What is bare metal recovery? Definition, process and when to use it

Hardware fails without warning. A system that was running fine at the end of the day can be completely inoperable the next morning, and not every failure is something you can troubleshoot your way out of. When a motherboard dies, a storage controller corrupts a disk array, or ransomware locks every file on the machine — the only path forward is a complete rebuild.

That is where bare metal recovery comes in. It applies to servers, workstations, laptops and virtual machines. It is one of the most important capabilities in any backup and recovery strategy, and one that is often confused with related but narrower recovery methods. This guide explains exactly what bare metal recovery is, how the process works, when to use it and how it compares to system state recovery.

Kaseya offers bare metal recovery across its backup solutions: Datto SIRIS for MSPs protecting client environments and Unitrends (available as a physical backup appliance or enterprise backup software) for businesses managing their own infrastructure. Both support full system restoration to the same hardware or dissimilar hardware, across physical servers, virtual machines and endpoints.

What does bare metal recovery mean?

Bare metal recovery (BMR), also called bare metal restore, is the process of rebuilding a complete system from a backup image onto hardware that has no operating system installed. The name describes the starting point: the target machine is bare metal, nothing but the physical hardware, with no OS, no applications and no configuration in place.

A bare metal recovery restores everything: the operating system, installed applications, system drivers, configurations and data, all from a single image backup. The result is a fully functional system, identical in software terms to the one that existed before the failure, even if the underlying hardware is new or different.

This distinguishes bare metal recovery from file-level backup and restore, which can recover individual files and folders but cannot rebuild a system from scratch. It also distinguishes it from system state recovery, which restores critical OS components but not the full system environment. Bare metal recovery is the most comprehensive restore option available and the one to reach for when a system cannot be recovered by any other means.

The term “bare metal” originated in the context of machines running directly on physical hardware, without a hypervisor or virtualization layer in between. In recovery contexts, it describes the starting condition: raw, unconfigured hardware that receives a full system image during the restore process. While BMR is most commonly discussed in the context of servers, it applies equally to workstations, laptops and virtual machines protected by image-based backup tools.

How does bare metal recovery work?

Bare metal recovery follows a structured sequence. The details vary by platform, but the core process is consistent across tools and environments. Here’s how it works:

1. A full system image backup is created. The backup captures the complete state of the protected system, including the OS and boot sector, all installed applications and drivers, system configurations and registry, and all data volumes. This image is typically created using block-level backup technology, which works at the disk level rather than the file level to ensure a complete and bootable capture. Modern backup tools use Volume Shadow Copy Service (VSS) on Windows systems to create crash-consistent images while the machine is running, eliminating the need for scheduled downtime.
2. The backup image is stored securely. The image is stored locally on a backup appliance or external storage and, in a well-designed strategy, replicated to an offsite location or cloud. Storing the only copy of a bare metal backup locally creates a single point of failure: if the primary machine and local backup are destroyed in the same event, recovery becomes impossible.
3. A failure event occurs. Hardware failure, ransomware, catastrophic software corruption, or a disaster that renders the original system unusable triggers the need for bare metal recovery.
4. Bootable recovery media is prepared. Most backup solutions provide bootable ISO images or USB media that contain a lightweight recovery environment. The technician boots the target machine from this media to start the recovery process without needing a pre-installed operating system on the target hardware.
5. The system image is deployed to the target hardware. The recovery tool connects to the backup repository, presents available restore points and the technician selects the appropriate image. The tool writes the complete system image to the target machine’s disks, reconstructing the partition layout, boot sector, OS, applications and data.
6. Drivers are adjusted for the target hardware. If the target machine has different hardware from the source, the recovery tool needs to inject or update the appropriate drivers to ensure the restored system boots correctly. Purpose-built backup solutions handle this automatically through hardware-independent restore technology. Without this capability, restoring to dissimilar hardware often results in boot failures. This topic is covered in detail below.
7. The system is booted and verified. Once the image is applied, the recovered machine boots its restored OS. The technician verifies that services, applications, and data are accessible and functional before returning the system to production.

Benefits of bare metal recovery

Bare metal recovery is not just a fallback for catastrophic failures. When it is built into a backup strategy properly, it delivers a set of concrete operational advantages that file-level and system state recovery methods cannot match.

Complete system restoration from a single image
Rather than reinstalling the OS, reinstalling applications, reconfiguring settings and restoring data separately, a bare metal recovery does all of this in a single operation from one image. A process that could take a skilled technician a full day to complete manually can be executed in a few hours with BMR, significantly compressing recovery time.

Faster recovery time objectives
Traditional rebuild approaches, starting from a bare OS install and working forward, routinely take 12 to 24 hours or longer for complex systems. According to a 2023 Backblaze survey of IT professionals, image-based recoveries like those used in BMR averaged two to four hours compared to 12 to 24 hours for file-based methods. That gap has a direct dollar value: Splunk research found that 40% of enterprises experienced unplanned system downtime in the past year, with per-incident costs that quickly reach into the hundreds of thousands.

Hardware flexibility
BMR is not limited to restoring to the same machine. With hardware-independent restore technology, a system image can be deployed to new, replacement or dissimilar hardware, including physical-to-virtual (P2V) and virtual-to-physical (V2P) migrations. This means hardware failure does not have to wait on sourcing identical replacement equipment before recovery can begin.

Exact system state recovery
A bare metal restore brings back the system exactly as it was at the time of the backup, including OS configuration, installed software, drivers, preferences and data. There is no configuration drift, no missing application settings, and no need to remember how the system was set up. This is particularly valuable for complex environments where the configuration took significant time and expertise to establish.

Clean ransomware recovery
When ransomware has compromised a system, the safest recovery path is wiping the affected machine entirely and restoring from a known-good backup image. BMR handles this cleanly, bypassing the encrypted environment and restoring to a pre-attack state without any residual risk of reinfection from the compromised OS.

Simplified disaster recovery planning
Because BMR can restore to any compatible hardware, disaster recovery plans do not need to account for exact hardware replacement. Recovery site infrastructure, cloud environments or spare hardware pools can all serve as BMR targets, making DR planning more flexible and more cost-effective.

Bare metal recovery vs. system state recovery

System state recovery and bare metal recovery are both used to restore systems after failures, but they address different scenarios and different levels of damage. Understanding the difference determines which one to reach for in a given situation.

System state recovery restores a specific subset of OS components to a previous working configuration. On a Windows system, this typically includes the registry, boot files, the COM+ class registration database and (on domain controllers) Active Directory and the SYSVOL folder. System state recovery is appropriate when the operating system is still installed and the hardware is still functional, but corruption, a failed update or a bad configuration change has caused the system to behave incorrectly or fail to boot properly. The system state backup is smaller and faster to restore because it only captures these critical components, not the entire disk.

Bare metal recovery restores the entire system: OS, applications, drivers, configurations and data, to a clean hardware target. It is the right choice when the hardware has failed, when the machine needs to be rebuilt on new or replacement hardware, or when the damage is so extensive that a system state restore would be insufficient.

A useful way to think about the distinction: system state recovery fixes a broken car by replacing the key components that stopped working, while bare metal recovery rebuilds the car from scratch on a new frame. If the frame itself is intact and the problem is specific and contained, a system state recovery is faster and simpler. If the frame is gone, only a bare metal recovery gets you back on the road.

There is one important overlap worth noting: a bare metal recovery automatically includes a system state recovery as part of the process. Restoring the full system image inherently restores the system state components within it. The reverse is not true.

When to use bare metal recovery

Bare metal recovery is the appropriate response to any scenario where the operating system and application environment cannot be recovered by simpler means. The most common situations include the following.

Hardware failure
When a machine’s CPU, motherboard, storage controller or other hardware components fail beyond repair, the only recovery path is restoring to new or replacement hardware. Bare metal recovery handles this by deploying the full system image to the replacement machine. This applies equally to servers, workstations and laptops. Given that hardware components fail without warning and identical replacement hardware may not be available, the ability to restore to dissimilar hardware is particularly important in this scenario.

Ransomware attack
Ransomware that has encrypted a system’s OS and application files typically renders normal recovery methods ineffective. A bare metal recovery restores the affected machine to a clean, pre-attack state from a known-good backup image, bypassing the encrypted environment entirely. The critical requirement in this scenario is having a backup that predates the infection, stored in an immutable location that the ransomware could not reach.

Catastrophic software corruption
Severe OS corruption, a failed OS upgrade, or a catastrophically misconfigured system that cannot boot may not be repairable through system state recovery or standard troubleshooting. Bare metal recovery restores a known-good system state without requiring the underlying OS to be functional first.

System migration and hardware refresh
Bare metal recovery is also used proactively, not just reactively, for migrating workloads to new hardware. Rather than rebuilding a system from scratch by reinstalling the OS and applications, IT teams can restore a bare metal image to the new hardware, significantly reducing migration time and the risk of configuration drift between the old and new environments. This applies to both server refreshes and workstation fleet replacements.

Disaster recovery
When a site-level event destroys physical infrastructure, bare metal recovery is the mechanism for rebuilding systems at a recovery site or in the cloud from stored images. This use case is closely tied to broader server disaster recovery planning, where BMR is one component of a documented recovery process.

Bare metal recovery to dissimilar hardware

One of the most important practical considerations in bare metal recovery is whether the target hardware matches the source hardware.

When restoring to identical hardware, the process is relatively straightforward. The system image was captured on the same hardware configuration, so the drivers and hardware abstraction layer settings in the restored OS match what the machine expects to find.

When restoring to dissimilar hardware (different CPU, motherboard, storage controller or network adapter), the restored OS may fail to boot because the drivers embedded in the image do not match the new hardware. This is a common failure point in bare metal recovery, particularly when the original hardware is no longer available and replacement machines have a different specification.

Purpose-built backup solutions address this through hardware-independent restore technology, sometimes called universal restore. This capability injects or replaces the critical boot drivers during the recovery process to match the target hardware’s configuration, allowing the restored OS to boot correctly even when the hardware specification has changed.

Unitrends Unified Bare Metal Recovery, accessible through the Kaseya helpdesk, supports both same-hardware and dissimilar-hardware restores, including physical-to-virtual (P2V) and virtual-to-physical (V2P) migrations. Datto SIRIS BMR supports recovery to replacement hardware, with guidance on driver requirements available in the Datto product documentation.

A few practical points on dissimilar hardware restores worth knowing:

• UEFI and BIOS boot modes cannot be mixed. Both the source and target machines must use the same boot mode.
• Storage controllers in hardware RAID configurations need to be set up on the target machine before the BMR process starts, otherwise the recovery environment may not recognize the drives.
• Non-standard drivers (RAID cards, specialized network adapters) may need to be injected separately or sourced before the restore begins.
• The target hardware must have sufficient storage capacity to receive the partition layout of the original system.

How bare metal recovery is used with Kaseya

Kaseya offers bare metal recovery as part of both its MSP-facing and direct business backup solutions.

For MSPs, Datto SIRIS includes bare metal recovery as one of its recovery paths alongside instant virtualization and file-level restore. When recovery time is the priority, Instant Virtualization is typically the faster first response: the protected system boots as a VM in seconds to minutes, keeping the client operational while hardware is sourced and replaced. Bare metal recovery then handles the restore to the replacement physical machine, with Fast Failback resyncing any data changes that occurred during the virtualization period back to the recovered system. This two-stage approach is particularly practical when the RTO is tight and waiting on a full BMR restore is not an option.

For businesses managing their own infrastructure, Unitrends provides two BMR options depending on the backup method used. Hot Bare Metal (also called image-based BMR) captures a full system image while the machine is running, with no downtime required for the backup itself. Unified Bare Metal Recovery (formerly Integrated Bare Metal Recovery) allows recovery from a standard file-level backup using an ISO provided by the Unitrends appliance, eliminating the need to maintain a separate bare metal backup schedule for every protected system. Both paths are available through the Unitrends backup appliance and Unitrends enterprise backup software.

Together, these options mean that whether you are an MSP recovering a client system overnight or an IT team rebuilding infrastructure after a hardware failure, the recovery path is documented, tested and built into the same platform managing the rest of your backup operations.