What is the archive bit in NT, and how does it affect me?

From Backup Central


The Windows archive bit is evil and must be stopped

An article written by W. Curtis Preston, 2006


I have a major problem with the Windows archive bit, and so should you. At the very least, backup product vendors should give us the option of not using it — without penalty. Here's why: If the "ready for archiving" bit is set on a file in Windows, it indicates that a file is new or changed, and that it should be backed up in an incremental backup. Once this happens, the archive bit is cleared. Therefore, the first problem with the archive bit is that it should be called the backup bit, because backups are not archives.

The biggest problem with the archive bit, however, is that the process assumes that only one application will clear the archive bit, when there could actually be several of them.

The first backup program to back up the directory will clear the archive bit, and the next program will not back up the same files. Suppose a user decides to use ntbackup to backup his files on the company's file server to CD. If he does that, ntbackup will clear the archive bit, and the corporate backup system in charge of backing up those files will not back them up. This is because they don't appear to be in need of backup, as the archive bit is not set. This means that any user can defeat the purpose of the entire backup system.

Proponents of the archive bit will point out that it is set on newly installed software, even if the files are old. A backup software package that uses only modification time will not notice these files if they're older than the latest incremental backup. So perhaps what they should be using is a combination of the archive bit and modification time. If either has been changed, the file should be included in an incremental backup.

The Unix difference

When backing up Unix systems, there is no archive bit, so backup applications use either mtime (when the contents of the file were last changed) or ctime (when the attributes of the file were last changed).

When backing up Windows systems, different backup applications use the archive bit differently. NetWorker includes the archive bit as one of the things it checks to determine if a file needs to be backed up, but it also checks mtime and ctime, as well. NetBackup uses the archive bit for files and ctime for directories, but allows you to use mtime for files.

Tivoli TSM does not use the archive bit at all. Based on what I'm saying here about the archive bit, that's not a bad thing. Hopefully, it's not the only way your backup product determines if a file needs to be backed up.

If your product offers the option to use mtime, it would probably be a more reliable way of backing up your data. If your product can't use anything but the archive bit, perhaps you should show your vendor this article.

You can tell NetBackup to use the Windows journal instead. Investigate that option in the manual.