Monday, March 26, 2007

Vista Complete Backups part 2

I spent a little more time with Windows backups today working on the shadow copy type of backup that's available. I started by looking at the Backup Rules registry key in HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsBackup\ScheduleParams\Rules
to decode the values in to something that actually makes sense. First a little explanation of the Key. Automatic backups can only be scheduled in Vista Ultimate and Business/Enterprise editions. So, if you're looking for this on a system that isn't one of these, good luck.
Under Rules you'll see a numerical value that corresponds to your drive letter. 1 is C, 2 is D and so on. These keys exist ONLY if you've selected them in your backup configuration. Let's look under key 1 shall we?
Here's what my system looks like. As you can see I am looking at my C drive backup configuration for automatic backups.

As I was looking at this I thought, what the heck is that hex value? It says flags, but what flags are they? Explanation forthcoming....

As you may have noticed, I like to use pictures to explain things (art is the international language right?)
Here's what I've gathered so far and I think it's fairly complete:
Each type of data in these backups is a power of 2 as shown here and please excuse my paint-fu or lack of.

As you can see I added in the numerical value of each data type that Windows Backup tries to use by default. Don't ask me why 16 is not there - if someone knows, please indulge me.

The backup flags begin counting at decimal value 1073741824 (0x40000000)
Add the data types in the image above to this number and you'll be able to decode any value you see.
Here's a quick cheat sheet:
Pictures only - 0x40000004 1073741828 - value of 4
Music - 0x40000001 1073741825 - value of 1
Videos - 0x40000002 1073741826 - value of 2
Documents - 0x40000008 1073741832 - value of 8
Email - 0x40000040 1073741888 - value of 64
TVshows - 0x40000080 1073741952 - value of 128
Compressed - 0x40000020 1073741856 - value of 32
Additional - 0x40000100 1073742080 - value of 256

All types selected - 0x400001ef 1073742319 - value of 495
It should be a matter of simple addition to decode the backup flags value now.