Skip to end of metadata
Go to start of metadata

Your Windows operating system and installed applications can create many changes 'under the hood' without you knowing about it. This can cause Incremental or Differential images to be substantially larger than expected. This article describes a feature in Macrium Reflect to log files that have been changed in each Incremental or Differential image. 

 

Note: Macrium Reflect must be at v6.3 or later. Please take the 'Other Tasks' > 'Check for updates' menu option in Reflect if you are running an earlier release.

 


What are Incremental and Differential Images?

Incremental images will only backup data blocks that have changed since the last Image or, in the case of Differential, Full image in the backup set. Images are created at File System cluster level and each block is MD5 hashed and compared. Blocks with the same hash signature aren't included in the Differential or Incremental image file. A data block is usually 16 clusters in length.


See also: How backup sets are created and maintained


How to show changed files

If the following registry entry is set, Reflect will perform a reverse 'look-up' to identify the file for each cluster that is backed up.

 

This may increase the time taken to backup and should only be used for diagnosis.
Key: HKEY_LOCAL_MACHINE\SOFTWARE\Macrium\Reflect\Settings
Name:LogIncrementalChanges
Type:DWORD
Value:1

 

Once the registry entry is set, perform another Differential or Incremental Image and, once complete, delete the registry entry created above. Then use Windows Explorer to navigate to: 'C:\ProgramData\Macrium\Reflect' in Windows Explorer and sort by Modified Date:

In addition to the normal '.html' and '.vsslog' files you will also see files with '.inc.log' at the end. There will be one for each NTFS partition in the Differential or Incremental.

The first file, {IMAGEID}-XX-YY.inc.log, is the log for the first NTFS partition, the next file is , {IMAGEID}-XX-YY1.inc.log and,

in the above example, {IMAGEID}-XX-YY3.inc.log is the last last NTFS partition in the image.

 


Example log output

 



Each log file lists the MFT record and full path name to the file(s) that have changed.

There will be many MFT metadata files (prefixed by '$') that are not visible to Windows Explorer or any other windows utilities, but these are always included (if changed) in Diff/Inc image files.
Please note that this doesn't mean that all clusters in the listed files have changed it means that the file clusters are scanned and differences have been detected.
  • No labels