Does Restore-WBBackup preserve alternate data streams and security descriptors during file recovery?

Recovery Behavior

Yes, Restore-WBBackup preserves alternate data streams (ADS) and security descriptors when recovering files to an NTFS-formatted volume. Because Windows Server Backup leverages the Volume Shadow Copy Service (VSS), it captures the full NTFS metadata of the source files, including the primary data stream, associated alternate streams, and the security descriptor (Owner, Group, DACL, and SACL).

Technical Explanation

The preservation of these attributes is a function of the underlying backup mechanism rather than a specific switch in the PowerShell cmdlet. The backup image stores the file system metadata as it existed at the time of the snapshot. During the restore process, the system attempts to write this metadata back to the target volume.

However, there are three critical conditions that can affect the outcome:

• Filesystem Compatibility: Metadata preservation is exclusive to NTFS. If you restore files to a FAT32 or exFAT volume, all security descriptors and alternate data streams will be stripped.
• SID Resolution: While the security descriptors are preserved, the SIDs (Security Identifiers) within those descriptors must be resolvable. If you restore files to a server in a different domain or forest, the restored ACLs may contain orphaned SIDs.
• Inheritance: Depending on the destination folder's properties, restored files may be subject to inheritance rules of the target directory, which can complicate the effective permissions of the restored objects.

Verification Steps

To verify that your specific environment is retaining this metadata, use the following scoped commands on a test file:

1. Create a test file with an ADS:

   echo "Test Stream Content" > testfile.txt:mystream

2. Apply a unique permission:

   icacls testfile.txt /grant "Everyone:(R)"

3. Perform the backup and restore using Restore-WBBackup.
4. Verify the ADS exists:

   dir /R testfile.txt

5. Verify the ACLs:

   icacls testfile.txt

Diagnostic Detail Required: Are you restoring these files to the original volume or to a different volume/server? This determines whether you will encounter SID resolution issues or permission inheritance conflicts.