How does File History work in Windows 10?

Question

A Windows 10 machine has File History backup turned on. It was taking almost 400GB of space so I changed it to delete saved points older than 3 months. What exactly is included in File History? For example if you download a 2GB movie will that be saved? How do systems like this keep track of files if the expectation is the file will be modified?

For example if there is a 1MB file a.exe and the user deletes it and then reuses the name but makes a 10MB file, would this be considered a new version?

Answer 1

File History is a very basic utility. File History only backs up copies of files that are in the Documents, Music, Pictures, Videos, and Desktop folders and the OneDrive files available offline on your PC. As long as that 2GB movie you mentioned was saved in one of these folders, then it will be backed up.

File History Will save a copy of the files in those folders to another location, configured in its settings. It does so in the frequency also set in its settings. Once Windows detects the file has changed, it makes a copy of that file. Windows creates a folder on the drive you selected and creates copies of the files. It renames them with dates in the file name, as well as creates a small database.

Restoration of these files is based on the frequency selected. If you have it set to save copies every hour, and you change the file every second, you would only have made 24 backups of that file in one day.

To answer your last question, they answer would be yes, as long as the file was backed up before it was changed. Again, it all depends on the frequency of backups. It will not keep track of every version of file on change, as that would eat up massive amounts of storage.

File History was really designed for non-technical users in mind. These users were not backing up their data. Microsoft had always provided a backup utility in their OSs, but found non-technical people were not using it. The whole differential, incremental, etc, verbiage scared non-technical people away. File History makes backing up files much easier for the layperson. It is a simple set-it-and-forget-it way of backing up files. However, it is not nearly as powerful as a real backup program.

Answer 2

Did you study how Volume Shadow Copy works ? W10 file history is based on that. But there is a big difference: unlike the System Restore/VSC file recovery in older Windows versions, File History keeps most backups on a separate hard drive.

Important things to note:

• Do not expect File History to cover all your folders or whole drives - it backs up all your default and custom Libraries (including Public Folders), plus Contacts, Desktop and Favorites folders. But you can manually add folders to File History via the Modern UI/Metro user interface.

• File History does not back up any files or folders that use EFS

• It does not back up items in your OneDrive (aka SkyDrive) folder unless they are made available offline.

• File History does not require administrator rights to set up, or back up and restore files.

Now to answer your questions:

• Yes, large files will be kept also. The system is designed to use external storage for its purpose. Cache is also stored under C:\Users\(username)\AppData\Local\Microsoft\Windows\FileHistory\Data.

• In file history, there's a full copy of the file, unlike VSC where file changes are stored. It actually works like this: it utilize USN Journal to track changes and saves file revisions on backup location. Saves the amended version with appended date/time. Example: File1 (2016_10_01 01_11_11).tmp, File1 (2016_10_02 02_12_21).tmp.

• Unknown 100% at this point, but it will probably make no difference what the file contents is. In one of the initial tech tests the system was able to distinguish files by a criteria similar to DLL versioning. That means a totally different a.exe would not be considered the new version of the previous one. I haven't seen that implemented in the following versions, so it probably got removed.

Basically, FH is just a scheduled limited backup tool using simple file copy-paste.

Answer 3

I took the title of this article as including "What is the structure of the backup? Where is it stored?" so I did some poking around.

When you select a drive for the backup, the file contents will be stored in a folder \FileHistory\userName\computerName where userName is the name of the user that set up the File History, and computerName is the name of the computer which the files are being backed up form.

Under that folder there is a Configuration folder that holds two xml files and an EBD file (a database) that doesn't seem to contain much, and a Data folder that holds copies of the actual files.

Under the Data folder, the first level is the drive name from the original system (e.g. there is a folder D for files backed up from drive D:). Within these first-level folders, the files have exactly the same structure as on the original drive, with two exceptions:

1. Each file's name has a date (likely the time the backup started) encoded as " {yyyy_mm_dd hh_mm_ss UTC}" (note the leading space) inserted just before the filename extension.
2. Between adding the encoded date and prefixing the full original file path with \FileHistory\Data some of the filenames can become too long. These files are given numbered names, and placed in (apparently) single-level numbered folders in a folder called $OF directly under Data (thus a sibling to the drive names).

The Modified date of the backup files is the same as the original file. The Created date indicates when that particular backup file was created. The backup file has the R (Read-only) attribute set.

My experiments were done using a FAT/FAT32 file system on a USB thumb drive, so I don't know what sort of permissions would be set on the backup files.

As a more concrete example, I have Microsoft reference source on my system, and some of these files have been backed up to:

• F:\FileHistory\kpmartin\TETRON\Data\D\Users\KPMartin\Documents\Reference Source\dotnet462RTM\Source\ndp\fx\src\winforms\Managed\System\WinForms\Printing\PrintDialog {2020_02_02 06_33_12 UTC}.cs, which is a backup of D:\Users\KPMartin\Documents\Reference Source\dotnet462RTM\Source\ndp\fx\src\winforms\Managed\System\WinForms\Printing\PrintDialog.cs
• F:\FileHistory\kpmartin\TETRON\Data\$OF\7315\7318 {2020_02_02 06_33_12 UTC}.cs which is a backup of D:\Users\KPMartin\Documents\Reference Source\dotnet462RTM\Source\ndp\fx\src\winforms\Managed\System\WinForms\Printing\PrintControllerWithStatusDialog.cs

The mapping of the numbered names does not appear to be stored with the files themselves in the FileHistory folder on the backup drive. Instead it is stored on the original system, in the user's AppData\Local\Microsoft\Windows\FileHistory\Configuration folder, in a database files called Catalog1.edb. Alongside this is an XML files called Config1.xml which appears to contain the actual backup options, including the folder include and exclude lists, as well as the destination drive information. In addition to Catalog1.edb and Config1.edb, there are also Catalog2.edb and Config2.edb which appear to be exact copies of the number-1 counterparts.

The EDB files are a format known as an "ESE Database" which is used all over the place in Windows where a non-relational database is required. Some example besides FileHistory are Active Directory and the index used by Windows desktop search. The gory details on this file format and where it is used are available online. The metadata of this file can be probed using the esentutl.exe command which may exist on more advanced Windows system (I have Windows 10 Enterprise). The linked article mentions two other commands that could also perhaps do some probing. Dumping the actual table contents from the database likely requires writing code, but there is both native and Managed (.NET) support for this.