Restic exclude question on windows?

Hi Currently running restic 0.17.0 on windows and everything is working fine, just cant get to exclude this part


\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy111\shares

on the exclude i have tried these combinations

D:\System Volume Information
System Volume Information
System Volume Information*
HarddiskVolumeShadowCopy108
HarddiskVolumeShadowCopy*
HarddiskVolumeShadowCopy109
HarddiskVolumeShadowCopy110
HarddiskVolumeShadowCopy\*
*/HarddiskVolumeShadowCopy
C:\System Volume Information\*
D:\System Volume Information\*

not sure whats the correct way to exclude?

Thank you

"\Device\HarddiskVolumeShadowCopy111\shares"

Maybe this one?

thanks for the reply, the issue is that it keeps changing the 111 to another number everytime

I guess you’re using --use-fs-snapshot? If yes, then just use the normal filesystem paths to write the excludes.

Excludes support placeholders, so just replace 111 with *.

Thanks for the reply, currently using GitHub - kmwoley/restic-windows-backup: Powershell scripts to run Restic backups on Windows
to backup on windows
so i assume it be on the excludes file like this?
i was checking the powershell code it seems it only runs like this

$ResticExe backup $folder_list $vss_option --tag "$tag" --exclude-file=$WindowsExcludeFile --exclude-file=$LocalExcludeFile $AdditionalBackupParameters

\Device\HarddiskVolumeShadowCopy*\shares

Thanks

@killmasta93 Thanks for the update!

hi @fede currently, i tried but it seems its not working :frowning:

And with:

"\Device\HardDiskVolumeShadowCopy*"

Link:

thanks for the reply so odd i tried the following and keep seeing this error

restic.exe : error: failed to save D:\shares\sistema de gestion\xxx\00. 
xxxx\xxxx.pdf: nodeFromFileInfo 
\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy305\shares\sistema de 
gestion\xxx\00.\xxxx\xxxx.pdf: get EA 
failed while opening file handle for path 
\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy305\shares\sistema de 
gestion\xxx\00.xxx\xxxx\xxxx.pdf, with: 
Access denied.
En C:\windows\restic\backup.ps1: 281 Carácter: 13
+             & $ResticExe backup $folder_list $vss_option --tag "$tag" 
--exclude- ...

but looking at the file full admin permissions or could it be permission from the shadow copies?
even whats odd i try to ignore the shadow copies it still seems to tries to copy it

Have you tried running the normal restic command? Without using the script?

Thanks for the reply, so i did the following running it manually but created this script of my own

 get EA failed while opening file handle for path \\?\D:\shares\

This i was the command i ran

# Load the S3 bucket information from secrets.ps1
$excludeFile = "C:\Windows\restic\windows.exclude"
$repo = "s3:http://192.168.1.241:9002/zeus"
# Set the AWS environment variables required for Restic to access the S3 bucket
$Env:AWS_ACCESS_KEY_ID='User'
$Env:AWS_SECRET_ACCESS_KEY='xxxxx'
$Env:RESTIC_REPOSITORY='s3:http://192.168.1.241:9002/zeus'
$Env:RESTIC_PASSWORD='xxxxxx'

# Run the Restic backup command using the S3 bucket as the repository
C:\Windows\restic\restic.exe -r $repo backup "D:\" --exclude-file=$excludeFile

and my exclude files

# default excludes
# examples https://github.com/duplicati/duplicati/blob/master/Duplicati/Library/Utility/FilterGroups.cs
C:\hiberfil.sys
C:\pagefile.sys
C:\swapfile.sys
C:\$Recycle.Bin
C:\autoexec.bat
C:\Config.Msi
C:\Documents and Settings
C:\Recycled
C:\Recycler
C:\$$Recycle.Bin
C:\System Volume Information
C:\Recovery
C:\Program Files
C:\Program Files (x86)
C:\ProgramData
C:\PerfLogs
C:\Windows
C:\Windows.old
C:\$$WINDOWS.~BT
C:\$$WinREAgent
Microsoft\Windows\Recent
Microsoft\**\RecoveryStore*
Microsoft\**\Windows\*.edb
Microsoft\**\Windows\*.log
Microsoft\**\Windows\Cookies*
MSOCache
NTUSER*
ntuser*
UsrClass.dat
D:\System Volume Information
System Volume Information
System Volume Information*
HarddiskVolumeShadowCopy108
HarddiskVolumeShadowCopy*
HarddiskVolumeShadowCopy109
HarddiskVolumeShadowCopy110
HarddiskVolumeShadowCopy\*
*/HarddiskVolumeShadowCopy
C:\System Volume Information\*
D:\System Volume Information\*
\Device\HarddiskVolumeShadowCopy*\shares
\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy*\*
\Device\HardDiskVolumeShadowCopy*

# cloud services
Dropbox
AppData\Local\Google\Drive
Google Drive\.tmp.drivedownload
C:\OneDriveTemp


# browsers
Google\Chrome

# AppData
AppData\Local\Microsoft
AppData\Local\Duplicati
AppData\Local\D3DSCache
AppData\Local\ConnectedDevicesPlatform
AppData\Local\Packages
AppData\Roaming\Signal
AppData\Local\ElevatedDiagnostics
AppData\Local\restic
AppData\LocalLow\Microsoft\CryptnetUrlCache
AppData\Local\IsolatedStorage
AppData\Local\Spotify
AppData\Local\Programs\signal-desktop
AppData\Roaming\Code
AppData\Roaming\Slack
AppData\Roaming\Spotify
AppData\Roaming\Zoom

# misc. temporary files
Temporary Internet Files
Thumbs.db
AppData\Local\Temp
Users\Public\AccountPictures

Thanks

@killmasta93 Your exclude file looks quite interesting.
Perhaps I could merge it with mine at npbackup/excludes/windows_excludes at main · netinvent/npbackup · GitHub

Pretty sure both lists could contain interesting entries.

Just a side question, why do you exclude NTUSER.DAT files which are the HKEY_USER parts of registry ? Looks like a file I would definitly like to have. The same for .edb files, which are quite precious when it comes to password corruption, or even more active directory.

hi there, yeah currently only using restic to backup files of the users not really concerned with HKEY as that part i have it covered with proxmox ZFS snapshots

I was wondering if you ever got the issue of how i can exclude that part been trying all types of combination

\\?\D:\shares\

Basically, you need to have FileMatch compatible expressions. The problem is that ? is a single char wildcard in FileMatch.
If I happen to remember well, the escape char is $, which can be used to escape ? so it becomes a “real” char instead of being interpreted.
That being said, even interpreted, the wildcard ? should allow the real char ? as replacement.

Could you try the following exclusion:

\\$?\D:\Shares
\\$?\GLOBALROOT\Device\HarddiskVolumeShadowCopy*

Just make sure that you really don’t want to backup D:\Shares because that’s what the first line will exclude.
If that doesn’t do the trick, than the escape could be \\ (depending how fnmatch is implemented for windows I guess), so first part would become \\\.

wow thank you so much that did the trick

\\$?\GLOBALROOT\Device\HarddiskVolumeShadowCopy*

Happy to help :wink:
This will actually go into the default exclude list of NPBackup.

Wouldn’t mind you to give this a test run, I definitly need some feedback.

Thanks to @killmasta93 and @deajan now I also learned how to solve it!
I will surely use it in the future

hi @deajan back again, so whats odd is that again getting the alert


nodeFromFileInfo 
\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy306

i tried these two not sure if i missed something else?


\\$?\GLOBALROOT\Device\HarddiskVolumeShadowCopy*
\\$?\D:\Shares

@killmasta93 Just to make sure what happens. The exclusion DID work and now it does not ?

Hi @deajan sorry for the late reply, yeah the exclusion did not work :frowning: i thought it did not sure what happened