KnowledgeBase v7.2
Page tree
Skip to end of metadata
Go to start of metadata

Protected File Access

Macrium Image Guardian will protect all existing local backup files from unauthorised modification or deletion. All such activity will be blocked with error 0x80070510 - Storage policy block. 


Protected File Types

The following file extensions are protected by Macrium Image Guardian.

ExtensionBackup Type
.mrimg Macrium Reflect image files
.mrbakMacrium Reflect File and Folder backup files
.mrexMacrium Reflect Exchange backup files
.mrsql*Macrium reflect SQL backup files
*Note: SQL backup files can only be created to a protect volume by Macrium Reflect running on the local PC. Network write access will be blocked for all processes, including Macrium Reflect. This limitation will be removed in a future update.

 

Windows File operations on Macrium Backup files

Macrium Image Guardian will block opening of backup files for modification or delete, The following lists some of the operations and special considerations if you are maintaining the location and life of Macrium backup files outside of Macrium Reflect.

  1. Windows Explorer Copy. New backup files can be created on a protected volume as the result of a Windows Explorer copy operation. 

    Copying a file to the same folder as the original will be blocked on local file systems. Duplicate files in the same folder is undesirable and should be avoided. The identity of the backup file will be duplicated and this can lead to unpredictable results in Macrium Reflect.   

  2. DOS Commands. COPY, MOVE, and XCOPY.  These commands will succeed where the result of the operation is a new file. Overwriting or deleting existing backup files files will fail.

  3. RoboCopy. RoboCopy.exe can copy, move and synchronise folders.  For more information on RoboCopy parameters please see here: https://technet.microsoft.com/en-us/library/cc733145(v=ws.11).aspx

    Some RoboCopy parameters may perform delete file and overwrite operatons on your backup files and have special functionality in MIG if the 'Allow RoboCopy to sync and move backup files on protected volumes' option is enabled: 


    ParameterRule
    /MOVE
    /MOV

    		If the source folder is on a protected volume then the /MOVE /MOV parameters will only delete backup files in the source folder if the destination folder is also on a protected volume.

    This ensures that existing files cannot be moved to an unprotected volume and compromised.
    /MIR
    /PURGE

    If the target folder is on a protected volume then the the /MIR  /PURGE parameters will only delete backup files in the target folder if both of the following conditions are true:

    1. The source folder is a backup destination in any saved backup definition xml file.
    2. The target folder is not a backup destination in any saved backup defintion xml file

    This ensures that the synchronisation operation cannot inadvertently, or otherwise, delete files in a folder that is used as a backup destination in Macrium Reflect.

    All overwrite operationsIf the result of any parameter is to overwrite an existing backup file on a protected volume then this will only be allowed if the target folder is not a backup destination in any saved backup definition xml file.

    RoboCopy and Network Shares

    If the source of a /MOVE /MOV or target of a /MIR /PURGE operation is a MIG protected volume on a network share then all delete operations are blocked. This is because RoboCopy 'Rules' can only be applied if the Windows session that's opening the files is the same Windows session that's running RoboCopy. In the case of a network share, the remote computer is opening the files and will block all delete operations.





  • No labels