Reading a chain's file progression can be a bit tricky for those new to ShadowProtect.
Sample Chain - 3 snapshots per day
- C_VOL-b001.spf - 01/01/14 8:00am
- C_VOL-b001-i001.spi - 01/01/14 12:00pm
- C_VOL-b001-i002.spi - 01/01/14 5:00pm
- C_VOL-b001-i002-cd.spi - 01/01/14 5:00pm
- C_VOL-b001-i002-cd.md5 - 01/02/14 12:05am
- C_VOL-b001-i003.spi - 01/01/14 7:00am
- C_VOL-b001-i004.spi - 01/01/14 12:00pm
- C_VOL-b001-i005.spi - 01/01/14 5:00pm
- C_VOL-b001-i005-cd.spi - 01/01/14 5:00pm
- C_VOL-b001-i005-cd.md5 - 01/02/14 12:05am
The first point in reading a chain is that the consolidated file's name will contain a reference to the last incremental or smaller consolidated file which got rolled up. Looking at the list above, notice the first consolidated daily image (-cd) file is named "i002" which is the same as the most recent snapshot prior to the consolidation.
Note: Remember, ImageManager gathers files for consolidation for a 24-hour period covering midnight to midnight. So snapshots generated at 5pm with consolidations scheduled for 7pm will not be included in that consolidation, instead they'll be included in the next consolidation. Only the last most recent snapshots prior to the midnight of that morning will be included in that day's consolidation.
The second point in reading a chain, at least as of version 5 of ShadowProtect, is the timestamp of the generated .spi versus the associated .md5 file. Notice how the timestamp of the i002-cd.spi matches the timestamp of the last included snapshot i002.spi (01/01 5:00pm). See how the associated i002-cd.md5 is timestamped at 01/02 12:05am. By noting the associated .md5 file, you can determine when the consolidation took place.
This behavior of naming and timestamp association continues when daily files are consolidated into weekly (C_VOL-b###-i###-cd-cw.spi), weekly into monthly (C_VOL-b###-i###-cd-cw-cm.spi), and monthly into rollup (C_VOL-b###-i###-cd-cw-cm-cr.sp).
Note: The monthly file name (and correspondingly the rollup) might not always have a "cw" as part of the name. The "cw" in the monthly name would only happen if the end of the week (default Saturday) also fell at the end of the month so both the weekly and monthly were created at the same time.