Restore a guest file from a Reversed Incremental

[matt1234]

Hi. I am having trouble understanding how we can restore guest files from a reverse incremental backup job (that has 14 restore points). As an example:

- Lets say on that there are two files on the targert VM, file1 and file2
- if file2 is amended and file1 was unchanged - I assume that the VRB file would contain file2 and The VBK would contain file1 and file2
- if file1 is deleted, presumably, file1 would be removed from the VBK file and would not be included in that days VRB file?

If I now need to restore file1, how would i do it. If I understand correctly it would not be in any of the chained VRB files as it was never changed, and it would not be in the VBK file. How would I go about restoring files1, or am I misunderstanding this?

Thanks

[tsightler]

I would have to say you are misunderstanding. The important thing to remember is that Veeam is not a file level backup product. Veeam backs up block devices, specifically virtual disks. A restore point is simply a compressed, block level image of exactly how that disk appeared when the snapshot was taken. Because of this, it's not really practical to attempt to correlate modifying and deleting files to which VBK/VBR they reside on. Unless you're using a tool like sdelete, blocks are not actually deleted from disk when a file is deleted. The blocks would only be moved to the VBR file as they were overwritten by new data from new files.

So, for your example, the blocks which represent file1 would be in the VBK during the initial full backup. When file1 was deleted, most of those blocks would still be in the VBK file, since those blocks were not overwritten, although the file would be unlinked from the directory, thus the block that contains the directory would have been modified and thus the original block representing the directory prior to the change would be in the VBR file. As the blocks of that file are overwritten with new data, the old blocks that represent the file are moved to the VBR files, thus the data that represents the file itself may actually be spread across multiple VBR files.

To restore the file, you simply select a restore point when the file still existed. Veeam automatically combines the current VBK and the required VBR's to reconstruct a virtual image of that disk exactly as it appeared at that point in time.

[matt1234]

Thanks guys for the quick response and explanations. I understood that the backups were working at block level but I had made an incorrect connection (in my thought process) between blocks and files. I think that my problem came from trying to think about it using traditional backup methodologies.

Thanks again.