Techie Tuesday: Using Macrium Reflect from the command line


You can retrieve a prompt for all the command line arguments by simply typing reflect -h from the command line.

Running a Backup

The command line form is as follows:

reflect.exe [-v | -e [-w] [-full | -inc | -diff] [xml filename] ]
Explanations for the switches are as follows:

-h This help text
-e Execute the XML file. If no full / diff / inc qualifier is used, a full backup is performed by default.
-v Validate the XML file and exit
-w If Reflect is busy then wait until available otherwise exit immediately
-full Run a full backup
-diff Run a differential backup
-inc Run an incremental backup
-pass Password. Overrides the password saved in the xml file.

Please note that the XML file name is the fully qualified path.

To validate an XML file

reflect.exe -v "c:\backup.xml"

To execute an XML file

reflect.exe -e "c:\backup.xml"

To execute an XML file with wait if busy

<reflect.exe -e -w "c:\backup.xml"

To execute an XML file and create an incremental image

reflect.exe -e -inc "c:\backup.xml"


Mounting an image

reflect.exe [Path To Image File] -b [-auto -drives [Drives[s]] -pass [PASSWORD]]
Explanations for the switches are as follows:

-b Browse image
-auto Automatically assign drive letters. If not specified then you will be prompted
-drives A comma separated list of drive letters to use. If not specified then the next available letters are used
-pass The password for protected image files

The image file name is the fully qualified path. If “LAST_FILE_CREATED” is specified then the last image created in the current Windows session is mounted.


To mount an image and prompt for a drive letter to use

reflect.exe “D:\901DBF91346B9A81-00-00.mrimg” -b

To mount all partitions in an image using the next available drive letter(s)

reflect.exe “D:\901DBF91346B9A81-00-00.mrimg” -b -auto

To mount all partitions for the last image created

reflect.exe "LAST_FILE_CREATED" -b -auto

To mount all partitions in an image using drive letters j,k,l

reflect.exe "D:\901DBF91346B9A81-00-00.mrimg" -b -auto -drives j,k,l

To mount all partitions in a password protected image using drive letters j,k,l

reflect.exe "D:\901DBF91346B9A81-00-00.mrimg" -b -auto -drives j,k,l -pass "PWD"


Unmounting an image

reflect.exe [Drive Letter] -u

Explanations for the switches are as follows:

-u Unmount image


If a drive letter isn’t specified then all mounted images are unmmounted

To unmount an image from drive letter ‘j’

reflect.exe J -u

To umnount all mounted drives

reflect.exe -u


Download a 30-day Trial of Macrium Reflect for Home or Business use.

Techie Tuesday: New Feature – Logging file changes for Incremental and Differential Images


Your Windows operating system and installed applications can create many changes ‘under the hood’ without you knowing about it. This can cause Incremental or Differential images to be substantially larger than expected. This article describes a feature in Macrium Reflect to log files that have been changed in each Incremental or Differential image.

Please Note: Macrium Reflect must be at v6.3 or later. Please take the ‘Other Tasks’ > ‘Check for updates’ menu option in Reflect if you are running an earlier release.

What are Incremental and Differential Images?

Incremental images will only backup data blocks that have changed since the last Image or, in the case of Differential, Full image in the backup set. Images are created at File System cluster level and each block is MD5 hashed and compared. Blocks with the same hash signature aren’t included in the Differential or Incremental image file. A data block is usually 16 clusters in length.

See also: How backup sets are created and maintained

How to show changed files

If the following registry entry is set, Reflect will perform a reverse ‘look-up’ to identify the file for each cluster that is backed up.

Please Note: This may increase the time taken to backup and should only be used for diagnosis.

Key: HKEY_LOCAL_MACHINE\SOFTWARE\Macrium\Reflect\Settings
Name: LogIncrementalChanges
Value: 1

Once the registry entry is set, perform another Differential or Incremental Image and, once complete, delete the registry entry created above. Then use Windows Explorer to navigate to: ‘C:\ProgramData\Macrium\Reflect’ in Windows Explorer and sort by Modified Date:

In addition to the normal ‘.html’ and ‘.vsslog’ files you will also see files with ‘.inc.log’ at the end. There will be one for each NTFS partition in the Differential or Incremental.

The first file, {IMAGEID}, is the log for the first NTFS partition, the next file is , {IMAGEID} and,

in the above example, {IMAGEID} is the last last NTFS partition in the image.

Example log output

MFT Record - 32 - .\$Extend\$RmMetadata\$TxfLog\$TxfLog.blf 
MFT Record - 34 - .\$Extend\$RmMetadata\$TxfLog\$TxfLogContainer00000000000000000002 
MFT Record - 38 - .\Windows\Prefetch\AgGlGlobalHistory.db 
MFT Record - 39 - .\Windows\Prefetch\AgGlFaultHistory.db 
MFT Record - 43 - .\Windows\Prefetch\AgRobust.db 
MFT Record - 45 - .\Windows\Prefetch\AgGlFgAppHistory.db 
MFT Record - 1236 - .\Windows\SoftwareDistribution\SelfUpdate\WuPackages.xml 
MFT Record - 1333 - .\Program Files (x86)\TeamViewer\Version8\TeamViewer8_Logfile.log 
MFT Record - 1353 - .\ProgramData\Microsoft\RAC\PublishedData\RacWmiDatabase.sdf 
MFT Record - 1592 - .\Users\Dev\AppData\Local\Google\Chrome\User Data\Default\Current Session 
MFT Record - 1783 - .\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Log\ERRORLOG 
MFT Record - 13900 - .\Windows\System32\winevt\Logs\Microsoft-Windows-PrintService%4Admin.evtx 
MFT Record - 15637 - .\Windows\WindowsUpdate.log 
MFT Record - 15741 - .\Windows\System32\winevt\Logs\Microsoft-Windows-Windows Defender%4Operational.evtx 
MFT Record - 15743 - .\Windows\System32\winevt\Logs\Microsoft-Windows-Windows Defender%4WHC.evtx 
MFT Record - 15755 - .\Users\Dev\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\http_localhost_2904.indexeddb.leveldb\LOG 
MFT Record - 15868 - .\Windows\bootstat.dat 
MFT Record - 21541 - .\Windows\security\database\secedit.sdb 
MFT Record - 21544 - .\Windows\ServiceProfiles\LocalService\NTUSER.DAT 
MFT Record - 21565 - .\Windows\ServiceProfiles\NetworkService\NTUSER.DAT 
MFT Record - 22562 - .\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\MpCmdRun.log 
MFT Record - 22649 - .\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 
MFT Record - 22650 - .\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 
And so on......... 

Each log file lists the MFT record and full path name to the file(s) that have changed.

Please note: There will be many MFT metadata files (prefixed by ‘$’) that are not visible to Windows Explorer or any other windows utilities, but these are always included (if changed) in Diff/Inc image files.

Please note: This doesn’t mean that all clusters in the listed files have changed it means that the file clusters are scanned and differences have been detected.

Download a 30-day Trial of Macrium Reflect for Home or Business use.

Techie Tuesday: Re-deploying Windows to new hardware using Macrium ReDeploy



Macrium ReDeploy overcomes issues with Windows boot processes to run a Windows installation on new hardware. There are a variety of scenarios where you move a windows installation to a new machine, for example:

  • Due to hardware failure or planned upgrade.
  • Moving between a physical and a virtual machine (P2V / V2P).
  • Changing a non-raid to a raid installation or legacy SATA to AHCI SATA.

Aspects of the Windows boot process can cause a boot failure after significant changes to the hardware, ReDeploy can overcome these.

Discovering hardware and association with matching device drivers is time consuming and must be undertaken while windows is being installed. It is skipped during a normal Windows boot making the boot delay acceptable.

Early in the boot process, the boot loader loads the Windows kernel (the core of the operating system) and the critical drivers required to get Windows up and running. If the new hardware configuration requires a new driver to read the disk containing the operating system then Windows will fail to boot.

When the kernel and critical drivers are loaded, the kernel starts. The kernel and its associated hardware abstraction layer (HAL) need to match the motherboard for best enabling. Drivers are optionally loaded to handle specific central processing unit (CPU) features. For a stable system, the driver needs to match the hardware, in this example, the CPU model.

ReDeploy detects changes to critical system features, locates relevant drivers and injects them into your Windows operating system so it boots.

ReDeploy makes the complex process of getting an off-line Windows operating system running, as easy and intuitive as possible. It does not, however, install the complete driver set for the new hardware. You can complete the driver installation for devices such as network and graphics adapters when your windows installation boots on your new hardware.

You need to run ReDeploy from the Windows PE Reflect rescue CD. This allows the new hardware to be detected and the configuration of the Windows system modified to enable it to boot.

Note: To transfer to a Windows Server install to new hardware use Macrium Reflect v6 Server edition for ReDeploy.

For non-server (workstation) installs use ReDeploy included with v6 Home, Workstation or the Server Edition. Please note that ReDeploy is not included in 30 trial versions of Macrium Reflect

Note: ReDeploy modifies an existing offline operating system to work with new hardware. Restore your system image to the PC being deployed before running ReDeploy. There is no need to reboot your PC after restoring an Image and before you run ReDeploy.

  1. Boot the target PC with the Windows PE rescue CD or USB equivalent. (There is a link to a video on creating a Windows PE rescue CD at the bottom of this page).
  2. Click ReDeploy Restored Image to new hardware.
  3. If you have a multi-boot system, then you will be presented with a list of operating systems, select the operating system to be redeployed. Click Next.
  4. Specify driver locations for your mass storage devices (such as RAID card).
    1. If you haven’t already, insert a driver disk for the hardware you are going to boot from.
      This will typically be the motherboard or RAID card driver CD.
    2. Click Add to add driver locations.
      You can also specify additional paths such as network folders.
    3. Click Map Drive to add a network share.
    4. Click Next.
  5. ReDeploy searches through user specified driver locations. If none are specified or no matching drivers are found then it searches removable devices such as CD’s and disk drives. ReDeploy also searches through Windows’ database of drivers.
  6. ReDeploy seeks drivers for all discovered mass storage devices and displays a list with details, Click Next.

    For each mass storage device, there are three possibilities:

    1. The driver is already installed. It might still need to be enabled at boot, this is done automatically.
    2. The driver is located, either from a CD, user specified path or from the Windows database. This driver is installed on completion of ReDeploy.
    3. No matching driver is located.
  7. If no driver is located, or you choose to override the displayed driver, then use locate driver to manually specify an .inf file.
    If you have multiple mass storage interfaces in your system, you only need to locate drivers for hardware that contains the Windows system and active partitions.
  8. Review displayed options, leaving them as default if possible. Click Next.
    If you are having trouble booting these options can help to resolve issues. For more information about them options see below:

    Option Description
    Disable reboot on system stop Set this option to stop automatic rebooting if a blue screen of death (BSOD) occurs while Windows is loading or running. If this option is not set and Windows generates a BSOD, there will be no time to note the BSOD error codes.
    Display boot drivers as they load Set this option to show which drivers are being loaded as Windows loads. Once Windows is loading and running without issue this option can be reverted using the Windows MSCONFIG utility. You can use the Pause/Break key to freeze the list as it scrolls past, use space to un-pause.
    Enable boot logging Set this option to log drivers being loaded by Windows as it loads. The resulting log file ‘ntblog.txt’ can be found in the windows folder. Once Windows is loading and running without issue this option can be reverted using the Windows MSCONFIG utility.
    Disable CPU Driver Set this option to disable CPU drivers. This may be useful if you see BSOD’s in the selected HAL drivers or system lockup on entering standby or shutdown.
    Set Hardware Abstraction Layer Set this option to choose which Hardware Abstraction Layer is to be used in the selected Windows operating system. The recommended HAL for this machine is the one initially selected. If you have the incorrect HAL configured, your Windows installation is unstable and can cause random BSOD’s or lock ups after Windows boots. In particular, if you are redeploying from or to Virtual Box with an advanced programmable interrupt controller (APIC) unchecked (the default) or very old physical hardware, set a new HAL.
    Allow Windows to detect Hardware Abstraction Layer Set this option to allow Windows to determine the best Hardware Abstraction Layer to use at boot time. This is a Vista and later only option.


    Enable SATA AHCI Set this option to enable support for generic SATA AHCI hardware. You will typically also need to enable an option in your BIOS for your mass storage hardware to operate in this mode. This is a Vista and later only option.


  9. Review the actions to be be performed and click Finish to apply them to the target operating system.A log file ReDeploy.log saves to the drive containing the redeployed operating system.After clicking Finish to inject drivers and apply your settings you see a confirmation dialog, and you can reboot your OS which should now be compatible with your new hardware.

Note: Check there is a tick in the checkbox against Check for unsupported devices each time the rescue media loads before burning the Windows PE rescue CD, so that you can add additional drivers when you boot on new hardware.

Download a 30-day Trial of Macrium Reflect for Home or Business use.

Techie Tuesday: Adding a boot menu option for system image recovery


Adding a Macrium Reflect Windows boot menu enables direct access to the Macrium Windows PE recovery environment without the need to burn a DVD or USB Flash drive.

Note: You are advised to create physical boot media, USB or DVD, that can be used if your OS system disk fails.

When you have created your rescue media you can add Macrium Recovery to your PC boot menu. By doing this you can restore a system image (the C drive) without a recovery CD.

  1. Take ‘Other Tasks’ > ‘Add Recovery Boot Menu Option…’
  2. Select the relevant version of Windows PE.

What version of Windows PE should I choose?
You should choose a version of Windows PE that can access your System drive and also your backup location. The default option selects the Windows PE version that is the best match for your Windows operating system. This enables the rescue media wizard to automatically copy any required drivers for Network, USB or SATA controllers. However, versions of Windows PE that are more recent than your Windows OS may already contain compatible drivers and also offer additional support for USB 3.0.

PE version Description
Windows PE 3.1 Based on Windows 7. This is the best option for Windows XP, Vista, Windows 7, Server 2003, Server 2008, 2008R2 operating systems. USB 3.0 support is not included.

Note: Some very early Windows XP systems may not meet the minimum requirements to boot Windows PE.

Windows PE 4.0 Based on Windows 8. Similar to Windows PE 5.0, but based on the Windows 8.0 kernel.

This is a legacy option that is provided if you have used previous versions of Macrium Reflect before PE 5.0 was included. Includes support for USB 3.0. We recommend that you use PE 5.0/10 unless your require PE 5.0 features on Windows XP or Server 2003.

Windows PE 5.0 Based on Windows 8.1. Supports UEFI / secure boot, USB 3.0 and HyperV Generation 2 virtual machines.

This is a good choice for Windows 8/8.1 or Windows Server 2012 systems. You may also consider this for older systems requiring default USB3 support.

Note: The Windows PE 5.0 download option is not available if you are running Windows XP or Server 2003.

Windows PE 10.0 Based on Windows 10. Supports UEFI / secure boot, USB 3.0, HyperV Gen 2 VMs and Windows overlay file systems.

This is the best choice for Win 8, 8.1, 10, Server 2012, 2012R2 systems. Windows PE 10 is a requirement if your system uses Windows 8.1 WIMBoot technology or if your system is a Windows 10 ‘Compact Install’. Both of these installation types are rare but may be used on Windows Tablet PCs with limited disk space.

Note: The Windows PE 10.0 download option is not available if you are running Windows XP, Vista or Server 2003/2008



The Macrium recovery boot menu option – Windows 10

Techie Tuesday: Understanding partition alignment


This week for Techie Tuesday we’re covering partition alignment.

Partition alignment refers to the physical sector offset of partitions. There are two alignment possibilities used by Windows:

  1. 1MB alignment. Beginning with Windows Vista/Server 2008 partitions are aligned on 1MB boundaries. For a disk with 512 bytes per sector this equates to 2048 sector alignment.
  2. Cylinder, Head, Sector (CHS) alignment. This is the alignment used by all Windows versions, up to and including Windows XP/Server 2003. Disks are described as having sectors, heads and cylinders, typically 512 bytes per sector, 63 sectors per head  and 255 heads per cylinder. A head is often referred to as a track. Partitions start on a head (or track) boundary and end on a cylinder boundary.

Partition alignment and Solid State Disks (SSD)

Solid State Disks require partition alignment to 4KB boundaries for optimum performance and life. 1MB aligned partitions are aligned on 4KB boundaries so present no problem, however, CHS aligned partition are often aligned on 63 sectors (31.5KB) degrading SSD performance and life time considerably.

Partition alignment and the Macrium Reflect cloning and restore function

To preserve the source partition alignment either…

  1. Select the source partition check box(es) and click the ‘Copy selected partitions’ link.
  2. Drag and drop the source partition(s) to free space on the target disk

To use the target partition alignment.

Note: This could be used to ‘convert’ and XP aligned partition for SSD alignment

  1. Drag and drop the source partition to an existing partition on the target disk

These defaulted alignment possibilities can be overridden in the Partition Properties dialog by selecting the ‘Alignment’ drop down control.

image2015-3-1 13 24 37

For more information why not visit our Knowledge Base.

Microsoft VSS – Keeping it Simple

The Microsoft VSS framework was introduced as long ago as Windows XP and still provides the tools necessary to a create consistent and accurate snapshots of any supported file system on your PC.

We’ve already blogged about how VSS works so in this article we’re focusing on how and why, we at Macrium Software, decided on a simple, non-invasive and reliable implementation of the VSS API for disk imaging.

Read More »

Backup Internals: What is VSS, how does it work and why do we use it?

As happens sometimes, our more technically minded customers question a system that “just works”. We like these sort of customers, as they keep us on our toes. In this specific case, the question was is it safe to continue using my computer during imaging and the answer is yes, although the longer explanation is much more involved. Read More »