Snapshot还原当前系统分区的技术分析

bfgxp

snapshot从1.4版开始支持还原当前操作系统所在分区，但似乎只能在gui中实现
找了半天也没有发现可以用命令行实现的方法或参数
哪位大大知道方法的麻烦说下
这是官方介绍内容http://www.drivesnapshot.de/en/restboot.htm
通过分析注册表发现
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager]
"BootExecute"=hex(7):61,00,75,00,74,00,6f,00,63,00,68,00,65,00,63,00,6b,00,20,\
  00,61,00,75,00,74,00,6f,00,63,00,68,00,6b,00,20,00,2a,00,00,00,73,00,6e,00,\
  61,00,70,00,6e,00,61,00,74,00,69,00,76,00,65,00,2e,00,65,00,78,00,65,00,00,\
  00,00,00
在“bootexecute”下多了一个启动程序
snapnative.exe                        c:\windows\system32\snapnative.exe

而在这里多了以下几个值
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Snapshot]
"AutoReboot"=dword:00000000
"AutoRebootSuccess"=dword:00000000
"Destination"="\\??\\C:"
"FullImage"="\\??\\x:\\C-Drive.sna"

关于从“bootexecute”键中运行的程序的特点
经查相关技术文档说是win系统在启动到这里时，所有系统分区中的文件都没有被锁定，而snapshot则巧妙的利用了win系统的这一点特性，通过在“bootexecute”键中添加snapnative.exe来还原系统
为什么不是snapshot.exe呢，因为在bootexecute这里运行的程序是很底层的native程序，普通程序在这里还没法运行

通过以上分析，虽然目前还没有命令行参数支持这种还原，但我们却可以通过注册导入相关的键值来实现

[ 本帖最后由 bfgxp 于 2010-12-19 13:03 编辑 ]

bfgxp

官方的命令行说明文档看了几遍了
Snapshot X:\C-DRIVE.sna C:
这条不行的

bfgxp

：）怎么说呢，还是多谢你这个解释，毕竟总有比我还菜的

bfgxp

回songhangzhou
一样的是全镜像型的

bfgxp

厉害，终于找出来了。
官方说明没有更新真害人啊
这样就不必自己写gui了

bfgxp

大汗，也许确实只更新了引导模块

bfgxp

原帖由 <i>lianjiang</i> 于 2010-12-31 07:50 发表 <a href="http://bbs.wuyou.net/redirect.php?goto=findpost&pid=2126391&ptid=183485" target="_blank"><img src="http://bbs.wuyou.net/images/common/back.gif" border="0" onload="if(this.width>screen.width*0.7) {this.resized=true; this.width=screen.width*0.7; this.alt='Click here to open new window\nCTRL+Mouse wheel to zoom in/out';}" onmouseover="if(this.width>screen.width*0.7) {this.resized=true; this.width=screen.width*0.7; this.style.cursor='hand'; this.alt='Click here to open new window\nCTRL+Mouse wheel to zoom in/out';}" onclick="if(!this.resized) {return true;} else {window.open(this.src);}" onmousewheel="return imgzoom(this);" alt="" /></a><br />

<br />

<br />
也说明了这个软件的开发商，不是很正规。<br />
连帮助都不能同步更新。

<br />
但不可否认，这个软件非常优秀

bfgxp

原帖由 ban_r 于 2011-1-2 01:51 发表

SORRY 今天才有空上来，贴回得有点晚了。。。。
http://www.drivesnapshot.de/en/commandline.htm
我是从这看到的。里边还有几个有用的参数
snapshot --? 这样能得到更多...

原来还隐藏了这么多的特殊参数
special operations :
--unmount - unmount all virtual disks and terminate Snapshot started with -VQ
--unmount:Z - unmount virtual disk Z
--resize X:  - show possible resize range for drive X:
--resize X: 1000 - (try to) resize drive X: to 1000 MB
--resizepart X: 1000 - (try to) grow partition and filesystem to 1000 MB
              resizepart is unable to shrink partitions or filesystems!
--SetPartitionSize HD1 1 130000000  (use with care !!)
--exec:"NET START ORACLE"  - execute commands as soon as
                               backup really started
                               MUST be the last option on the command line!
--ClearSignature HD1
--SetSignature HD1 01234567
--Checkboot HD1 - test if HD1 seems to be bootable
--Activate X: set active flag for drive X:
--Deactivate X: clear active flag for drive X:
--RestoreMBR HD1 filename - writes the MBR from filename to HD1
--RestorePartitionStructure HD1 filename -
      writes the partition information from filename to HD1
--exclude:path excludes the path and all subdirectories from backup
--exclude:filename1,filename2,...  excludes all given filenames from backup
--exclude:@filename.txt exclude from file filename.txt
--LogFile:filename.log - append log output to file filename.log
--DontLogStdout   - don't write VSS log output to standard output
--DontLogProgress - don't write the progress report lines to stderr
--novss  - don't use the volume shadow service
--usevss  - use the volume shadow service if available
--forcevss  - use the volume shadow service. If not available exit with error.
--register:License.lic - register Snapshot
--setdefaultpwd=MyPassword - sets the default password to MyPassword and exits
--SearchFull:path1,path2,path3 while working with differential images
              search the full image in the given pathes.
--LimitIORate:10  - limits the IO rate to 10MB/s (accepted range 1-100)
--show HD1   - show size and partitions on HD1
--show       - show size and partitions of all connected hard disks
--addDriver  - adds a new Hard Disk Diver to a restored Windows system drive.
                You need the driver.sys and the driver.inf file.
--mergeide   - corrects IDE driver setup for a restored system disk.
                Use this option if you have IDE disks and your system doesn't
                boot after a restore to different hardware.
--QuickCheck:test.sna - performs a quick check of the image with the name
                         test.sna.
BrokenImage.sna --repair:NewImage.sna  - this command can be used to repair
                a broken image
-----------------------------------------------------------------------------
scheduling the restore of x:\image-C.sna to C: during the next reboot:
snapshot --schedule C: x:\image-C.sna
--autoreboot:off       don't boot after the restore has finished
--autoreboot:success   reboot after the image was successfully restored
--autoreboot:any       reboot after the image was restored
--listschedule         list the scheduled restore
--removeschedule       removes the scheduled restore

bfgxp

原帖由 <i>23070205</i> 于 2011-5-29 16:57 发表 <a href="http://bbs.wuyou.net/redirect.php?goto=findpost&pid=2243185&ptid=183485" target="_blank"><img src="http://bbs.wuyou.net/images/common/back.gif" border="0" onload="if(this.width>screen.width*0.7) {this.resized=true; this.width=screen.width*0.7; this.alt='Click here to open new window\nCTRL+Mouse wheel to zoom in/out';}" onmouseover="if(this.width>screen.width*0.7) {this.resized=true; this.width=screen.width*0.7; this.style.cursor='hand'; this.alt='Click here to open new window\nCTRL+Mouse wheel to zoom in/out';}" onclick="if(!this.resized) {return true;} else {window.open(this.src);}" onmousewheel="return imgzoom(this);" alt="" /></a><br />
xp下实验，重装系统的那个功能，很强大。确实很快就能装好系统。不知金山是从网络给提供的，还是从本机提取的系统文件。个人觉得好像是网络提供的。在第一次重启进入的，不是系统。第二次，重启，进入是部署。第 ...

<br />
测试了金山的“重装系统”功能，确实是通过native程序实现的，还原也是通过native程序实现的，只是金山似乎没有备份完整的镜像。这一关键技术可能就是金山的秘密了。