Backup and recovery
On this page
The host's ways back and the records of losing them.
recovery_state
recovery mechanism (now). this recovery mechanism is in this state now, as Windows records it (WMI's shadow copies and storage, the policy and boot configuration values, ReAgent.xml) - not that a restore from it would succeed
Kind | State - something true when Signal read the host |
Built-in rules reading it | 3 |
Fields of recovery_state
Field | Type | Meaning |
|---|---|---|
| string | The recovery mechanism, as the analyst names it: "Shadow copies on C:", "System Restore", "Windows Recovery Environment", "Boot recovery", "File History". |
| string | What the mechanism's state is, in words, exactly as read ("3 copies, the newest made 2026-10-14 03:00 UTC", "none on this volume", "turned off by policy (DisableSR = 1)", "not read: needs administrator"). Never a bare yes or no. |
| string | What sets the state: the policy key (local GPO or Group Policy - Signal does not tell them apart here), the setting itself, Windows' default, or the file Signal read it from. |
| string | true when a policy value turns the mechanism off (System Restore's DisableSR or DisableConfig under the Policies key); absent when no policy is set or it could not be read. |
| string | What turns Windows' automatic boot recovery off in the boot configuration of the default boot entry: "recoveryenabled No", "bootstatuspolicy IgnoreAllFailures", or both; absent when neither is set or the boot configuration could not be read. |
| string | The volume a shadow copy, its storage or a volsnap record is about: its drive letter where it has one, else its volume name. |
| int | How many shadow copies of the volume exist now. |
| time | When the newest shadow copy of the volume was made. |
| time | When the oldest shadow copy of the volume was made. |
| string | The shadow copy storage of the volume in use now, in MB. |
| string | The most the volume's shadow copy storage may grow to: MB, and the share of the volume's size; "unbounded" when no limit is set. |
| string | true when the volume's shadow copy storage limit is under 1% of the volume's size - too small to hold a copy of a working system's changes, so Windows deletes copies as soon as they grow (what a resize to a tiny limit does); false when it is not; absent when the limit or the volume's size could not be read. |
backup_event
Windows Backup operation (historical). Windows Backup (Windows Server Backup, or Windows' own Backup and Restore) ended an operation this way at the record's time, or its backup catalog was deleted
Kind | Event - something that happened at a time |
Its time is | event logged |
Built-in rules reading it | 1 |
Fields of backup_event
Field | Type | Meaning |
|---|---|---|
| string | How a Windows Backup operation ended, as its event says: finished successfully (4), failed (5), completed (14), or the backup catalog deleted (161) - with its error code when it failed. |
| string | Where Windows Backup wrote the backup (its BackupTarget), as the event records it. |
| time | When a log record was written (its TimeCreated). |
shadow_copies_lost
shadow copies lost (volsnap, historical). Windows deleted or aborted every shadow copy of this volume at the record's time, for the reason the event names - not who or what caused it
Kind | Event - something that happened at a time |
Its time is | event logged |
Built-in rules reading it | 1 |
Fields of shadow_copies_lost
Field | Type | Meaning |
|---|---|---|
| string | The volume a shadow copy, its storage or a volsnap record is about: its drive letter where it has one, else its volume name. |
| string | What the mechanism's state is, in words, exactly as read ("3 copies, the newest made 2026-10-14 03:00 UTC", "none on this volume", "turned off by policy (DisableSR = 1)", "not read: needs administrator"). Never a bare yes or no. |
| time | When a log record was written (its TimeCreated). |