This article answers following questions related to Windows Server Backup in Windows Server 2008 and Windows Server 2008 R2:

Q1. How does Windows Server Backup store backups and maintain backup versions?
Q2. How do I query backup stored versions on a backup storage location?
Q3. How do I delete non system state backups created using Windows Server Backup?
Q4. How do I delete system state backups created using Windows Server Backup?

Overview

·Windows Server Backup is the built-in backup solution in Windows Server 2008 and Windows Server 2008 R2. Using Windows Server Backup, an administrator can schedule periodic backups of a server and also create backups on demand. For details on using Windows Server Backup, please see the Installed Help for Windows Server 2008 (http://technet.microsoft.com/en-us/library/cc770757(WS.10).aspx) and for Windows Server 2008 R2 (http://technet.microsoft.com/en-us/library/cc770757.aspx).

·Windows Server Backup in Windows Server 2008 allows administrators to back up entire volumes. More flexibility is available in Windows Server 2008 R2 where administrators can pick and choose individual files and folders to be included in a backup. The technology used by Windows Server Backup to perform a backup differs based on the nature of the backup:

oIf you back up an entire volume, Windows Server Backup creates a block-level backup that reads directly from the volume by passing the file system.

oIf you back up just specific files and folders, Windows Server Backup reads individual files going through the file system.

·Windows Server Backup stores backups at the following path: <BackupStorageLocation>\WindowsImageBackup\<ComputerName>\. A back up operation performs following steps:

1.Windows Server Backup reads data from source volumes and then creates a .vhd file per source volume on the backup storage location and writes the backup metadata.

2.Windows Server Backup stores backup versions in volume shadow copies. After the data write is complete, Windows Server Backup creates a shadow copy of the volume where the backup is stored using Volume Shadow Copy Service (VSS). This shadow copy retains the state of the storage volume as a “backup version” or “point-in-time” of the backup and must restore using this backup version. VSS is the underlying Microsoft technology required for maintaining backup versions. (For more information about VSS, see http://technet.microsoft.com/en-us/library/cc785914.aspx.)

3.After creating the shadow copy, Windows Server Backup updates the backup catalog which is stored on both the system volume of the server that is being backed up and the backup storage folder with the following information:

§The backup time The local system time of the server when the backup operation started.

§The shadow copy identifier (Shadow Copy ID) Used by Windows Server Backup to associate the backup version to the correct shadow copy.

§Version identifier Used by Windows Server Backup to uniquely identify a backup version. Users using command line tools (Wbadmin and the Windows PowerShell cmdlets for Windows Server Backup) will specify the version identifier as a parameter to the command to work with a backup version.

·If the backup storage location is full, Windows Server Backup automatically deletes the oldest backup version to make space for the current backup. Since each backup is stored inside a shadow copy, deleting a backup version is accomplished by simply deleting the corresponding shadow copy. However, space for a system state backup in Windows Server 2008 is not automatically managed by Windows Server Backup. See the section “How to Delete System State Backups” below for managing system state backups in Windows Server 2008.

·Windows Server Backup can store only one backup version on a network share (remote shared folder). You can store backups from multiple computers to a network share. A backup from a computer to a network share will be saved at: \\<RemoteServer>\<SharedFolderPath>\WindowsImageBackup\<ComputerBackedUp>. To delete the backup on network share, you need to delete the <ComputerBackedUp> directory from network share.

·Windows Server Backup uses the .vhd format for writing backups. The current virtual hard disk specification limits the size of a virtual hard disk to be 2040 GB, which can fit a volume of size 2040 GB – 2 MB, (i.e., 2088958 MB). Windows Server Backup in Windows Server 2008 also limits the maximum source volume size to be 2088958 MB. In Windows Server 2008 R2, if you are not backing up a full volume and, instead, creating a backup of selected files/folders, your source volume size can be more than 2088958 MB, provided your actual data size is less than equal to 2088958 MB. If you are creating a full volume backup, the maximum source volume size limit continues to be 2088958 MB.

How to Query Backup Versions

To see the backup versions present in a particular computer, use the Wbadmin get versions command. Note that, to use the Wbadmin command, you must be a member of the Administrators group or Backup Operators group and must open an elevated instance Cmd.exe (click Start, right-click Command Prompt, and then clickRun as administrator). For detailed Wbadmin command documentation, see:http://technet.microsoft.com/en-us/library/cc754015.aspx.

Sample output of Wbadmin get versions command:

wbadmin 1.0 - Backup command-line tool

(C) Copyright 2004 Microsoft Corp.

 

Backup time: 3/12/2009 10:55 AM

Backup target: Fixed Disk labeled New Volume(I:)

Version identifier: 03/12/2009-05:25

Can recover: Volume(s), File(s)

Snapshot ID: {f5e946da-5cc7-44c3-a747-9f1079e639b0}

 

Snapshot ID in the above output is new in Windows Server 2008 R2. Snapshot ID is same as Shadow Copy ID. It corresponds to a specific backup version and can be used to delete that backup version.

 

To view all backup versions on a particular backup storage location, type:

Wbadmin get versions -backupTarget:<BackupStorageLocation:>

For example, if you want to view all the backup versions on the backup storage location K:, type:

Wbadmin get versions –backupTarget:K:

In the output of Wbadmin get versions command, Backup time is the local system time and Version Identifier is the GMT time at the time the backup was created. If you change your system time zone, the value for Backup time will also change. Note that Version Identifier is a unique identifier for a given backup version and remains constant for a backup.

How to Delete Non-System State Backups

Windows Server Backup deletes a backup by just deleting the corresponding shadow copy and updating the backup catalog. You can perform the same steps manually to delete backups on demand. However, the backup catalog update cannot be done manually and it will happen instead during the next backup. In short, to delete a backup version manually, you need to delete the corresponding shadow copy from the backup storage location.

To delete a shadow copy, follow these general steps:

1.Identify the backup version you want to delete by querying the backup versions on your backup storage location.

2.Determine the shadow copy ID of the version you want to delete.

3.Delete the shadow copy.

Identify the backup version:

To list all the shadow copies on a volume, use the Vssadmin command. (For the complete syntax forVssadmin, see: http://technet.microsoft.com/en-us/library/cc754968(WS.10).aspx.) The following command line lists all shadow copies on a specified backup storage location:

Vssadmin list shadows /for=<BackupTarget>

For example, to list the shadow copies on the location Y, type:

Vssadmin list shadows /for=Y:

Determine the shadow copy ID:

On Windows Server 2008 R2, the shadow copy ID is same as Snapshot ID given in the output of querying backups. On Windows Server 2008, you can find your backup’s shadow copy ID by looking at output ofVssadmin list shadows /for=<Backup Target>. Match the shadow copy creation time with your backup’sBackup time value.

Delete the Shadow Copy for the specific Shadow Copy ID:

1.To open a command prompt with elevated privileges, click Start, right-click Command Prompt, and then click Run as administrator. Then type:

DiskShadow.exe

2.Type:

Delete shadows ID <Shadow Copy ID>

3.To exit DiskShadow type:

Exit

To delete the oldest shadow copy on backup storage location, type the following command in step 2 above:

Delete shadows OLDEST <BackupStorageLocation>

For example, if your storage location is volume G:, type:

Delete shadows OLDEST G:

If you have scheduled backups to dedicated disks, Windows Server Backup doesn’t assign a drive letter to the backup storage location to avoid any accidental data write or loss of backups. In that case, you can use the GUID of the backup storage volume to delete the oldest shadow copy. You can get volume GUIDs for all volumes on your system by using the Mountvol command. If your scheduled backup storage location is a dedicated disk, it will be reported with No Mount Points in the output of Mountvol. The volume GUID is in {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX} format.

Then, to delete the oldest shadow copy on that volume, type:

Delete shadows OLDEST \\?\Volume{GUID}

For example, for a volume GUID of 7fc1871b-2e1f-11dd-a339-001e4fb7af35, type:

Delete shadows OLDEST \\?\Volume{7fc1871b-2e1f-11dd-a339-001e4fb7af35}

How to Delete System State Backups

In Windows Server 2008, each system state backup  is a full backup and is stored in a separate directory, consuming the space needed for a full backup every time. New in Windows Server 2008 R2 system state backups are incremental and use VSS shadow copies for creating different versions of the backup.

There are three ways to delete system state backups:

oDelete a specified version of system state backup

oExample: Delete the version that was taken on Tuesday evening with a version identifier of06/02/2009-18:25.

§In an elevated command prompt, query backup versions and identify the backup created on Tuesday with the version identifier of 06/02/2009-18:25.

§Then, type: Wbadmin delete systemstatebackup –version: 06/02/2009-18:25

oDelete the oldest version on a backup storage location

oExample: Delete the oldest version on backup target G:\

§In an elevated command prompt type: Wbadmin delete systemstatebackup –backupTarget:G: –deleteOldest

oDelete all backups except the latest N versions on a backup storage location.

oIn an elevated command prompt type: Wbadmin delete systemstatebackup -keepversions:N

Applies To: Windows Server 2008, Windows Server 2008 R2, Windows Vista

We sometimes get people asking about the difference between VSS Full Backup and VSS Copy Backup in Windows Server 2008.

 

Basically, for certain applications (such as Exchange), VSS Copy Backup preserves logs and VSS Full Backup truncate logs. Yes, we know, this explanation is not very enlightening per se…

 

The point is that some applications create log files. For example, Exchange server creates a transaction log file. If you are using only Windows Server Backup to protect the applications, you can use any option to backup the data. However, if you are using a third party backup application, you should not use VSS Full Backup because it will delete the logs at the end of the backup. If the third party backup application relies on those logs to take incremental backups, it would take full backups all the time – a less than optimal situation…

 

So, when you do a VSS full backup, you create backup of all the files – but after that, the backup application may truncate logs on the file system.

 

On the other hand, when you do a VSS copy backup, all files are backed up and you preserve the all the applications files including log files on the live system. That means, you do preserve information on which files where changed, deleted, etc, and this will not affect the sequence of incremental and differential that might happen independent of the copy backup. Therefore, a copy backup cannot be used as a starting point for incremental/differential backups/restores.

 

Just a final technical note: The backup type (full, copy, incremental) can be specified by a VSS-based backup application at the beginning of the backup session, using the IVssBackupComponents::SetBackupState. In response to that, any application that implements a VSS writer can choose to truncate the logs in the OnBackupComplete VSS event. This is one of the last events that a VSS-based backup application (such as DPM) sends to all affected writer at the end of the backup session.