If you can't find what you need using the site search on the toolbar above, or if you need more detailed help or just need to be pointed in the right direction, post your question to the newly opened kadaitcha.cx forums. Membership is free.

Backup and Data Recovery

This article is designed to help you learn about how to prevent the loss of data due to corruption, hardware failure or inadvertent file deletion. If you are currently experiencing such a problem, you need to read the Data Corruption and Hard Disk Troubleshooting article rather than this one.

This resource looks at different approaches to backup and suggests how you might go about creating a backup plan. If you need to know how to use ntbackup, simply type the word ntbackup into the Windows XP Help and Support Centre.

The Automated System Recovery (ASR) component of NTBACKUP allows you to save and restore system files and configuration settings needed to recover from a system failure. ASR is not a data backup or data recovery tool. kadaitcha.cx does not hold ASR in any kind of regard; at best ASR is a kludge, at worst it's terrible to use.

Backup Software

NTBACKUP

NTBACKUP is provided with all Microsoft-supplied XP CD-ROMs. The software allows you to archive selected files and folders from your hard disk and to restore them back to your hard disk or to another disk. An archive from NTBACKUP can contain multiple backup sets, which means you can have a single file that contains every backup you have made. Multiple backups within an archive are usually identified by date and title.

If you are using a computer that an Original Equipment Manufacturer (OEM) provided with a pre-installed copy of Windows XP, the Valueadd and Support folders may not exist on your hard disk or on the recovery CD-ROM that was included with your computer. That means NTBACKUP is not an option for you. See: .

If you do not have NTBACKUP, you can either take the risk of trying to source a copy from the Internet, or you can try to source a copy from a friend or colleague.

NTBACKUP backs up files. If your disk system suffers irrecoverable damage and you don't mind reinstalling the operating system and all your applications then NTBACKUP is a sufficient tool to safeguard your data. Of course, that assumes you put copies of the backup archives in safe places, such as on CDs, DVDs or other hard disks.

Windows XP Professional automatically installs ntbackup.exe. Retail XP Home Edition (both full retail and upgrade versions) include ntbackup.exe on CD but it is not installed by default. If you have a retail XP HE, read here for instructions on .

Original Equipment Manufacturer (OEM) versions are often modified and/or "cut down" by vendors and distributors, so OEM installations vary considerably from one vendor to the next. Your particular OEM version might not include ntbackup.exe at all, or any of the "value add" items included in the retail package, for that matter. The problem with OEM versions is that they often come pre-installed and you are either given a recovery CD or your HDD has a hidden partition on it with the recovery files stored there. Other OEM systems include a ValueAdd directory below the Windows directory. If you are unsure about what recovery mechanisms you have available to you in the case of emergency, ask the people who sold you the system to tell you just exactly how you are supposed to go about recovering your important data from a system failure.


If you are considering buying a new machine with an OEM Windows XP, read this discussion at annoyances.org for other people's experiences.

If you are already stuck with an OEM installation and only have a recovery disk, your best course of action is to install from scratch, configure the system into a state where you are happy with it then image the hard disk.


This article describes how to use the Backup utility that is included with Windows XP to back up files and folders on your computer.


This article describes how to use the Backup utility that is included with Microsoft Windows XP to back up files and folders on your computer.

Note You must have permissions as an administrator or as a backup operator on your computer to back up files and folders. Backup operators and administrators can back up and restore encrypted files and folders without decrypting the files or folders.

This article is intended for a beginning to intermediate computer user.

You may find it easier to follow the steps if you print this article first.


This step-by-step article describes how to use the Backup program in Microsoft Windows XP to restore files and folders on your computer. The Backup utility in Windows XP helps you protect your data if your hard disk stops working or your files are accidentally erased. With Backup, you can create a copy of all the data on your hard disk, and then archive it on another storage device, such as a hard disk or a tape.

Imaging Software

Unlike NTBACKUP, which copies whole files that you select, imaging software takes a byte for byte image of your entire hard disk, including the structure and layout of your partitions. Some disk imaging packages allow you to selectively restore files from the image, and others require that you restore the whole image.

Backup and Imaging Software (Open Source and Free)

PC INSPECTOR™ clone maxx "PC INSPECTOR™ clone maxx is the new professional hard drive copying program from CONVAR. Using the new direct DMA support, data can be copied from hard drives in high speed mode with speeds up to 3.3 GB per minute. The full version of PC INSPECTOR™ clone maxx can be obtained at no cost from the sponsor "CONVAR – Die Datenretter™"

DriveImage XML "DriveImage XML is an easy to use and reliable program for imaging and backing up partitions and logical drives. The program allows you to: Backup logical drives and partitions to image files; Browse these images, view and extract files; Restore these images to the same or a different drive; Copy directly from drive to drive; Schedule automatic backups with your Task Scheduler..."

HDClone "Free Edition copies drives for migrating or backing up complete installations as well as for data rescuing. The download package contains a program to easily create a bootable floppy disk or CD/DVD under Windows with only few clicks. A floppy image, ISO image, and manual as PDF are also enclosed."

NasBackup "NasBackup is an open source backup solution.  It is a high-performance, enterprise-grade system for backing up MS Windows desktop PCs, laptops and servers to network disks. NasBackup is a highly configurable solution and easy to install and maintain."

Backup and Imaging Software (Commercial)

PowerQuest Drive Image (PQDI): Sadly, PowerQuest was bought by Symantec. PQDI has since been replaced by Norton's Ghost product. Drive Image 2002 may still be available and kadaitcha.cx recommends a search of eBay to see if you can pick up a used/cheap copy of PQDI 2002. There are at least two versions of PQDI 2002 and the earlier version is the better one if you run a Windows server operating system because  the later version checks the disk signature and will not backup a server OS.

Acronis TrueImage
kadaitcha.cx uses Acronis TrueImage Home for workstations. Reports from several sources are been glowing. If you are going to spend money, this product is worth primary consideration.

Image for Windows
From the website: "Image for Windows is an affordable and reliable drive image backup and restore utility. Drive imaging from Windows is an easy and convenient way to backup all your hard drive's data and operating system partitions. Your backups can be saved to a set of files on local or network drives, or directly to most CD or DVD drives. Backups saved directly to CD/DVD are bootable by default, making a convenient recovery disc. Simply restore the the partition(s) you need to recover, and they will be completely restored back to the way they were when the backup was created."

At under $US30, this software is a bargain, especially if it's as good as BootIt NG, another valuable product from Terabyte Unlimited.

Norton Ghost
Norton Ghost is reasonably popular but kadaitcha.cx can't work out why.

Types of Backup

There are a number of ways to backup data. The one you choose will depend on the importance of the data, its rate of change, and your budget.

Disk Image

A Disk image is a complete snapshot of an entire disk or partition, including the structure and content of the disk or partition. A disk image can be restored to any hard disk that has sufficient capacity.

Disk drive imaging has several major advantages over other backup methods. Because a disk image is a byte for byte copy of your disk, the physical locations of position dependent information is preserved, such as partition data. Any optimisations you may have performed on the hard disk are also preserved. This means that when you restore from an image, the hard disk is in the exact same state it was when you took the image, byte for byte.

With most modern imaging software you can copy the contents of one disk to another disk or move your entire operating system, applications, and data to a brand new disk in one easy operation. You can also restore the operating system, applications, and data from an image on disk, CD or DVD in no more time than it takes to make a cup of coffee starting out with cold water; all your menu, screen and personalisation settings are all restored as well. Compare that to the 45+ minutes just to install the OS, then add any number of hours or days to get all your applications back to the state you want them in.

The only real disadvantage to some imaging software packages is that the commercial ones cost money, however the disk imaging solutions listed above should be suitable for most uses.

Full Backup

When a file is backed up, its archive attribute is cleared by the backup software. If the file is subsequently modified, the archive attribute is set by the operating system, which indicates the file needs to be backed up. This way, backup software can filter out the files that don't need to be backed up. In a full backup, all selected files are backed up, irrespective of the archive attribute.

Disk imaging does not set the archive attribute of any files.

A full backup is also called a normal backup.

Copy Backup

A copy backup backs up all selected files but does not modify the archive attribute, unlike a full backup.
Incremental Backup

Backs up all files that have changed on a file system since the last full backup or the last incremental backup.

The nuance between an incremental backup and a full backup is all files on a file system as opposed to selected files.

As a general rule, everyday users need not consider the incremental backup. The process has its place in large offices and corporate environments where the time allowed to complete a backup is limited.

For large storage media, the incremental backup is the fastest backup method but restoring individual files or directories requires a lot of effort. Deciding to restore from an incremental backup usually means you must restore the entire archive. If files are backed up every night of the work week and the file was changed several times during the work week then there will be multiple backups of the file in the archive. Without spending a lot of time looking for the last backup of the files in question, to ensure that the latest version is restored, you restore the backups in the archive from every day of the week. Some backup software allows you to browse the archive so you can look through each and every backup set within the archive for the files you want to restore. Restoring from an incremental backup is either very time consuming or it is complicated.

Differential Backup

A differential backup backs up all files that have changed on a file system since the last full backup.

For speed, complexity and storage requirements, the differential backup sits between the full backup and the incremental backup.

The nuance between a differential backup and an incremental backup is that an incremental backup backs up changes since the last incremental backup, whereas a differential backup backs up the files that have changed since the last full backup. The difference is subtle; unlike restoring every backup in the archive for an incremental backup, if you performed a full backup on Monday and a differential backup on every other working day in the week, and the disk dies the following Sunday, to restore the data to where it was on the last working day, you restore the full backup then restore the last differential.

As with the incremental backup, everyday users need not consider the differential backup.

Choosing a Backup Method

From the previous section, after discarding incremental backups and differential backups as genuinely serious alternatives for most users, only full backup, copy backup and disk imaging are left as serious contenders.

Full Backup or Copy Backup?

Recall that when a file is backed up during a full backup, its archive attribute is cleared by the backup software. If the file is subsequently modified, the archive attribute is set by the operating system, which indicates that the file needs to be backed up again. The archive bit is used only by the incremental and differential backup methods. Performing a full backup lays the foundation for subsequent incremental and differential backups by resetting the archive attribute of the backed up files. It follows then that the difference is moot if you are not going to employ either incremental or differential backup methods.

You can choose either the full backup or the copy method. From this point on, this document uses the term full backup.

Isn't a differential backup easier on disk space?

When compared to multiple full backups, yes, but the cost of a writeable CD or a DVD is low, as is the cost of a hard disk dedicated to backup storage.

A full backup has the advantage that all your documents are backed up into one backup set; if you use the differential backup method then you need to deal with more than one backup set.

In productivity terms, a full backup is the most efficient.

Do I need to employ disk imaging?

The answer to that question depends on the scope of what it is you are trying to protect.

If you only want to protect your data then you do not need disk imaging.

If you want to protect an investment of time in installing the operating system, your favourite programs and supporting device drivers for your equipment then you need disk imaging.

If you want to protect both your data and your OS installation then you should use both methods.

Why do I need both methods?

You don't "need" both methods, but you should use both file and image backups. File backups can be performed regularly but a disk image only needs be taken when your OS is new or prior to making extensive changes. Backing up a few hundred important files will always be quicker than taking a disk image.

Develop a Backup & Recovery Plan

How important is your data?

If you rely on the data on your computer to earn your living then you ought to consider a robust backup regimen.

If you use the computer for 'surfing the web' and sending short emails to relatives then a single disk image and ad hoc backups every few weeks might be sufficient.

How often is the data updated?

The more important the data and the more often it changes, the more robust your backup plan should be.

Do you have the necessary hardware?

Depending on the type of backup you want, you will need one or both of:

  • A second hard disk
  • A DVD or CD writer

Do you have the necessary software?

Check that you have NTBACKUP. It's named Backup and you'll find it in the System Tools menu:

If Backup isn't listed on your System Tools menu then you must have XP Home Edition. You can install NTBACKUP from the ValueAdd folder on your XP CD. See NTBACKUP, above, for instructions on how to install it.

If you intend to make disk images then you can try any of the free and Open Source programs above. Alternatively you can spend money on a commercial product.

Taking a disk image is not necessarily something that should be done just once and forgotten about until it's needed in an emergency.

Over time, your personal preferences are likely to change and your installed base of software is likely to grow. If you are constantly fiddling and making changes to your system then you should weigh up the risk of not taking another disk image before you fiddle. Fiddling with your system includes installing unproven beta software and hacking around in the registry when you don't really know what you're doing, and installing multiple Windows operating systems in the wrong order.

It is wise to take a new image periodically, especially just before you install new software that is more than just a small tool or utility. "Small tool or utility" does not include office applications, new drivers and the supporting software for new hardware, programming languages and third-party browsers.

Whenever kadaitcha.cx strikes crashes and corruption, it's almost invariable that the issue is caused by either major hardware fault or very badly written drivers for things like printers, sound cards and video cards. So if you plan on making major hardware changes, take another disk image first.

Backup Plans

Scenario 1

In this scenario, it is assumed that you prefer not to reinstall the operating system and that your data is reasonably important, consequently you decide to take an image and do a full backup once a week.

  • Install the operating system and your favourite applications
  • Take a disk image and burn it to CD, DVD or store it on a second hard disk
  • Every Friday, run NTBACKUP and perform a full backup of selected files, saving the backup file (.bkf) to a second disk
  • Every second Friday, burn the backup file (.bkf) to CD or DVD

Scenario 2

In this scenario, it is assumed that you don't mind reinstalling the operating system and that your data is reasonably important, consequently you decide to do a full backup once a week.

  • Every Friday, run NTBACKUP and perform a full backup of selected files, saving the backup file (.bkf) to a second disk
  • Every second Friday, burn the backup file (.bkf) to CD or DVD