Windows Image-level Backups Overview
Windows image-level protection employs block acceleration to deliver lightning-fast backup performance for Windows servers, particularly those with millions of files. Because Windows assets are backed up at the disk and volume level, image-level protection yields faster backup performance than file-level protection. With this increased backup speed, you can snapshot more frequently to reduce data loss in the event of an outage.
NOTE Image-level backups are not supported for virtual machines in these environments: Azure and Amazon Web Services (AWS). Instead, use agent-based file-level and application backups.
See these topics to get started with image-level protection:

Features of image-level and file-level protection are given here:
Feature |
Image-level backup |
File-level backup |
---|---|---|
Data protected |
The following apply to image-level protection: ● Assets are protected and the disk and volume level. ● Backups include the 'in use' regions of the Windows disk or volume only. Deleted regions are not included. ● Provide application consistent backup and recovery for NTFS and ReFS filesystems. ● Provide crash consistent backup and recovery for FAT, FAT32, and exFAT filesystems. |
The following apply to file-level protection: ● Assets are protected at the file system and operating system level. (Backups must include system state to protect the OS and for disaster recovery of the entire asset.) ● Provide application and operating system consistent backup and recovery. ● Protect configurations that cannot be protected by image-level backups, such as cluster shared volumes (CSVs) and VHDS clusters. ● Protect Azure and AWS virtual machines. (Image-level backups are not supported for these VMs.) |
Backup options |
Image-level backups support these options: ● Opt to include or exclude volumes from backup. ● Opt to run commands on the asset before or after the backup job. ● Opt to index the backup so you can search an asset's backups by filename to recover individual files. This feature is available in release 10.4.8 and higher. This option is set by asset (see To edit an agent-based asset for details). |
File-level backups support these options: ● Opt to include or exclude files, folders, or volumes from backup. ● Opt to exclude system state. ● Opt to run commands on the asset before or after the backup job. ● Recommended where more granular exclusion of data is required. |
Backup and recovery job performance |
Image-level jobs yield faster backup and recovery: ● Backup and recovery jobs use multiple parallel streams for fast performance. (Resource availability on the Windows asset impacts the number of streams used.) ● Backup performance is not impacted by the size or number of individual protected files. |
File-level jobs yield slower backup and recovery: ● Backup and recovery jobs use a single stream. ● Backup performance is impacted by the size or number of individual protected files. ● Switch to image-level backups to avoid creating aliases for large assets or assets with many small files. |
Backup size |
Image-level full backups may be larger than file-level fulls of the same asset. Smaller deduplication ratio than with file-level backups. (Fewer duplicate blocks found, more unique blocks stored.) This may result in decreased on-appliance retention. |
File-level full backups may be smaller than image-level fulls of the same asset. Greater deduplication ratio than with image-level backups. (More duplicate blocks found, fewer unique blocks stored.) This may result in greater on-appliance retention. |
Recovery |
These recovery procedures are supported for image-level backups: ● Recover individual files by browsing the contents of a backup. ● Opt to enable Index Image-Level Backups on the Edit Asset page so you can search the asset's backups by filename to recover individual files. This feature is available in release 10.4.8 and higher. For details, see To edit an agent-based asset. NOTES ● The index feature is not supported for recovery of ReFS filesystems. Recover by browsing the backup instead. ● Filename search of indexed Windows image-level backups is not supported for recovery from imported backup copies. Recover by browsing the imported copy instead. ● Assets with high-frequency backups or with very large file counts can add considerable load to the appliance. Consider appliance load when enabling the index option for these types of assets. ● To index the backup, the job creates and mounts an object. If a file recovery object is already mounted for the asset, the backup runs but no index is created (as only one object per asset can be mounted at any given time). The resulting backup completes in warning status, with a message indicating that no index was created. ● Use Windows image-level replicas to quickly spin up a virtual replica of a failed Windows asset on your VMware or Hyper-V host. NOTES ● Only one Windows replica can exist per Windows asset. You cannot run both an image-level replica and a file-level replica of the same asset at the same time. If a replica exists, you must tear it down before creating another for the asset. ● You can opt to run image-level replicas in the Unitrends Cloud. Contact your Account Manager for assistance. ● Use instant recovery for rapid disaster recovery of a failed asset. ● Use bare metal recovery to recover a failed asset to identical physical hardware or to a virtual machine. For details, see Recovering Windows Image-level Backups. |
These recovery procedures are supported for file-level backups: ● Recover an entire backup. This restores the asset to the point-in-time at which the backup was taken. ● Recover individual files by searching by filename or browsing the contents of a backup. ● Use Windows file-level replicas to quickly spin up a virtual replica of a failed Windows asset. NOTES ● Only one Windows replica can exist per Windows asset. You cannot run both an image-level replica and a file-level replica of the same asset at the same time. If a replica exists, you must tear it down before creating another for the asset. ● You can opt to run file-level replicas in the Unitrends Cloud. Contact your Account Manager for assistance. ● Use bare metal recovery to recover a failed asset to identical physical hardware, to dissimilar physical hardware, or to a virtual machine. For details, see Recovering File-level Backups. |
Exchange and SQL applications are included in image-level backups. Image-level backups can be taken with VSS copy-only snapshots (which do NOT truncate application logs) or with VSS full snapshots (which do truncate application logs by default). Image-level backups provide application protection but fewer recovery options than Unitrends application backups. NOTE Oracle on Windows – You must use Windows file-level backups to protect the Oracle server and Oracle application backups to protect hosted applications. Windows image-level backups cannot be used for Oracle. Use one of these strategies to protect an Exchange or SQL server with image-level backups: NOTE Additional recovery considerations apply for SQL clustered instances, SQL availability groups, and Exchange DAG nodes. For details, see Considerations for recovering SQL clusters, SQL availability groups, and Exchange DAGs. ● Run image-level backups using VSS copy-only snapshots, along with Unitrends application backups. Note the following: ● This strategy provides additional options for application recovery. For example, you can recover a database, transaction log, storage group, or Exchange item from an application backup. (See Application backups below for details.) ● Image-level backups use VSS copy-only snapshots by default. You do not need to configure any special setting to use copy-only snapshots. ● Image-level backups that are run with VSS copy-only snapshots do not affect any application backup chain and do not truncate any application log files. ● Logs are automatically truncated by these Unitrends application backups: Exchange fulls, Exchange incrementals, and SQL transaction log backups. ● Run image-level backups using VSS full snapshots to protect both the system files and hosted applications. Note the following: ● Each image-level backup truncates any Exchange and SQL transaction logs for any online user databases on the server. NOTE Image-level backups run using VSS full snapshots do NOT truncate logs for the following: offline databases, databases whose parent application instance is offline, and SQL system databases (master, model, and tempdb). ● From an image-level backup, you can recover individual files, use replicas or instant recovery to quickly recover a failed or corrupted Windows machine, or use bare metal recovery to recover a failed asset to identical physical hardware or to a virtual machine. ● VSS full snapshots are not used for image-level backups by default. You must configure this setting by checking these boxes in the Edit Asset dialog: Show Image Level Backup Settings and Allow application aware. For details, see To edit an agent-based asset. NOTES ● For hosted Exchange and SQL applications, you cannot run both application backups and image-level backups that are configured with the Allow application aware setting. This would result in backup failures (because VSS full snapshots truncate all application logs). ● There is no way to recover SQL databases or Exchange instances separately. You can recover Exchange and SQL files from image backups, but you cannot easily recover a database or Exchange instance after data loss or corruption. ● Once an asset is configured with the Allow application aware setting: ● Any existing SQL and Exchange schedules are disabled. ● Windows file-level replicas of the asset cannot include SQL or Exchange applications. An error displays if you attempt to configure an application when adding or editing the replica. ● Any existing file-level replicas that include SQL or Exchange should be manually deleted as their application data will become stale over time (since there will be no future application backups being restored to them). You can then recreate the replica without SQL and Exchange. ● Run image-level backups using VSS copy-only snapshots. Note the following: ● Application logs are NOT truncated. The database administrator must manually truncate the application logs. ● From an image-level backup, you can recover individual files or use instant recovery to quickly recover a failed or corrupted Windows machine, or use bare metal recovery to recover a failed asset to identical physical hardware or to a virtual machine. ● There is no way to recover SQL databases or Exchange instances separately. You can recover Exchange and SQL files from image backups, but you cannot easily recover a database or Exchange instance after data loss or corruption. |
Active Exchange databases and active SQL user databases are automatically excluded from file-level backups. (SQL system databases are always included to support Windows replicas.) File-level backups are taken with VSS full snapshots. Full file-level backups do NOT truncate application logs. Run file-level backups along with Unitrends application backups to protect hosted applications. (See Application backups below for details.) |
|
Unitrends application backups provide these benefits: ● SQL, Exchange, Oracle, and SharePoint backups perform application-level post backup processing, such as log truncation. ● Support all SQL database recovery models. Must run asset-level application backups for all recovery models other than simple. ● Support backup of multi-node SharePoint farms. For more on application protection, see Application Backups Overview. |
||
SLA policies |
SLA policies supported for image-level backups. |
SLA policies are supported for file-level backups. |
Copy Data Management |
Image-level backups and image-level replicas that reside on a VMware or Hyper-V host can be used with the Copy Data Management feature. |
File-level backups can be used to create Windows replicas. Windows replicas that reside on a VMware or Hyper-V host can be used with the Copy Data Management feature. |

Follow these best practices to protect your Windows assets with image-level backups:
● Adhere to Microsoft best practices.
● Full and incremental backups are supported for image-level backups.
● Opt to index backups so you can search the asset's backups by filename to quickly recover individual files. See Recovering from an indexed image-level backup by using Search Files for details.
● A new full backup is required if the disk or volume configuration has changed since the last backup. This includes any change to the number, size, or properties of the disks or to the number, size, or properties of the volumes on a disk.
If the disk or volume configuration has changed since the last backup, the appliance promotes the next scheduled backup to a full (or displays a message indicating a full is required if an on-demand incremental is attempted). Once a full backup succeeds, subsequent incrementals run as scheduled.
NOTE Protecting a given image-level asset by using more than one appliance is not recommended. Each time a backup is run on an one appliance, the integrity of the incremental backup chain on any other appliance is compromised. To correct a compromised backup chain, the appliance automatically promotes the next incremental to a full. Because of this, running incrementals on multiple machines is likely to result in many full backups.
● In-place Windows operating system upgrades disable the Volume CBT driver that is used to run incremental backups. To run incremental backups after performing an in-place OS upgrade, you must uninstall then re-install the Volume CBT driver:
● Use Windows Control Panel > Programs > Programs and Features to uninstall Unitrends Volume CBT Driver:
● To re-install, run the MSI installer (C:\PCBP\Installers\uvcbt.msi). After installing the driver, you must enable it by rebooting the Windows asset.
● After re-installing the Volume CBT driver, the next incremental is promoted to a full backup.

Follow these best practices to protect your hosted applications with image-level backups:
● Adhere to Microsoft best practices.
● Full and incremental backups are supported for image-level backups.
● Do not use Windows image-level backups for Oracle. You must use Windows file-level backups to protect the Oracle server and Oracle application backups to protect hosted applications.
● Additional recovery considerations apply for SQL clusters, SQL availability groups, and Exchange DAGs. For details, see Considerations for recovering SQL clusters, SQL availability groups, and Exchange DAGs.
● A new full backup is required if the disk or volume configuration has changed since the last backup. This includes any change to the number, size, or properties of the disks or to the number, size, or properties of the volumes on a disk.
If the disk or volume configuration has changed since the last backup, the appliance promotes the next scheduled backup to a full (or displays a message indicating a full is required if an on-demand incremental is attempted). Once a full backup succeeds, subsequent incrementals run as scheduled.
● A new full backup is required if the disk or volume configuration has changed since the last backup. This includes any change to the number, size, or properties of the disks or to the number, size, or properties of the volumes on a disk.
If the disk or volume configuration has changed since the last backup, the appliance promotes the next scheduled backup to a full (or displays a message indicating a full is required if an on-demand incremental is attempted). Once a full backup succeeds, subsequent incrementals run as scheduled.
NOTE Protecting a given image-level asset by using more than one appliance is not recommended. Each time a backup is run on an one appliance, the integrity of the incremental backup chain on any other appliance is compromised. To correct a compromised backup chain, the appliance automatically promotes the next incremental to a full. Because of this, running incrementals on multiple machines is likely to result in many full backups.

The following requirements must be met for image-level protection of Windows assets:
Item |
Description |
---|---|
Unitrends appliance |
These requirements apply to the Unitrends backup appliance: ● The appliance must be running release 10.3 or higher (10.5.1 or higher to use the Windows image-level replicas feature). ● Port 443 must be open inbound to the appliance from the protected Windows asset for the TCP protocol. |
Windows agent |
The Windows asset must be running Unitrends agent version 10.3 or higher with the Volume CBT driver. (Agent version 10.5.1 or higher is required to use the Windows image-level replicas feature). During agent installation, you have the option to install the Volume CBT driver. The Volume CBT driver is needed to run image-level incremental backups. After you install the Windows agent and Volume CBT driver, you must reboot the Windows asset to enable the driver. For details, see . NOTES ● If the Volume CBT driver has not been installed or has not been enabled, image-level incrementals are not supported. Any scheduled incremental is automatically promoted to a full backup. If you attempt to run an on-demand incremental, you receive a message indicating that only full backups are supported. ● There is a known issue where the Hyper-V CBT driver cannot be installed on Hyper-V servers that are running a pre-10.1.0-3 agent. In this case, you must manually uninstall the older Windows agent before installing the latest agent. For details, see To uninstall the Windows agent. |
Windows asset |
See these rows below for Windows requirements: NOTE Additional Windows requirements apply for instant recovery. For details, see Windows asset requirements for IR. |
The operating systems listed below are supported. (Additional version limitations apply. See the Compatibility and Interoperability Matrix for details.) Supported client operating systems: ● Windows 11, 64-bit only ● Windows 10, 64-bit only ● Windows 8.1, 64-bit only ● Windows 8, 64-bit only ● Windows 7 with SP1, 64-bit only Supported server operating systems: ● Windows 2022, 64-bit only ● Windows 2019, 64-bit only ● Windows 2016, 64-bit only ● Windows 2012 R2, 64-bit only ● Windows 2012, 64-bit only ● Windows 2008 R2 with SP1, 64-bit only NOTES These additional requirements apply to Windows 2008 R2 SP1: ● These Windows security updates must be installed: Update for Windows Server 2008 R2 x64 Edition (KB2533623) and Security Update for Windows 7 for x64-based Systems (KB3033929). (If these updates have not been installed, you are prompted to install them during agent installation.) ● The Unitrends Volume CBT driver (used to run image-level incremental backups) cannot be installed along with the Unitrends Windows agent. You must install it manually. During agent installation the Volume CBT installer is placed here: C:\PCBP\Installers\uvcbt.msi. To install the driver, simply run uvcbt.msi. After installing the driver, you must enable it by rebooting the Windows asset. |
|
Image-level protection is supported for BIOS- and UEFI-based assets.
|
|
Image-level protection is supported for Windows machines configured with basic disks only. Dynamic disks are not supported. Offline disks are included in image-level backups. |
|
Image-level protection is supported for GUID Partition Table (GPT) partitions and Master Boot Record (MBR) partitions. |
|
Image-level protection is supported for these file systems: NTFS, FAT, FAT32, exFAT, and ReFS. NOTE Due to a Microsoft limitation, VSS snapshots cannot be taken of these volumes: FAT, FAT32, and exFAT. Backups of these volumes may contain data that is not in a consistent state if data changes during the backup job. |
|
Image-level protection is not supported for read-only disks. You must exclude all volumes on read-only disks from the backup job or run file-level backups. Image-level backups fail if read-only volumes have not been excluded. (For details on excluding volumes, see step 4. in To create an image-level backup job.) NOTE Removable media is automatically excluded from image-level backups. You do not need to exclude volumes on a read-only disk that resides on removable media. Image-level protection is not supported for VHD or VHDX files that are mounted as local volumes. For details, see VHD or VHDX files that are mounted as local volumes. |
|
The Multi-point Services Role and RDS User Profile Disks are not supported. |
|
Image backups are supported for Active Directory (AD) when running a standalone, single domain controller instance only. Microsoft system state backups are also required for bare metal recovery into other environments, including Unitrends DRaaS. For all other configurations, use Unitrends file-level backups for proper AD application protection. NOTES ● For more on protecting domain controllers with image-level backups, see Detailed Options for Protecting Domain Controller (DC) and and Restoring Active Directory (AD). ● For more on running Windows system state backups, see this Microsoft article: AD Forest Recovery - Backing up the System State data. |
|
Image-level protection is not supported for the following features. Use file-level protection instead: ● Windows Storage Spaces ● Cluster shared volumes (CSVs) ● Windows Server Failover Clusters (WSFCs) ● Distributed File System environments – Distributed File System (DFS) Namespaces and DFS Replication offer high-available access to geographically dispersed files. Because of the replication and syncing operations in DFS environments, you must set up the Windows machine in accordance with Microsoft best practices to ensure database consistency. If all Microsoft considerations are not addressed, backup and restore of the Windows machine may yield undesired results. If you prefer not to research these best practices, protect the machine by running file-level backups instead. |

Image-level protection is not supported for VHD or VHDX files that are mounted as local volumes.
If you include one of these locally mounted volumes in an image-level backup, recovery from the backup yields undesired results.
Protecting unmounted VHD or VHDX files is supported. For example:
Protecting a volume that was created by mounting a local VHD(X) file is not supported. For example: