Forgot your password?
typodupeerror
Data Storage Operating Systems Software Windows IT

Good Freeware System Snapshot Tool For Windows? 219

Posted by timothy
from the esoterica dept.
Khyber writes "I'm doing a little personal research into a project that tracks what changes get made to your system every time you install a program. I know there are ways of checking through Windows Restore Points, but that's not what I'm trying to do. Instead, I'm going to start with an absolutely fresh Windows XP install, take a full snapshot of the entire installation on the hard drive, and burn that to a DVD (somewhat like a backup disc with an entire snapshot of my hard drive's current contents.) With every program I install, I'm going to take another snapshot, burn to DVD, and repeat the process until I have recreated every step taken to get to my current system state (all programs installed on a separate hard drive, all registry entries etc on the OS drive, with only snapshots of the OS drive being recorded.) The purpose for all of this I'm not legally allowed to talk about, due to confidentiality requirements. Does anybody know of such a program, preferably freeware, that will accomplish my objective, and are there tools that can be used to compare the difference in drive images?"
This discussion has been archived. No new comments can be posted.

Good Freeware System Snapshot Tool For Windows?

Comments Filter:
  • FOG might do it. (Score:5, Informative)

    by millia (35740) on Tuesday November 11, 2008 @10:28AM (#25719999) Homepage

    Wow, quiet in here.

    FOG, aka Free Open Ghosting, at www.fogproject.org, will certainly take images of your hard drives; that's not a problem.
    And, I haven't played with it, but it has the capability to do install packages, so that meets the bit-by-bit portion of things.

    Like most open-source packages, FOG improves constantly, and recently, it's getting better by leaps and bounds.

    • Re: (Score:3, Funny)

      by n1ckml007 (683046)
      Windowskey + E then alt+printsrn then Ctrl-v to paste into MSPaint There's your snapshot
      • Re: (Score:2, Informative)

        by MrNaz (730548) *

        The best snapshotting tool I have found (I'm not entirely sure if this is what you are after, as the summary is not clear) is BartPE with the DriveImageXML plugin. It's free and legal, although you need a Windows XP disc to build the tool (no really, it's free and legal).

        I use it to install Windows fresh, add my apps, and then take a snapshot. If there is a virus attack or the install is otherwise dirtied, I can restore to a clean Windows install in around 10 minutes as opposed to the 2 or 3 hours it takes

        • It is unfortunate that acronis [acronis.com] don't offer a free solution, but (despite this fact) I'm still going to recommend them heartily for being solid and damned good. Judging by the fact that your work is "classified" I'm guessing they could afford to shell out a few bucks for the home edition. I've also seen hack jobs put together out of FreeDOS boot disks and file transfers.
    • by Moryath (553296)

      Norton Ghost is fairly cheap and Ghost Explorer will allow you to "browse" the images. I'm not entirely sure on the comparisons angle.

      Trying to make an "alternative system rollback/savestate" program are we?

      • Re:FOG might do it. (Score:4, Interesting)

        by Anonymous Coward on Tuesday November 11, 2008 @12:12PM (#25721537)

        Norton Ghost is fairly cheap and Ghost Explorer will allow you to "browse" the images. I'm not entirely sure on the comparisons angle.

        Trying to make an "alternative system rollback/savestate" program are we?

        First, Ghost sucks. Not version 8, which was awesome, but the recent versions, which won't let you run ghost off the damn CD you paid for. No, you have to find an old copy and put that on a USB or other HD to run it from. B-tards.

        This guy isn't trying to make his own ghost, he's trying to clone registry keys and serial numbers so he can push a software install. So he's tryign to clone Installshield, but in a way that magically provides great MSI compatibility to installers that don't already have MSI functionality.

        AKA the windows tech pipe dream. And I say this after my last post was called an anti-apple troll because I suggested a $299 emachine laptop was "good enough" for most people vs a $1500 macbook :p

        Oh and thanks to OP for the FOG link. Hadn't heard of it.

        Captcha: atheism - the practice of not believing Steve jobs is God

        Take that mods :)

        • by jp10558 (748604)

          If he actually wants to snapshot installers, then he could try Total Uninstall? Or he could try Emco.is and their RDK which has worked decently for me.

          If he actually just wants to snapshot a drive, then there's Seagate's tool that's a stripped down Acronis(free with a Seagate drive hooked up), or the full Acronis True Image(not free though)...

    • Re: (Score:3, Informative)

      by Gazzonyx (982402)
      I've used FOG before, a few months ago, in fact. It just isn't production ready yet. IIRC, you had to install a service on the windows box, etc. The web interface was somewhat counterintuitive and left a bit to be desired. It also had a few rather annoying bugs. This may have changed since the last time I used it. I'd say that as it was a few months ago, you'll be pulling you hair out since it works just enough to let you see what it's capable of, and then falls through on delivery of said capability.
    • by kv9 (697238)
      I use G4U [feyrer.de]. it can snapshot your system on a remote server and do all kinds of neat tricks.
  • Depending on how long you need to keep the backup, Acronis [acronis.com] makes some great imaging utilities with free trials
  • by MikeV (7307) on Tuesday November 11, 2008 @10:29AM (#25720023)

    ...but then I'd have to kill you. You know, confidentiality agreements and whatnot...

    • No kidding. The story seems a bit too much like "do my job for me". It says it's just a "personal research project" but if it really were personal, then there wouldn't be "confidentiality requirements". Maybe this guy's a RIAA/MPAA stooge and wants to more efficiently look for P2P software or something.

  • by Daryen (1138567) on Tuesday November 11, 2008 @10:31AM (#25720055)

    The best tool I have ever used is Prism Deploy [newboundary.com].

    It isn't free, but they do have a free trial. I've tried a number of programs to package executable programs and manage Windows images, but nothing has come close.

    I'm really interested to see if there are any freeware programs that come close.

    • We use Prism App Manager where I work to perform remote installations, and it's appalling.

      Prism is based upon taking a baseline image and checking for changes after an installation, which in itself is fine. You will get an identical installation of every package each time.

      The issue arrises when you use an old package on a newly patched machine, and it overwrites a patched file with an older, unpatched version. This can happen when installing Office 2007 on a machine, then running an Office 2000 package, a
      • by Daryen (1138567) on Tuesday November 11, 2008 @11:58AM (#25721307)

        I agree, this is a poor choice if your only goal is a typical black box Windows image. However, listen to what the author was trying to do:

        I'm doing a little personal research into a project that tracks what changes get made to your system every time you install a program.

        As you know from using it, Prism Deploy allows you to see every single file change, registry change, file deletion, and file modification that has been made since the last snapshot. Sure, you could put all of that into an executable if you want and distribute that, but you could also save it as a prism image, and use that information to create your own package, or in the author's case, whatever undisclosed nefarious purpose he has in mind.

        I'm going to start with an absolutely fresh Windows XP install, take a full snapshot of the entire installation on the hard drive, and burn that to a DVD... With every program I install, I'm going to take another snapshot... all programs installed on a separate hard drive, all registry entries etc on the OS drive. [emphasis mine]

        I think that prism deploy (or a similar tool) would allow him to do this with minimal work.

      • Upon further investigation (R'ingTFA), I see you also wish for image comparisons.

        Prism certainly doesn't include this function.
  • Rsync is your friend (Score:2, Informative)

    by frith01 (1118539)

    If all you need is an indication of what files
    have changed, then just use rsync --only-write-batch=FILE

    http://samba.anu.edu.au/ftp/rsync/rsync.html [anu.edu.au]

    If you need more detailed descriptions (especially for registry changes) you may want to export the registry files in a pre-script, then diff the registry entries.

  • by Anonymous Coward

    The easiest way is to run dual boot Fedora/XP. It will take you all of a couple of hours to install Fedora/Ubuntu/Whatever from a Live CD, partitioning the drive as required during the install. You can then backup the whole Win partition without Windows locking any files and what-not. Another approach is to add in another disk for that purpose, maybe a USB thumbdrive if your OS can boot from it.
    The other approach is to use a VM machine. There are some cut-down versions of XP designed to work well in them.

  • WinINSTALL? (Score:4, Informative)

    by dsginter (104154) on Tuesday November 11, 2008 @10:38AM (#25720139)

    WinINSTALL LE [microsoft.com]

    Download [ondemandsoftware.com]

  • by pinky99 (741036)
    knoppix + dd
    • by TheLink (130905)
      I used to use knoppix + dd + lzop

      e.g.
      time dd if=/dev/sda bs=131072 conv=noerror | lzop -c > /mnt/backupdrive/20081111-machine1-sda.img.lzo

      (WARNING!!! Achtung!!! Do NOT typo the if=/dev/sda and make it of=/dev/sda there is a very big difference ;) )

      gzip might be fast enough on modern CPUs to give near max disk speeds.
      But I still only get about 33-35MB/sec with gzip on my core 2 duo for the first 1000 blocks of my drive (even cached!). lzop is much faster.

      The conv=noerror is to tell dd to ignore read error
      • by Fweeky (41046)

        dd_rescue > conv=noerror. It'll read in big blocks and when one fails, it'll drop the block size and retry, so you don't lose a 128k chunk when there's only one unreadable 512 byte sector.

      • by TheLink (130905)
        Sorry!

        Should be conv=noerror,sync
  • Xen? (Score:5, Interesting)

    by SanLouBlues (245548) on Tuesday November 11, 2008 @10:40AM (#25720173) Journal

    Sounds like a virtual environment is exactly what you need.

    • Re: (Score:3, Informative)

      by Khyber (864651)

      No, I do not need a virtual environment.

      I want to do this on a level THE REGULAR COMPUTER USER CAN ACHIEVE. This needs to be easily and SIMPLY explained and proven in a court of law. As the machine I will be doing this test on will be the same machine admitted as evidence, it will be much simpler to have it all contained within a pure windows environment.

      ANYTHING requiring Linux or Unix will not be that simple, period, as this only involves the Windows OS and the BEST evidence is a direct comparison through

      • by jp10558 (748604)

        I think Total Uninstall will track all changes and show them, including registry changes between two scans it does. So you'd do a scan, do an install, scan again save that. Rinse and repeat... Not free, but $35 or so is cheap, and totally windows, though you do need to first install Total Uninstall...

        • by Khyber (864651)

          That would be nice except I wish to have *ONLY* the original OS install, and the programs which I will be installing, nothing more.

          Got anything that would work on a USB stick so the OS install isn't touched besides from what I plan on installing on it for the demonstration? Preferably freeware and will work in Windows itself (the comparison tool, whether it be for drive images or just filechange logs) so the average juror can understand it easier?

          • by jp10558 (748604)

            Not that I know of... Perhaps Filemon/Regmon from sysinternals? But not nearly as easy to understand as Total Uninstall is. . .

  • Why? (Score:5, Interesting)

    by ledow (319597) on Tuesday November 11, 2008 @10:42AM (#25720199) Homepage

    Personally, I use Ghost for imaging and if I want to find out what a program is doing, I run sysinternals File Monitor and Registry Monitor. They're real-time and don't record in a nice format but nothing really beats them on Windows. They've helped me diagnose hundreds of horrible modern and ancient installation programs used in an educational environment to allow network installation (why, exactly, do you need write access to C:\WINDOWS to run a Shockwave-based game for toddlers, etc.?).

    Linux/Unix has this much easier because it allows you to monitor EVERYTHING without massive binary blobs having settings stored in them, having settings locked to particular machines, etc. or things generally getting in your way. Windows, it's a pain in the proverbial.

    Even a lot of the professional MSI-Builders with their "discovery" modes are absolutely useless at working out what was actually a vital change and what was just the installer playing about, or the user changing their screensaver / explorer view preferences while they installed etc. I spend half my life cleaning MSI's of unnecessary cruft and inserting the entries that they miss. About 50% of automated install captures like this are useless for deployment to a different machine.

    Basically, despite the "secrecy" around your particular purpose (why did you have to mention that at all... it makes no difference to what you want and adds nothing to our knowledge), it's probably not worth the hassle. Before and after snapshots, or package the programs and MSI's and you'll find out everything you need along the way, with an actual, practical result at the end. Trying to diff a filesystem/registry image in any way is madness and is only useful if you can get a *perfectly* clean machine, a VERY good automated program to do it brilliantly, where you'll end up with a lot of cruft that isn't related to the program installation at all (e.g. event log entries, temporary files, taskbar icons saving their settings etc.).

  • Virtualization (Score:4, Insightful)

    by pipatron (966506) <pipatron@gmail.com> on Tuesday November 11, 2008 @10:42AM (#25720205) Homepage

    Do the install in a virtual machine like VirtualBox or similar. Then you can do as many snapshots you like directly.

  • by Auroch (1403671) on Tuesday November 11, 2008 @10:43AM (#25720225)
    Well, I havn't read the article, but just hit prt-scr! Although, some computers require you too hit function+prt scr. Of course, linux and OSX have better screen shot tools built in. Linux also has GIMP, which does shots! Yup, clearly the answer is 'switch to linux'!

    Seriously, do we even need an article on this?

    ... I wonder how important the article is after all, but I'm too lazy to read it ... *sigh*
  • by metaphorplay (1041734) on Tuesday November 11, 2008 @10:44AM (#25720235)
    I would recommend regshot at sourceforge. GPL'd.
  • by Judinous (1093945)
    1. Install program on Windows 2. Boot to linux live cd of your choice 3. cat inputdevice > outputdevice 4. Repeat steps 1-3 as needed 5. diff 6. ????? 7. NDA'd
  • I'd use xVM (Score:4, Insightful)

    by florin (2243) on Tuesday November 11, 2008 @10:47AM (#25720267)

    You might of course just use any hard drive imaging tool, but this is rather slow and clumsy, and it will use a lot of disk space (which isn't necessarily a problem if you really wanna burn a DVD every time). It might be easier and quicker to use one that supports incremental backups. I like Acronis True Image a lot but it is not free.

    If you mainly want to document changes done to a running system over time, virtualisation products might fit your purposes well. Most of them have some sort of ability to make snapshots. The popular free VMware Server only allows a single snapshot, but Sun's xVM is every bit as good and does multiple snapshots easily [techtarget.com].

    • Re: (Score:1, Informative)

      by Anonymous Coward

      Ditto. In my opinion, your methodology is insane and unlikely to produce anything of value -- Windows really is huge, and much of the data you're interested is locked away past the filesystem level of abstraction -- but doing it with a VM makes a lot more sense than doing it on actual hardware. You can switch between states easily. You can retain easily-bootable, read-only copies of previous states (say, if you want to dump the registry). In any event, you don't tie up an entire computer for this project, a

      • Re: (Score:3, Interesting)

        by Khyber (864651)

        virtualization takes TOO LONG.

        I'm going to be demoing this LIVE in court. That's NOT FEASIBLE AT ALL.

        I've got most of what I need - I just need a GREP tool for windows. DIR /b /s /a:AHRS > file.txt is fine for almost everything. I need a comparison tool.

        Does the command I listed above happen to record filesizes as well? The faster and quicker I can make this happen in court, the better off EVERYONE will be. It's gotta be simple enough for a JURY OF MINDLESS IDIOTS TO UNDERSTAND.

        In other words - LINUX, UN

        • by jp10558 (748604)

          If you don't like my previous suggestion, you might try Cygwin? Then you do have grep...

          • by Khyber (864651)

            cygwin might work.

            So many suggestions, I'm having problems deciding which woudl be better:

            my original suggestion - the DIR command with all the extended parameters outputting to a text file - can be used to demonstrate changes made to the system and be used for demos

            Anon-inspired idea: Dual boot XP on separate hard drives within the same system, C as base comparison control, D with the software causing the problem - easier hardware forensics analysis and comparison

            Majorly recommended but not feasible for th

            • by karnal (22275)

              Why not two identical systems? I have a feeling even "dual booting" may not prove your point since the average person probably doesn't know what that even means.

            • by Stray7Xi (698337)

              I think the way you asked your question lead to confusion, since it appears you don't care about file contents.

              If all you want is diff, install diff, don't install cygwin if you're only going to use a couple tools. Most GNU tools have a windows build. http://gnuwin32.sourceforge.net/packages/diffutils.htm [sourceforge.net]

              Some antivirus will hook write events (I know Avast can for example, I'm assuming Kaspersky can too), they do this to ask permission (allow? deny?), however if you set up the logging right, you could get

        • ehm do you mean the 'fc' (File Compare) command that comes with windows, by any chance?

          If you need more, you might want to download a Windows version of 'diff', hte standard UN*X tool for this sort of thing.
          It's available at:
          http://unxutils.sourceforge.net/ [sourceforge.net]

          Just copy diff.exe from the zipfile to c:\windows and you're set to go.

          Example: diff c:\oldregistry.reg c:\newregistry.reg

          Once, you've enjoyed 'diff', you might want to look into 'find' in the same Zipfile.
          Example: find c:\ -ctime -2
          This will report all f

          • by Khyber (864651)

            Great suggestion - however I need this to be easy for the average clueless American computer user to be able to do and come to the same conclusion. I've outlined the details in a few of my responses to this thread, the most recent and updated idea/system in mind is in response to GNU above.

        • >type filename.ext | find /i "searchstring"

          Where filename.ext is the file name and
          /i means "ignore case". omit this is want case-sensitivity grepping for:
          "searchstring"

  • Partimage (Score:3, Informative)

    by horatio (127595) on Tuesday November 11, 2008 @10:48AM (#25720275)

    I was looking into taking a snapshot of a fresh+patched windows install because I was tired of reformatting and then spending hours reinstalling+patching.

    I checked out http://www.partimage.org/ [partimage.org] which seems to be the tool targeting what you're trying to do.

    For me, it didn't work out because the only apparent way to burn an image to disc is to have DVD+RW media [sysresccd.org] and I didn't have the patience to wait until I could get to the store to buy the rewritables.

    • Re: (Score:2, Informative)

      by ternarybit (1363339)
      Try PING (PartImage is Not Ghost) -- ping.windowsdream.com [windowsdream.com]

      Very flexible, lots of driver support, backup from/to CD, HDD, USB drive, FTP or network share, and GPL'ed. Active forum, too.
  • by jgtg32a (1173373)
    Just use DD it's easy

    http://www.ss64.com/bash/dd.html [ss64.com]
    • by ratboy666 (104074)

      Sure, I'll "second" that.

      Make sure the disk is zeroed prior to installing anything (dd if=/dev/zero of=/dev/sdb -- replacing sdb with whatever the drive actually is).

      The partition the drive and install your software.

      To capture -- dd if=/dev/sdb | bzip2 >image.bz2

      I would use bzip2 instead of gzip for the slightly better compression. It would be possible to "delta" two images, but you didn't ask about it.

      This presumes unix (linux), possibly as a "live cd"; it may be workable with "cygwin".

      It is ALSO possib

      • Yeah, just like GP said... Easy!

        http://www.linux4dummies.com/WTFisSDBandhowdoIfindoutwhatmydriveactuallyis?
        • by ratboy666 (104074)

          Easy... is relative. Let's try to remove Unix (Linux) from the equation:

          There is a weird convention used with Windows for direct drive access:

          http://support.microsoft.com/kb/100027 [microsoft.com]

          \\.\PhysicalDriveN for physical drives (0, 1, 2...), or \\.\X: for logical drives (C, D, E...). Of course, the mapping between physical and logical isn't particularly clear, given the partition tables on the physical devices.

          Under Unix (linux, here) /dev/sdx is physical drive x (a b c...), /dev/sdxn (1 2 3...) is a partition. Its

  • Get a Linux live CD and an external USB drive. Use rsync on the virgin installation and then you can use rsync to only archive the changes from that point on. If you are really stuck on having DVDs at the end of this, you can then merge the two rsyncs (the original with the changes) and burn that to disk.
  • Horribly Inefficient (Score:5, Informative)

    by Ralish (775196) <ralish AT gmail DOT com> on Tuesday November 11, 2008 @10:51AM (#25720321)

    What you're aiming to do is perfectly valid but the method you describe in order to achieve your goal is horribly inefficient; I'd be hard pushed to think of a more time-consuming and difficult way to achieve your goal. My tip:

    This sounds like an absolutely ideal scenario where you could benefit from virtualisation technology. Install the system you wish to "monitor" in a virtual machine. I come from the VMware world, and I can say that the snapshots feature of VMware Workstation would do exactly what it sounds like you want. Whenever you wish to capture an image of the present state of the machine, take a snapshot. Further, you can take as many snapshots as you please, these snapshots can be built on previous snapshots, and you can even have branching snapshots. Icing on the cake: only the differences since the last snapshot will be saved, so you'll save a huge amount of data versus burning complete snapshots to DVD.

    What next? Simple, mount the snapshots as a drive on the host machine and diff them using the tool of your choice. I use WinDiff for basic directory/file comparison, but there's a multitude of options out there. The only problem I can imagine would be you probably can't mount multiple snapshots simultaneously from the same virtual disk, but you could get around this by just making a copy of the VHD on your HD and mounting the second snapshot off that.

    By the way, there's likely other virtualisation products out there (e.g. VirtualBox) that can achieve what I described above, I'm purely using VMware Workstation as an example as it's my virtualiser of choice. Further, VMware Workstation is not free, VBox is.

    • by orabidoo (9806)
      confirmed. VirtualBox does a great job and is freeware (there's even a GPL version).

      even better, run VirtualBox on linux and create windows instances, then you have the best of both worlds: linux stability and security, and access to windows applications.

    • by hAckz0r (989977)
      I have to agree about the VirtualBox as a solution. If he makes a snapshot and restarts from that snapshot each time he could save a lot of time, and a separate snapshot OS/image could even be used for actually performing the delta imaging and comparison. The WinDiff on the other hand may be under powered depending on his actual purpose. If he is examining malware code he will need some more powerful tools to see what was actually changed, such as hidden NTFS data streams, raw disk sectors, etc. In that cas
    • by HTH NE1 (675604)

      Also, unless you're only ever installing on the system and no one ever actually uses it, you'll probably want to take snapshots immediately before installation as well as immediately after. Things change just from day-to-day use. You wouldn't want a restore after a bad install to lose all your work since the previous install.

    • by Reziac (43301) *

      Tell me if I'm making shit up, but wouldn't it be possible to do it like this?

      Run two VMs.
      Install your setup in both.
      Add apps to the 2nd VM.
      Do a DIFF of the two running VMs.

      Dupe the 2nd VM to a 3rd VM, rinse and repeat the further steps.

      And so on, saving the DIFF info between generations of VMs.

      And only save DVD snapshots of each VM for "in case the process dies before I'm done, so I don't have to start over" and for archival documentation, but don't waste time DIFFing DVDs (which has gotta be WAY slower th

    • by Khyber (864651)

      Virtualization is useless in a live demo in front of a jury that has NO CLUE what virtualization/Linux/Unix is.

      I must keep this simple and to the level the regular juror will understand.

      The full process goes like this.

      1: Install Windows on a freshly full-formatted HD.
      2: DIR /b /s /A:ASRH > file.txt to get a listing of every file present, hidden, system, read-only, etc.
      3: Install a program with a DRM feature
      4: Repeat step 2, then check with some form of GREP for windows or something to compare the two wri

      • by neonfrog (442362)

        A good generic file comparison tool I've used is Beyond Compare:

        http://www.scootersoftware.com/ [scootersoftware.com]

        Has a 30-day trial and a reasonable cost.

        Why I'm replying to your ungrateful and horrible impoliteness is beyond me, though. I really like how you didn't say that virtualization wouldn't work in your original question, nor did you mention the scenario/target audience, yet you are insulting those who couldn't read your mind. Well done!

  • Just boot from a liveCD, then clone the drive?

    That would make sure that your clone is consistent, and since you cannot continue working with the pc while the cloning is in progress (that would certainly make it inconsistent), there is not much disadvantage in rebooting.

    If you want to get fancy, install a second OS, and make a script that upon booting that OS automatically clones the first OS and then reboots. Any linux can do this easily.

    Since you also have a second drive, the burning to dvd can happen late

  • by Anonymous Coward

    It is called the Shadow Copy. It will give you snapshots of the drive state periodically and all the changes (this is not Restore Points). More info can be found here...

    http://sansforensics.wordpress.com/2008/10/10/shadow-forensics/

  • i Use http://www.clonezilla.org/ [clonezilla.org] to backup the HD. nomaly i only backup the patision were the system is on, a 100GB HD i take 20 GB for the backup then it don't take me 3-10h to install windows + programmers + setup then it only take 10 mins. to get back on and the children can play agen. fist time i say to my border nothing can go rung it took him 10 mins to fuck windows up :) he was 6 at that time
  • Try cygin + dd [lippmann.us].
  • Macrium Reflect (Score:1, Informative)

    by Darksun (97127)

    Is free for personal use, makes images, creates a boot cd for recovery. very slick program.

  • Check out the Microsoft Business Desktop Deployment software. Free and pretty easy to setup and use.
  • by Junta (36770)

    Is there a reason why sysprep wouldn't work? It's already on your system I would wager.

  • g4l (Score:3, Informative)

    by digitalhermit (113459) on Tuesday November 11, 2008 @11:15AM (#25720659) Homepage

    There's a tool called Ghost 4 Linux that might do what you need. You boot with the g4l disk on your backup target. You can then specify a remote server or a local storage device to create the image backup. It doesn't matter what OS is being stored as it's a physical image.

    Files can be very large because it copies sectors, not files, so even deleted files can take space. To minimize this there are some disk zero utilities that will zero out the unused space on your drive.

    I use it often for backing up my Windows laptops.

  • by DiSKiLLeR (17651)

    If only Windows ran on ZFS :(

    Us Solaris peeps do *exactly* this. Take a snapshot immediately after install, take another snapshot after configuring the system, take any additional snapshots later...

    I would post an output from zfs list showing all the snapshots taken on the root filesystem, but unfortunately slashdot's lameness filter REFUSES to cooperate telling me to use fewer junk characters :(

    FreeBSD http://wiki.freebsd.org/ZFS [freebsd.org] and MacOSX http://www.apple.com/macosx/snowleopard/ [apple.com] will soon have proper ZFS

    • by Fweeky (41046)

      FreeBSD's UFS2 supports snapshots too, though they're not as effecient as you might like.

      I'm pretty sure NTFS supports snapshots in the form of the volume shadow copy service, but they're not as clearly exposed to the user.

  • Regsnap from LastBit Software will snapshot the entire registry and system file
    lists (if you want it to) and save it out to a file. Once you make your changes
    or installations you can snapshot it again and then directly compare the two files
    and generate a difference file of all the changes to the system. It's a fairly
    useful utility for capturing what installers/applications do to windows based
    systems. Unfortunately it's not free.

  • then you have to look at drivesnapshot. Drivesnapshot.de is the website, it isnt "cheap" but not expensive and worth EVERY penny. This plus the software at runtime.org for data recovery and you are set for $200
  • Sounds to me that you might look into the API of Thinstall [thinstall.com]. It has to keep track of all changes so that it can run a packager. I have played with a few apps that have been created from it and they seem to work great. I imagine that if the API is good getting to that info and even tweaking it might be possible.

    Sera
  • Taking an initial and progressive snapshots are a good idea to start with and a VM tool will let you do this if you are just monitoring what software is doing. Go with Virtual PC 2007, it is free and will let you take the VHD images and later remount them as secondary drives on a VM to compare them.

    However depending on your end goal, it might be better to 'also' just data mine the changes to the system. Use http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx [microsoft.com] (Process Explorer) as it tracks all the

  • Windows Services for UNIX 3.5:

    http://technet.microsoft.com/en-us/interopmigration/bb380242.aspx [microsoft.com]

    http://technet.microsoft.com/en-us/magazine/cc160802.aspx [microsoft.com]

    Utilities
    SFU comes with more than 300 UNIX utilities as part of the Interix subsystem, with additional utilities available either from InteropSystems or by compiling from available source code. These utilities cover all the major UNIX utilities and areasâ"everything from addr to yaccâ"and behave exactly as you and your UNIX users would expect them

  • Use VMware. It has a snapshot feature that takes a snapshot of a VM, and then records the changes to the VM. I use it when I test an installer; I roll back the snapshot when I'm complete. (Disclaimer: I work for VMware)

Men love to wonder, and that is the seed of science.

Working...