Is it possible to perform a diff on 2 .vib files to determine what guest files are backed up?

[kapple]

We are evaluating the free Veeam Agent for Windows as a possible solution for backing up user workstations.
We have a small test group, including our ITS management, using the agent. They backup their workstations to a Veeam repository. These are “Entire Computer” backups.

The daily differential backup jobs report between 4-6 GB of data backed up each day. Users in this group report that there are very few changes on their workstations on a day to day basis, and feel that the changes on their file systems should be much less than 1 GB. I have been tasked with finding out what exactly is backed up on a daily basis.

That said, I would guess the easiest way to find this out would be to perform some sort of diff on two consecutive .vib files. Is this possible? If so, how would one go about performing this task?

Lastly, is there any changes that the Veeam Agent makes to the file system each day that affects the size of the backup, such as file attributes changes, or the agent databases (though from looking at my own workstation, the databases appears to be less than 2MB in total size).

Thanks,

Veeam 9.5 U4

[Egor Yakovlev]

Hi Ken!

During Workstation backup, Veeam tracks changes by addressing NTFS MFT (Master File Table) to find changed files (not only by content, but down to file's property\attribute) and address blocks on a disk where those files are kept on. We also create a digest for those chunks of disk we backup, so on next run we can compare backup with production and backup only changes in between. You can open backup(say, vib) in a File Restore Wizard to see what was actually backed up.

Since "Entire Machine" is used as backup mode, note that it backs up changes from entire machine: meaning OS as well. User might add 1 file with a size of 20MB and tell you: "that's all I did change in a day!", however there is an OS that is also running, services that are changing so on. A simple windows update that might run invisible to the user might lead to additional 3-4GB backup size spike. An antivirus scan might also add "changes" to file system - changing "last accessed" attribute for a bulk of files. A SQL server might rebuild an indexes? Windows might run scheduled defragmentation?

If you want to backup _only_ specific, user-related files, feel free to switch mode to "File Level Backup" and tell agent what to backup exactly. We will then track changes on those files, ignoring rest of the volume.

Lastly, Veeam Agent does not do anything that makes your backup grow.

Hope that helps!

P.S. Here is a good read if you want to drill into Veeam Changed Block Tracking topic.

[kapple]

Thank you for the explanation Egor, that is helpful.
I assume that performing a diff on the actual backup file will not provide this information, and that the only way to get this info is to do file level backup, and looking at the files from the previous night's backup, correct?

[Egor Yakovlev]

That's correct.

[kapple]

Thanks again Egor.