Techie Tuesday: Reviewing your backup history


Macrium Reflect maintains an easy to access log of all types of backups and restores where you can review activities, purge the log files and view Windows VSS events.

  1. In the main task bar click Log.

  2. Clicking the Delete old logs icon will take you to the Log file purge settings, where you can select to remove old logs.

  3. Make selection and click OK.
  4. Select the activity you want to review.

  5. If the activity has a VSS log, select to view VSS events, if required by clicking the View window VSS events icon.

Download a 30-day Trial of Macrium Reflect for Home or Business use.

Macrium Reflect 7 will be released on 27th February 2017. Read more here.

Techie Tuesday: Preparing a USB stick for Windows PE


To use a USB stick as a boot device, Windows requires a Master Boot Record (MBR) however some USB sticks are shipped without one and with just a single partition. The USB stick, therefore, needs formatting but the standard Windows format option does not prepare the disk correctly as it does not create a master boot record.  You therefore need to prepare the USB stick using other tools, for example, Windows diskpart.

  1. Start an elevated  command prompt. See Running an elevated command prompt for more information.
  2. Type:
  3. Type:
     list disk

  4. Identify the disk number of your USB stick.Please ensure that you correctly identify your USB stick.
  5. Type:
    select disk <n>

    Where <n> is the number of the disk previously identified as being the USB stick.  Confirm that the current disk selection is correct by typing in detail disk, this will show information relating to the currently selected disk.

    Note: Please be certain you have the disk selection correct before proceeding to the next step.

  6. Type:

    This erases all data on the USB stick.

  7. Type:
    create par primary

    This creates a primary partition on the USB stick using the maximum size available.

  8. Type:

    To make the primary partition active.

  9. Type:
    format FS=ntfs LABEL="Macrium WinPE" QUICK

    This formats the newly created partition on the USB stick for legacy MBR booting.

    If your system has GPT disks and uses the newer UEFI booting standard then please type the line below instead:

    format FS=FAT32 LABEL="Macrium" QUICK

    Note: UEFI booting requires a FAT32 formatted partition and will not recognize NTFS.

  10. Type:

    once the format command has completed to exit diskpart.

  11. Type:

    Again to close the command prompt.

See also: Troubleshooting USB rescue media

Download a 30-day Trial of Macrium Reflect for Home or Business use.

Techie Tuesday: Using Macrium Reflect from the command line


You can retrieve a prompt for all the command line arguments by simply typing reflect -h from the command line.

Running a Backup

The command line form is as follows:

reflect.exe [-v | -e [-w] [-full | -inc | -diff] [xml filename] ]
Explanations for the switches are as follows:

-h This help text
-e Execute the XML file. If no full / diff / inc qualifier is used, a full backup is performed by default.
-v Validate the XML file and exit
-w If Reflect is busy then wait until available otherwise exit immediately
-full Run a full backup
-diff Run a differential backup
-inc Run an incremental backup
-pass Password. Overrides the password saved in the xml file.

Please note that the XML file name is the fully qualified path.

To validate an XML file

reflect.exe -v "c:\backup.xml"

To execute an XML file

reflect.exe -e "c:\backup.xml"

To execute an XML file with wait if busy

<reflect.exe -e -w "c:\backup.xml"

To execute an XML file and create an incremental image

reflect.exe -e -inc "c:\backup.xml"


Mounting an image

reflect.exe [Path To Image File] -b [-auto -drives [Drives[s]] -pass [PASSWORD]]
Explanations for the switches are as follows:

-b Browse image
-auto Automatically assign drive letters. If not specified then you will be prompted
-drives A comma separated list of drive letters to use. If not specified then the next available letters are used
-pass The password for protected image files

The image file name is the fully qualified path. If “LAST_FILE_CREATED” is specified then the last image created in the current Windows session is mounted.


To mount an image and prompt for a drive letter to use

reflect.exe “D:\901DBF91346B9A81-00-00.mrimg” -b

To mount all partitions in an image using the next available drive letter(s)

reflect.exe “D:\901DBF91346B9A81-00-00.mrimg” -b -auto

To mount all partitions for the last image created

reflect.exe "LAST_FILE_CREATED" -b -auto

To mount all partitions in an image using drive letters j,k,l

reflect.exe "D:\901DBF91346B9A81-00-00.mrimg" -b -auto -drives j,k,l

To mount all partitions in a password protected image using drive letters j,k,l

reflect.exe "D:\901DBF91346B9A81-00-00.mrimg" -b -auto -drives j,k,l -pass "PWD"


Unmounting an image

reflect.exe [Drive Letter] -u

Explanations for the switches are as follows:

-u Unmount image


If a drive letter isn’t specified then all mounted images are unmmounted

To unmount an image from drive letter ‘j’

reflect.exe J -u

To umnount all mounted drives

reflect.exe -u


Download a 30-day Trial of Macrium Reflect for Home or Business use.

Techie Tuesday: Cloning a disk


It is possible to clone an entire hard drive or specific partitions on a hard drive. This is useful if you are upgrading to a larger hard drive. With Macrium Reflect you can boot the target disk on the same system after cloning. Cloning your hard drive creates a bootable new hard drive with the state of your computer at the time you undertook the clone.You can clone to a hard drive installed in your computer or to a hard drive installed in a USB hard-drive Caddy.

Windows cannot boot from a USB connected drive. This is a restriction imposed by Windows. If you clone your system disk to a USB connected external drive then, to boot your clone, the physical disk must be removed from the USB caddy and attached to your Motherboard SATA port.
Deleting and re-configuring existing partitions or configuring new partitions is possible with Macrium Reflect, so you don’t need to do this prior to cloning.
Show important information about MS Dynamic Volumes…

  1. Select the disk you wish to clone in the main application window and Click ‘Clone this disk’..

  2. In the wizard that opens Click Select a disk to clone to…
  3. Select the hard disk you wish to clone to. In this case, there is only one disk available.
  4. If you do not want to modify the order or size of partitions of the clone, click Next. This is the default behavior.Alternatively, drag the partitions you want to clone, the red arrow below shows this.


    In this example, there is 400MB of free space after the copied partition. You can modify the size of each partition to fit the new disk if required.You can delete partitions on the target disk by selecting and clicking ‘Delete existing partitions’..
  5. To modify the partition sizes, click Cloned Partition Properties and adjust the size of the partition by:
    1. Setting the partition size precisely using the Partition Size entry box.
    2. Resize the partition automatically by clicking Maximum size, Minimum size or Original size.

  6. Click OK.
  7. If required, click Advanced Options to change settings for this clone:

    Option_____________ Description
    Intelligent sector copy Copy only file system sectors/clusters that are in use. This reduces the time to create the clone as unused file system clusters are not copied.
    Verify File System Verifying the file system prior to cloning ensures that there are no file system errors transferred to the clone.
    Please note that this may take several minutes to complete
    Rapid Delta Clone Copy only file system differences between the clone source and target. This increases cloning speed dramatically.
    Show more information on RDC…
    Enable SSD TRIM Enable SSD TRIM on the clone target to optimize the disk.

    Show more information on SSD TRIM…

    Forensic Sector Copy Copy every sector from the source to the target disk partition.
    Please note tat this option is only necessary if you want to copy unused file system space and will significantly increase the time to complete the clone.
  8. Click Next.
    The options to Add Schedule, Edit Schedule or Delete Schedule is displayed.

    Click ‘Add Schedule’
    to optionally schedule your clone

    Make any required changes and click Next.
    For more information see Scheduling backups.
  9. Review the settings and click Finish.
  10. Verify the settings in Backup Save Options and if appropriate, click OK.

    Saving a backup definition enables you to run your Clone at any time with a single clickNote: You must save your backup definition if you have created Clone schedules. Your schedules cannot run if this step is missed.If you want to run the Clone at this point, select ‘Run this backup now’ and click OK.
  11. A Warning box appears, if appropriate click Continue.

    The target disk for the clone operation will be overwritten. This is unrecoverable, so please ensure that the target disk contains no valid data.The clone operation now starts.
    Incompatible Disk Selected
    If you receive the error message ‘Incompatible Disk Selected’ when cloning then please see this article for more information: Incompatible Disk Selected

Creating a clone video


Download a 30-day Trial of Macrium Reflect for Home or Business use.

Techie Tuesday: Differential and incremental disk images


The entire contents of the imaged file system are stored in a full image file. This is a reliable way of backing up your PC, however, repeating the process is slow and subsequent images can fill your backup media very quickly.

After you have created an initial full image, you can create differential and incremental images. These are both quicker to execute than full images and create much smaller image files.

Note: With the Free Edition of Macrium Reflect you can only make full and differential images of your disks and partitions.

Differential Images

A differential image stores the changes that have been made to the imaged file system since the last full image. Subsequent differentials can be taken, but only one differential and the full are required in order to fully restore the system.
This is quicker than creating a full image, however the longer the time between the full and the differential, the larger the differential image file is and the longer it takes to create.

Advantages of differential images:

  • Differential images created after the initial full Image are very quick because only file system changes since the full backup are saved.
  • The amount of disk space used by differential images is significantly less than that of full images.
  • Only two image files are required to restore the system.

Disadvantages of differential images:

  • As the time since the last full image was taken increases, the size of the differential grows as does the time it takes to create the differential image.
  • In order to reduce this time, it is necessary to perform a full image occasionally to reduce the size of the subsequent differential images.

Incremental Images

The main difference with incremental images is that they only store file system changes since the last image, either full, differential or incremental. The resultant backup set therefore consists of a full image and a number of incremental images which must all be present in order to restore the system correctly.

Advantage of incremental images:

  • Incremental images have the same advantages as differential images, but since they only store the changes that were made since the last full or incremental. They are always small and very quick to make, especially if done frequently.

Disadvantage of incremental images:

  • All files must be present in the image set. If any intermediate incremental images are missing, it is not possible to restore the system to the latest backup.

Maintaining backup sets

Maintaining backup sets can seem an onerous task, however, Macrium Reflect takes care of all the hard work for you. With Macrium Reflect you can schedule incremental or differential backups automatically. It is as simple as selecting the image you wish to restore and Macrium Reflect automatically selects the required files in the image set as part of the restore process. The same is true for exploring an image. If you choose to explore an incremental image in an explorer window, Macrium Reflect reconstructs all the files that have been backed up to that time.

Macrium Reflect also includes functionality to automatically delete expired image sets. For example, if you take a full image every month and then incremental images every day, you can configure Reflect to keep two full image sets (the equivalent of two months of backups) and delete any older files. As a result, your backup media does not become full of obsolete image files.

Selecting an incremental or differential backup

The process for creating a differential or incremental backup is the same. Both save changes since the full backup if this is the only backup made so far.

  1. Initiate an incremental or differential backup, select Backup Definitions Files. In this instance, there is one saved XML definitions file MyBackup.xml which contains the configuration required to back up the C drive.
  2. Right click MyBackup.xml and select Run Now.
    You are presented with a number of options.
  3. Select Full, Incremental or Differential to automatically execute that particular backup. If unsure which you want to run, click Prompt.
  4. Click Finish.
  5. When the Image is complete close the dialog.

Alternative method using an existing backup

  1. Click the ‘Restore’ tab
  2. Select either Image Restore or File and Folder Restore.
    This presents a list of image or file and folder backup files
  3. Select the file that you want to create an incremental or differential from.
  4. Select Other Actions… link, and choose ‘Differential’ or ‘Incremental’

Download a 30-day Trial of Macrium Reflect for Home or Business use.

Techie Tuesday: New Feature – Logging file changes for Incremental and Differential Images


Your Windows operating system and installed applications can create many changes ‘under the hood’ without you knowing about it. This can cause Incremental or Differential images to be substantially larger than expected. This article describes a feature in Macrium Reflect to log files that have been changed in each Incremental or Differential image.

Please Note: Macrium Reflect must be at v6.3 or later. Please take the ‘Other Tasks’ > ‘Check for updates’ menu option in Reflect if you are running an earlier release.

What are Incremental and Differential Images?

Incremental images will only backup data blocks that have changed since the last Image or, in the case of Differential, Full image in the backup set. Images are created at File System cluster level and each block is MD5 hashed and compared. Blocks with the same hash signature aren’t included in the Differential or Incremental image file. A data block is usually 16 clusters in length.

See also: How backup sets are created and maintained

How to show changed files

If the following registry entry is set, Reflect will perform a reverse ‘look-up’ to identify the file for each cluster that is backed up.

Please Note: This may increase the time taken to backup and should only be used for diagnosis.

Key: HKEY_LOCAL_MACHINE\SOFTWARE\Macrium\Reflect\Settings
Name: LogIncrementalChanges
Value: 1

Once the registry entry is set, perform another Differential or Incremental Image and, once complete, delete the registry entry created above. Then use Windows Explorer to navigate to: ‘C:\ProgramData\Macrium\Reflect’ in Windows Explorer and sort by Modified Date:

In addition to the normal ‘.html’ and ‘.vsslog’ files you will also see files with ‘.inc.log’ at the end. There will be one for each NTFS partition in the Differential or Incremental.

The first file, {IMAGEID}, is the log for the first NTFS partition, the next file is , {IMAGEID} and,

in the above example, {IMAGEID} is the last last NTFS partition in the image.

Example log output

MFT Record - 32 - .\$Extend\$RmMetadata\$TxfLog\$TxfLog.blf 
MFT Record - 34 - .\$Extend\$RmMetadata\$TxfLog\$TxfLogContainer00000000000000000002 
MFT Record - 38 - .\Windows\Prefetch\AgGlGlobalHistory.db 
MFT Record - 39 - .\Windows\Prefetch\AgGlFaultHistory.db 
MFT Record - 43 - .\Windows\Prefetch\AgRobust.db 
MFT Record - 45 - .\Windows\Prefetch\AgGlFgAppHistory.db 
MFT Record - 1236 - .\Windows\SoftwareDistribution\SelfUpdate\WuPackages.xml 
MFT Record - 1333 - .\Program Files (x86)\TeamViewer\Version8\TeamViewer8_Logfile.log 
MFT Record - 1353 - .\ProgramData\Microsoft\RAC\PublishedData\RacWmiDatabase.sdf 
MFT Record - 1592 - .\Users\Dev\AppData\Local\Google\Chrome\User Data\Default\Current Session 
MFT Record - 1783 - .\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Log\ERRORLOG 
MFT Record - 13900 - .\Windows\System32\winevt\Logs\Microsoft-Windows-PrintService%4Admin.evtx 
MFT Record - 15637 - .\Windows\WindowsUpdate.log 
MFT Record - 15741 - .\Windows\System32\winevt\Logs\Microsoft-Windows-Windows Defender%4Operational.evtx 
MFT Record - 15743 - .\Windows\System32\winevt\Logs\Microsoft-Windows-Windows Defender%4WHC.evtx 
MFT Record - 15755 - .\Users\Dev\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\http_localhost_2904.indexeddb.leveldb\LOG 
MFT Record - 15868 - .\Windows\bootstat.dat 
MFT Record - 21541 - .\Windows\security\database\secedit.sdb 
MFT Record - 21544 - .\Windows\ServiceProfiles\LocalService\NTUSER.DAT 
MFT Record - 21565 - .\Windows\ServiceProfiles\NetworkService\NTUSER.DAT 
MFT Record - 22562 - .\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\MpCmdRun.log 
MFT Record - 22649 - .\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 
MFT Record - 22650 - .\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 
And so on......... 

Each log file lists the MFT record and full path name to the file(s) that have changed.

Please note: There will be many MFT metadata files (prefixed by ‘$’) that are not visible to Windows Explorer or any other windows utilities, but these are always included (if changed) in Diff/Inc image files.

Please note: This doesn’t mean that all clusters in the listed files have changed it means that the file clusters are scanned and differences have been detected.

Download a 30-day Trial of Macrium Reflect for Home or Business use.

Techie Tuesday: Adding BitLocker support to Windows PE


Note: It isn’t absolutely necessary to unlock a BitLocker encrypted drive when restoring an image of the encrypted partition. The partition will restore without a problem and will be automatically re-encrypted on reboot, however, unlocking the drive in Windows PE enables intelligent sector copy imaging and cloning, RapidDelta Restore (RDR) and also free access to the drives contents using PE Explorer.

Automatically unlocking BitLocker encrypted drives

Macrium Reflect can include the components and decryption keys necessary automatically to unlock Microsoft BitLocker encrypted drives in Windows PE.

In the Rescue Media Wizard select ‘Include optional components’ and ‘Automatically unlock BitLocker encrypted drives’

When Windows PE starts any BitLocker unlocked drives that are were attached when the recovery media was created will be automatically unlocked in PE.

Unlocking BitLocker encrypted drives using a USB stick

Automatically unlocking encrypted drives when PE starts may present an unacceptable security risk for some users. Automatic unlocking requires no user intervention and the Macrium Reflect boot menu is able to access encrypted drives without password entry. An alternative method is to de-select the ‘Automatically unlock BitLocker encrypted drives’ option in the rescue media Wizard:

You can then save BitLocker Encryption Key files (.BEK) and/or BitLocker password TXT files to the root of any USB stick. This could also be a Windows PE rescue media USB stick.

  1. In Windows Explorer, right click on any BitLocker encrypted drive and click on ‘Manage BitLocker’.

  2. In the newly opened window click ‘Back up your recovery key’

  3. In the BitLocker Drive Encryption wizard select ‘Save to a USB flash drive’ and chose the USB device you want to save to.

    After choosing the USB device you want to save the Recovery Key file to, click ‘Save’ and then ‘Finish’ in the BitLocker Drive encryption wizard. This action will save a .BEK file and/or a recovery password text file to the chosen USB device.

    Note: The .BEK file is a protected operating system file, it is hidden by default and won’t be visible within Windows Explorer. it can be made visible by changing Folder Options and de-selecting the option to ‘Hide Protected operating system files’.You can add as many keys as you have encrypted drives.

When Windows PE starts ensure that your USB flash drive is attached to your PC. Your encrypted drives will then be automatically unlocked when Macrium Reflect initializes.

Note: PE 10 1607 is only relevant when using BitLocker XTS or iSCSI, otherwise it’s a wasted download. So, if you are already using PE 10 then Reflect checks for XTS BitLocker encrypted partitions and only downloads 1607 if you are.

You can force a rebuild using PE 10 1607 by setting the following registry entry and rebuilding your rescue media.

Download a 30-day Trial of Macrium Reflect for Home or Business use.