Offline image backup of OS: Robocopy ok?

Yukata said:

Hi there!

I would like to do an offline image backup of my OS-drive. I'm only interested in the OS itself. The data is backed up separately (and resides on a different drive). For high security, I'd like to avoid using any third party software. I will be installing win 10 using the latest iso-image downloaded from Microsoft. My question is:

If I boot up on a standard WinRE USB-stick (created in Win10 as usual): Can I just do a Robocopy to get an image backup into a VHDX file, ie a backup that is later restorable and bootable?

So basically to do a backup:
1) Boot up WinRE from a USB-stick and into the command line
2) Create VHDX-file using Diskpart and attach it to a drive letter, say V:
3) Robocopy /MIR /COPYALL C:\ V:\
I will copy all three partitions like this, ie the EFI System Partition, the OS partition itself and the recovery partition.

If I backup the OS like this, can I then later restore a bootable OS by doing the reverse (on all three partitions, first recreating those partitions with the same sizes), ie roughly like this (except I will create 3 partitions with same size as before, not 1 partition):
1) Boot up WinRE from a USB-stick and into the command line and open Diskpart
2) select disk 0
3) clean
4) create partition primary
5) active
6) format fs=ntfs quick label="OS_DRIVE"
7) assign letter=C
8) Mount backup VHDX-file using Diskpart and attach it to a drive letter, say V:
9) Robocopy /MIR /COPYALL V:\ C:\
10) Perhaps a call to bootsect to set a bootsector for C:\ ?

Will it work to boot the restored OS?
Will it work restoring to another host? Ie just to boot that host and then install the specific drivers necessary to make the restored host work well.

I know this looks very manual and rather complicated. The reasons I'm backing up in this particular way are:
* I want to avoid third party software to minimize dependencies I have to trust. I only want to have to trust Microsoft in this case.
* I just want to do this backup 1 time so I have a standard image of a configured host. I can then use that image/backup to reflash any of my hosts easily. Ie I can reinstall Windows 10 easily and with all my additional time consuming OS customizations intact.
* I would have loved to use "Backup and restore > Create a system image" in Windows 10, but unfortunately I've had mixed results. Sometimes when I restored to another host (using a usb stick created with "Recovery Media Creator" in Windows 10), Windows refused to restore the image with cryptic error messages. Also, I've heard some people say not all data was copied when Windows did the backup. I just thought that with Robocopy, I can be sure to really copy ALL the files without missing anything.

I guess, at heart, the question is: Is there any functional difference between copying all the files of a partition vs an image backup (especially when booting/doing the backup up in a WinRE env when the OS files are not locked/used by the OS and are in a consistent pre-boot state)?

Feel free to send very technical links, I love that :)

Very greatful for any help as I've been wondering about this for some time! And a happy new year to all of you!

Cheers,
Yukata

Hi there

what's the problem in creating the stand alone bootable version of Macrium Free and then saving the OS -- if the external device is large enough you can have the bootable version of Macrium and the backup image on the same device making for easy restore. Depending on the size of your Windows OS a 64GB thumb drive might be big enough.

Security would be fine since you are booting a stand alone device and you can disconnect from LAN and Internet.

Another option is if you have the Windows OS totally on its own drive is to boot up a linux live distro and simply type the following : dd if=/dev/<windows disk> of=/dev/<output device - or even file> bs=64M status=progress.

There's no 3rd party software in the DD command its part of the linux kernel.

Linux is used by literally 100,000's of commercial servers and cloud servers around the world so I wouldn't worry here about security --if it's good enough for CIA, MOSSAD etc then I'm sure it will be OK for you.

No formatting etc of the output device is required -- entire disk is cloned as an exact copy of the input one. Linux security is also extremely robust and again you can run with Internet and LAN disconnected.

To restore simply swap the if (input file) and of (output file) parameters -- it's so simple and will always work provided there's nothing physically wrong with the hardware.

The only proviso in moving to different hardware with different drivers is that whatever method you use the application must at least be able to recognize a proper hard disk / ssd etc to restore to -- you'll always get a base windows system which can especially for Windows 10 fetch most drivers from the Internet.

I've often moved Windows between different hardware -- even from INTEL MOBO's to AMD ones and the other way around --- you might come up against Activation problems but if it's W10 and you got a digital license activation will probably be automatic anyway.

Cheers
jimbo

Hi Jimbo,

Thanks for the response!

There's no big problem to use a third party. It's just I only need a single image and I'd like it to be free of any third parties (in case they are compromised themselves). I do have a license to Acronis TI 2019 if I need to use it. But I thought: What is the difference between an image backup and just copying the files?

For example, if you format a usb stick and just copy the files from the windows install iso onto the stick, it will boot and install Windows just fine (you don't even need to install a boot sector). So why not just do the same with a real Windows install? It's simple, clean and no third parties involved that can compromise your security.

I guess I can test it myself in a VM, but I thought someone might know: What's so magical about an image backup that it's different from a regular file backup?

Cheers,
Yukata

Thanks for the suggestions!

Cereberus, that sounds like an interesting technique. I'm gonna remember it for something else in the future. Unfortunately for this, the images will be too large. The OS partition is 256Gb but the install image should only be about 10-20Gb.

I do wonder what's the difference between an offline filecopy to a vhdx file of the OS partition and an image backup. My suspicion is that Macrium/Acronis et al just create a volume shadow copy of the OS partition and then do a file copy into a proprietary container, but I could be wrong. Gonna dig a bit on this.

Thanks for the responses! :)

Hi Samuria,

Thanks for the comment. Interesting suggestion. I guess you could clone it to a VHDX-file but to restore from a WinRE-stick, I guess you'd need to copy it by using Robocopy anyways?

Cheers,
Yukata