Fine-grained and multi-level recovery scheme for Windows based on duplication and snapshot

To protect the Windows system, any write operation to the blocks of the computer´s local disk is detected, and the duplication of the write data is delivered to the mirror disk in the storage server online by a driver in real time. The snapshots of the mirror disk are created on the critical points while the Windows is running. When the recovery is necessary, the WinPE with recovery managers in the storage server is used to boot the computer, and the selected snapshot is mounted as the computer´s external read-only disk SnapDisk, by comparing the files and registry entries in the local disk and that in the SnapDisk, not only disk-level recovery, file-level recovery can be implemented, but also registry entry-level recovery can be achieved.