GB difference Live vs Recovery = Why?

[bjm_]

After 5.2 install. Boot Menu & Emergency Disk re-create...then tested Boot Menu & Emergency Disk...then ran Full System Backup.
Does GB difference make sense?
Full from recovery enviornment - 68 GB - 07:22 minutes - Low compression
Full from live machine - 35 GB - 02:45 minutes - Med compression.


re-test:
Test 1 = Med comp - Full from live = 35 GB

Test 2 = Med comp - Full from recovery = 69 GB

Note: Test 2 does not appear with Logs?

[admin]

After 5.2 install. Boot Menu & Emergency Disk re-create...then tested Boot Menu & Emergency Disk...then ran Full System Backup.
Does GB difference make sense?
Full from recovery enviornment - 68 GB - 07:22 minutes - Low compression
Full from live machine - 35 GB - 02:45 minutes - Med compression.


re-test:
Test 1 = Med comp - Full from live = 35 GB

Test 2 = Med comp - Full from recovery = 69 GB

Note: Test 2 does not appear with Logs?

If the Windows partition (C: drive) is BitLocker encrypted, the image file generated in WinPE will be larger because BitLocker may not be unlocked in WinPE, in which case the program performs a "Sector by sector backup", which means that all sectors will be backed up.

[bjm_]

After 5.2 install. Boot Menu & Emergency Disk re-create...then tested Boot Menu & Emergency Disk...then ran Full System Backup.
Does GB difference make sense?
Full from recovery enviornment - 68 GB - 07:22 minutes - Low compression
Full from live machine - 35 GB - 02:45 minutes - Med compression.


re-test:
Test 1 = Med comp - Full from live = 35 GB

Test 2 = Med comp - Full from recovery = 69 GB

Note: Test 2 does not appear with Logs?

If the Windows partition (C: drive) is BitLocker encrypted, the image file generated in WinPE will be larger because BitLocker may not be unlocked in WinPE, in which case the program performs a "Sector by sector backup", which means that all sectors will be backed up.

Ahh...When image file is generated in WinPE and BitLocker is not unlocked in WinPE.  Haselo performs a "Sector by sector backup"...all sectors will be backed up...creating the 34 GB larger image.   

Does WinPE image have any compression?   
Does WinPE image size essentially equal the size of the disk being imaged? 

I'm just now grasping what a "Sector by Sector" image is/does.  
I imagine if my disk is healthy.  I don't need to regualry create "Sector by Sector" images.  
I'm now wondering whether I should incorporate  "Sector by Sector" images in my backup routine.  

I've only restored from Live machine images.  
Will/May my restore experience feel different = WinPE vs Live image...Restore?

May I restore a "Sector by Sector" image generated in WinPE from Live machine?

Thanks
Regards w Respect

[n8chavez]

If the Windows partition (C: drive) is BitLocker encrypted, the image file generated in WinPE will be larger because BitLocker may not be unlocked in WinPE, in which case the program performs a "Sector by sector backup", which means that all sectors will be backed up.

Does WinPE image have any compression?   
Does WinPE image size essentially equal the size of the disk being imaged? 

I'm just now grasping what a "Sector by Sector" image is/does.  
I imagine if my disk is healthy.  I don't need to regualry create "Sector by Sector" images.  
I'm now wondering whether I should incorporate  "Sector by Sector" images in my backup routine.  

Sector by sector imaging means there is some sort of encryption on the disk that the imaging program cannot read and distinguish from any other data.  In that case, the image of the entire disk is made without compression or exclusion.  It is an exact 1:1 forensic copy.  Without encryption this is not needed, but if the disk in encrypted this is required.

[Froggie]

I believe sector-by-sector imaging can easily include compression... and probably does.  Since the compression is lossless, there should be no need to NOT COMPRESS the data, even if it's a full forensic copy.

And in fact, with OSes using active TRIM on SSDs, and SSDs returning either all ZEROs or all same DATA (most of them on the market) for "unused sectors," those sectors are very compressible. It's the used encrypted sectors that are not very compressible.

[admin]

I believe sector-by-sector imaging can easily include compression... and probably does.  Since the compression is lossless, there should be no need to NOT COMPRESS the data, even if it's a full forensic copy.

And in fact, with OSes using active TRIM on SSDs, and SSDs returning either all ZEROs or all same DATA (most of them on the market) for "unused sectors," those sectors are very compressible.  It's the used encrypted sectors that are not very compressible.

You're right, sector-by-sector imaging does support compression as well, and the compression rate for unused sectors is theoretically very high. However, when imaging an encrypted partition sector by sector, the program can't exclude page, hibernation, swap, etc., so the resulting image file will be larger.

[bjm_]

I imagine if my disk is healthy.  I don't need to regualry create "Sector by Sector" images.  Correct me?
I'm now wondering (regardless of disk health) whether I should incorporate  "Sector by Sector" images in my backup routine. 

I've only restored from Live machine images. 
Will/May my restore experience feel different = WinPE vs Live image...Restore?

May I restore a "Sector by Sector" image generated in WinPE from Live machine?

[Froggie]

There's really no need for sector-by-sector images at all... unless you're trying to do some sort of forensic analysis of your disk.  The standard images include everything you need for a successful restoration, whether LIVE or otherwise.


...and, there's no such thing as a LIVE restoration of your OS partition (it is always LOCKED).  When you restore the OS partition during a LIVE System session, it needs to BOOT into a non-LIVE System session (WinPE Recovery Media) to do the restore as well.

LIVE System images are pretty safe, although not as perfect as non-LIVE images taken from an Emergency Disk.  The latter are always taken of a System partition that is not active, and as such, is as safe as it can be as far as activity is concerned.

[bjm_]

1) There's really no need for sector-by-sector images at all... unless you're trying to do some sort of forensic analysis of your disk.  The standard images include everything you need for a successful restoration, whether LIVE or otherwise.

2) ...and, there's no such thing as a LIVE restoration of your OS partition (it is always LOCKED).  When you restore the OS partition during a LIVE System session, it needs to BOOT into a non-LIVE System session (WinPE Recovery Media) to do the restore as well.

3) LIVE System images are pretty safe, although not as perfect as non-LIVE images taken from an Emergency Disk.  The latter are always taken of a System partition that is not active, and as such, is as safe as it can be as far as activity is concerned.

1) Okay, understood
2) Yes, understood
3) Ahh...LIVE image not as perfect as non-LIVE image...

Good to know...there's really no need for sector-by-sector images...[...]
   
   
   
Regards w Respect