How does WHS determine changed clusters for backup technically? RRS feed

  • Question

  • Does any one now how the client software detects which clusters changed technically? Because the backup is quite fast if only little data changed, there must be another means of detecting changed clusters instead of rereading the whole hard disk and recomputing cluster hashes, like it is done by all other imaging backup solutions I know (e.g. TrueImage, DriveSnapshot, Ghost).

    As far as I know there is no timestamps information for clusters provided by the Windows aPI, nor is there any API for querying cluster change information from the file system. If there is a volume snapshot , the information which clusters are in the snapshot is available to windows, but I know of no API, which provides this information to an application.

    Is WHS using a special volume filter or file system filter driver which intercepts volume writes and maintains a "changed cluster bitmap"?. Or is it using an undocumented API or am I missing something?

    Saturday, March 19, 2011 11:45 AM

All replies

  • After some weeks of analysing the Backup database and backup processes I can tell you my current state of guesswork ...

    Part of the backup databse are files called <ClientName>.<Partition>.FileRecordHash.4096.dat. These files contains records with an index and a hash code. The indexes corresponds to the used records in the $MFT.

    This file is read early in the backup phase and I expect that the current hash values of the Client $MFT are calculated and compared to identify the changed files

    Best regards from Germany

    Sunday, March 20, 2011 9:12 PM