all, the drive had over 100,000 files and it only tried to
copy 1300+.)

How can that be if Macrium was making a clone? How can they call it a
clone if it's missing 1300+ files?
If it can't clone a drive sucessfullly, why should one think that it
images drives successfully?
Unfortunately, I've screwed up the whole computer, and it will be hard
for probably at least a week to answer those questions of yours that
require looking at the computer. But I wanted to write this up when it
was fresh on my mind.

Missing from this description, is "how many Windows Updates did
you do, the minute the Macrium clone was finished" ? You are
doing forensics, without "freezing" the partitions.

*******

I made the exact same mistake, when I tested xxcopy when you
were describing your problem. I booted the C: drive *before* I
properly analyzed it.

Here is the test case to run, to give your favorite cloning
method a chance to work.

1) Equip a machine with a C: drive and a destination drive.
It helps if you label at least one partition, to make
the names a bit more manageable later. For example, my C:
might be WIN7. Not all methods make it easy to control
the name - cloning would create two "WIN7" labeled partitions.

2) Run the software under test from a CD. This is intended to
"freeze" things during the test phase. You don't want the source
drive to have any opportunity to change itself, before you get
to step (5).

For Macrium, use the Macrium CD.
For XXCOPY, use WinPE via booting the install DVD or recovery CD.
A WinPE disc gives you a command prompt to use.

3) Do your best to copy/clone.

4) Restart.

5) Boot your Linux Live DVD. Do *not* allow the source OS disk
to boot, before completing the forensic data collection in step (5).

Click the source and destination disks, to mount them in Linux.

Open a terminal:

find /media/mint/WIN7 -type d -exec ls -al -1 -d {} +
/tmp/WIN7_dirs.txt
find /media/mint/WIN7 -type f -exec ls -al -1 {} +
/tmp/Win7_files.txt

find /media/mint/DEST -type d -exec ls -al -1 -d {} +
/tmp/DEST_dirs.txt
find /media/mint/DEST -type f -exec ls -al -1 {} +
/tmp/DEST_files.txt

Edit each of the files with gedit (graphical text editor).
The name of the text editor might be "pluma" as another possibility.
They use different names on the various Linux distros.

Remove the root part of the file path on each line, so that
the files can be diffed. Save the edited files. Then

diff /tmp/WIN7_dirs.txt /tmp/DEST_dirs.txt /tmp/diff_dirs.txt

diff /tmp/WIN7_files.txt /tmp/DEST_filess.txt /tmp/diff_files.txt

Copy (using file sharing), the six files you have created in /tmp,
over to some other Windows machine. The contents of /tmp are in
RAM, and will not survive a reboot of any kind. They must be copied
somewhere for safe keeping.

6) At your leisure, look at the six files using Wordpad in Windows.
Do a "save" to correct the Linux line endings.

You can now use Notepad on any of them, once Wordpad has "laundered"
them.

7) The end result should be, a very small number of differences
in the diff_* files.

For the test to work, you want to select timestamp preservation.
Macrium would do this. xxcopy does it with /tc .

If you boot C: after step (5), expect the file complement to
change after each usage. Especially after any sort of Windows Update.

Running "xxcopy" in WinPE, respects permissions. You're running
as Administrator.

Macrium obviously has a better recipe than that. I have no idea
what account it uses (no proof). It could be using the SYSTEM
account for all I know.

Linux ignores Windows permissions. It should be able to visit
all the parts of the partition when making the file and
directory lists. Linux does pay attention to the partition
type - a 0x07 NTFS will mount, a 0x27 NTFS will not. You would
need to change the NTFS partition type, reboot, and then you
could take an inventory of a "hidden" NTFS. For example,
here is a picture of me burrowing into a 450MB hidden
Recovery partition. After taking this picture, I returned
the partition field to 0x27, making it hidden again. The
Recovery partition has a 323MB Winre.wim file.

https://s15.postimg.io/pwvs3fee3/recovery_partition.gif

HTH,
Paul

Wow, that's excellent.

I have been doing complete Windows backups since Windows
95/98 using many different programs along the way. Macrium
Reflect has proved to be the easiest and most reliable by
far. For at least temporary use, it can move modern Windows
to different hardware, too.

It is essential for doing pristine installations in addition
to regular complete backups (I do not mess with incremental
stuff). It makes a necessary function easier than ever
before.

Get yourself a fast SSD for your primary drive and a huge HDD
for your conventional drive. Macrium Reflect takes care of
the rest. It is a whole new world.

I wrote:

a huge HDD for your conventional drive

FWIW... That should be "a huge conventional HDD for your
secondary drive".

Are your drives all by one mfg or different brands?
The reason I ask is that many mfg's offer free cloning software
for their own brands.

In microsoft.public.windowsxp.general, on Thu, 08 Sep 2016 18:12:55
-0500, Paul in Houston TX wrote:


Are your drives all by one mfg or different brands?
The reason I ask is that many mfg's offer free cloning software
for their own brands.

Good idea. I got a Seagate drive this time and when I get past the next
thread, I'll see what software they have.

In microsoft.public.windowsxp.general, on Thu, 08 Sep 2016 14:14:01
-0400, Paul wrote:

micky wrote:
This post and my next one are two related problems.

I'm running Vista, but for this first problem, the OS seems less
important than that the partitions are NTFS.

How did Macrium Reflect clone a partition and still miss more than 1300
files?

I used Macrium Reflect Free to clone (not image) the C: partition, and
there were no errors reported. It's a sector by sector copy so I don't
think this relates to any partcular file.

Later, before changing from my current drive, which is 90% full to the
other drive, where the partition is twice as big, I wanted to copy the
most recently updated data files to the clone, to make it a real clone.

I used XXCopy /clone but the choice of methods is less important
than the result. XXCopy gave more than 1300 copy errors, all because
of access problems (all of them in two directories, Windows and one
other) plus another set of files and directories that were copied
successfully (I forget how many there were, and I can't check now.)

The problem is no longer that they weren't copied but that that they
needed to be copied. I only checked 6 of them but none of the 6 were
in the destination, the "clone". I suspect the other 1300 weren't there
either because xxcopy wouldn't have tried to copy them if they were
there. (After all, the drive had over 100,000 files and it only tried to
copy 1300+.)

How can that be if Macrium was making a clone? How can they call it a
clone if it's missing 1300+ files?

If it can't clone a drive sucessfullly, why should one think that it
images drives successfully?

Unfortunately, I've screwed up the whole computer, and it will be hard
for probably at least a week to answer those questions of yours that
require looking at the computer. But I wanted to write this up when it
was fresh on my mind.

Missing from this description, is "how many Windows Updates did
you do, the minute the Macrium clone was finished" ? You are

47. So you think all 1300 files could have been added by the windows
updates. I didn' t think of that, and you may be right.

That would be 27 files, average, per update , and that seems like a lot,
but possible and it would account for what I called a problem.

doing forensics, without "freezing" the partitions.

*******

I made the exact same mistake, when I tested xxcopy when you
were describing your problem. I booted the C: drive *before* I
properly analyzed it.

Here is the test case to run, to give your favorite cloning
method a chance to work.

I'll do this a little later. As my next thread will show, I have even
bigger problems.

I'm sorry I've looked so stupid here and I hope it won't keep people
from taking my next thread seriously.

Thanks. Micky



1) Equip a machine with a C: drive and a destination drive.
It helps if you label at least one partition, to make
the names a bit more manageable later. For example, my C:
might be WIN7. Not all methods make it easy to control
the name - cloning would create two "WIN7" labeled partitions.

2) Run the software under test from a CD. This is intended to
"freeze" things during the test phase. You don't want the source
drive to have any opportunity to change itself, before you get
to step (5).

For Macrium, use the Macrium CD.
For XXCOPY, use WinPE via booting the install DVD or recovery CD.
A WinPE disc gives you a command prompt to use.

3) Do your best to copy/clone.

4) Restart.

5) Boot your Linux Live DVD. Do *not* allow the source OS disk
to boot, before completing the forensic data collection in step (5).

Click the source and destination disks, to mount them in Linux.

Open a terminal:

find /media/mint/WIN7 -type d -exec ls -al -1 -d {} + /tmp/WIN7_dirs.txt
find /media/mint/WIN7 -type f -exec ls -al -1 {} + /tmp/Win7_files.txt

find /media/mint/DEST -type d -exec ls -al -1 -d {} + /tmp/DEST_dirs.txt
find /media/mint/DEST -type f -exec ls -al -1 {} + /tmp/DEST_files.txt

Edit each of the files with gedit (graphical text editor).
The name of the text editor might be "pluma" as another possibility.
They use different names on the various Linux distros.

Remove the root part of the file path on each line, so that
the files can be diffed. Save the edited files. Then

diff /tmp/WIN7_dirs.txt /tmp/DEST_dirs.txt /tmp/diff_dirs.txt

diff /tmp/WIN7_files.txt /tmp/DEST_filess.txt /tmp/diff_files.txt

Copy (using file sharing), the six files you have created in /tmp,
over to some other Windows machine. The contents of /tmp are in
RAM, and will not survive a reboot of any kind. They must be copied
somewhere for safe keeping.

6) At your leisure, look at the six files using Wordpad in Windows.
Do a "save" to correct the Linux line endings.

You can now use Notepad on any of them, once Wordpad has "laundered" them.

7) The end result should be, a very small number of differences
in the diff_* files.

For the test to work, you want to select timestamp preservation.
Macrium would do this. xxcopy does it with /tc .

If you boot C: after step (5), expect the file complement to
change after each usage. Especially after any sort of Windows Update.

Running "xxcopy" in WinPE, respects permissions. You're running
as Administrator.

Macrium obviously has a better recipe than that. I have no idea
what account it uses (no proof). It could be using the SYSTEM
account for all I know.

Linux ignores Windows permissions. It should be able to visit
all the parts of the partition when making the file and
directory lists. Linux does pay attention to the partition
type - a 0x07 NTFS will mount, a 0x27 NTFS will not. You would
need to change the NTFS partition type, reboot, and then you
could take an inventory of a "hidden" NTFS. For example,
here is a picture of me burrowing into a 450MB hidden
Recovery partition. After taking this picture, I returned
the partition field to 0x27, making it hidden again. The
Recovery partition has a 323MB Winre.wim file.

https://s15.postimg.io/pwvs3fee3/recovery_partition.gif

HTH,
Paul

micky formulated the question :
In microsoft.public.windowsxp.general, on Thu, 08 Sep 2016 18:12:55
-0500, Paul in Houston TX wrote:


Are your drives all by one mfg or different brands?
The reason I ask is that many mfg's offer free cloning software
for their own brands.

Good idea. I got a Seagate drive this time and when I get past the next
thread, I'll see what software they have.

Seagate and Maxtor used to have MaxBlast which was a free version of
Acronis. It would work if at least one of the drives involved was one
of theirs. The name might have changed since then.

In message , FromTheRafters
writes:
micky formulated the question :
In microsoft.public.windowsxp.general, on Thu, 08 Sep 2016 18:12:55
-0500, Paul in Houston TX wrote:

Are your drives all by one mfg or different brands?
The reason I ask is that many mfg's offer free cloning software
for their own brands.

Good idea. I got a Seagate drive this time and when I get past the
next
thread, I'll see what software they have.

Seagate and Maxtor used to have MaxBlast which was a free version of
Acronis. It would work if at least one of the drives involved was one
of theirs. The name might have changed since then.

IIRR (I am perfectly happy with Macrium 5 free, so no longer pay much
attention), some of those would work if one of the drives _in the
system_ was one of theirs - it didn't have to be either of the ones you
were xxxing between. (This assumes a system that can _have_ three drives
connected, of course.) I may be remembering wrong(ly) about that, of
course.
--
J. P. Gilliver. UMRA: 1960/1985 MB++G()AL-IS-Ch++(p)Ar@T+H+Sh0!:`)DNAf

Veni Vidi Visa [I came, I saw, I did a little shopping] - Mik from S+AS Limited
), 1998

J. P. Gilliver (John) was thinking very hard :
In message , FromTheRafters
writes:
micky formulated the question :
In microsoft.public.windowsxp.general, on Thu, 08 Sep 2016 18:12:55
-0500, Paul in Houston TX wrote:

Are your drives all by one mfg or different brands?
The reason I ask is that many mfg's offer free cloning software
for their own brands.

Good idea. I got a Seagate drive this time and when I get past the next
thread, I'll see what software they have.

Seagate and Maxtor used to have MaxBlast which was a free version of
Acronis. It would work if at least one of the drives involved was one of
theirs. The name might have changed since then.

IIRR (I am perfectly happy with Macrium 5 free, so no longer pay much
attention), some of those would work if one of the drives _in the system_ was
one of theirs - it didn't have to be either of the ones you were xxxing
between. (This assumes a system that can _have_ three drives connected, of
course.) I may be remembering wrong(ly) about that, of course.

You and Char Jackson are probably both correct, as the message when it
doesn't work is:

"To use the product, at least one Seagate or Maxtor device should be
installed in your system."

IMO it hardly matters when the OP has stated a Seagate drive is
involved, but for the sake of completeness I believe you are correct.

I didn't use it for cloning, but along with Macrium for making disk
images with type diversity in case one didn't work later when trying to
restore.