Skip to content
WindowsHow-To Published Updated 5 min readViews unavailable

Robocopy Copy Plans: Preflight, Verify, and Avoid Surprise Deletions

Stage Windows file copies with a non-writing Robocopy preflight, bounded retries, logs, and explicit verification - and understand the deletion risk in /MIR.

robocopy is dependable at copying large directory trees, but its options define whether a run merely lists work, copies files, retries for a long time, or deletes destination data. Treat a copy as a change operation: confirm both paths, preview the plan, write a log, and verify the result before an application or user switches to the destination.

This procedure stages a copy into a new destination and leaves deletion out of the plan. It is suitable for rehearsal and many one-way migrations; it is not a substitute for an application-consistent backup or a file-system snapshot when the source is changing during the copy.

Confirm the paths and make a non-writing preflight

Choose an existing source, an already-created empty staging directory, and a log path whose parent exists outside both trees. Confirm both roots and the log location before running anything; use a fully qualified destination rather than relying on the current working directory. In PowerShell:

$Source = 'C:\Data'
$Stage  = 'D:\Stage\Data'
$Log    = 'C:\Logs\Data-preflight.log'

robocopy $Source $Stage /E /COPY:DAT /DCOPY:DA /R:0 /W:0 /L /X /FP /BYTES "/LOG:$Log"
$rc = $LASTEXITCODE
"Robocopy preflight status: $rc"

/L lists the candidate work only: Microsoft documents that it does not copy, delete, or timestamp files. /X reports extra destination entries. This is a non-copying preflight, not a zero-write command: /LOG creates or overwrites the named log. Keep that file outside the source and destination, protect it as operational data, and review the full-path list and summary before removing /L.

The preview is a snapshot, not a lock. If files or directories change after preflight, the real run can see different inputs. For important migrations, quiesce writers or use a consistent snapshot/export, run the preview close to the change window, and retain an independent backup.

Copy to staging with bounded retries

For a staged one-way copy that includes empty subdirectories but does not mirror or purge the destination, use:

$Log = 'C:\Logs\Data-copy.log'
robocopy $Source $Stage /E /COPY:DAT /DCOPY:DA /R:2 /W:1 "/LOG:$Log"
$rc = $LASTEXITCODE
if ($rc -ge 8) {
    throw "Robocopy reported at least one copy failure (exit code $rc). Inspect $Log before cutover."
}
"Robocopy status: $rc; inspect the log and verify the staged data before use."

/E copies subdirectories, including empty ones. /COPY:DAT requests file data, attributes, and timestamps; /DCOPY:DA requests directory data and attributes. These choices do not copy file ACLs, owner information, or auditing information. If the migration requires security metadata, design and test those flags with the destination’s domain and access-control model instead of adding /COPYALL by habit.

The explicit /R:2 /W:1 avoids Robocopy’s documented default of one million retries with a 30-second wait. Choose retry behavior for the actual failure mode; a short retry budget makes an incomplete copy visible instead of leaving an unattended process waiting for hours.

Interpret the exit code, log, and verification separately

Robocopy’s return values are not a simple zero/nonzero success test. Microsoft documents values 0 through 7 as combinations of copied files, extra destination files, and mismatches without a copy failure; a value of 8 or greater means at least one failure occurred. A code below 8 is therefore not, by itself, proof that the destination is complete or content-identical. Review the summary and every mismatch, skipped, or failed item in the log.

Next compare the expected file set and sizes. For high-value files, verify content independently with SHA-256:

$relativePath = 'Reports\quarterly.dat'
$sourceHash = Get-FileHash -Algorithm SHA256 -LiteralPath (Join-Path $Source $relativePath)
$stageHash  = Get-FileHash -Algorithm SHA256 -LiteralPath (Join-Path $Stage  $relativePath)
$sourceHash.Hash -eq $stageHash.Hash

The final expression should be True. A small sample verifies only those files; a full migration that requires content-level assurance needs a hash manifest for the full expected set, plus a comparison against the destination. Hashing every file adds I/O, so plan it for the available window. If files remain open or changing, a matching hash for one file does not establish that the whole tree represents one consistent application state.

Keep the Robocopy log, source and destination roots, exit code, timestamp, and verification results together. Before cutover, have the owner validate representative application files and permissions from the intended client context. Do not delete the source merely because the copy process returned a code below 8.

Why /MIR needs a separate decision

/MIR is equivalent to /E plus /PURGE: it copies the tree and deletes destination files or directories that are absent from the source. Microsoft also documents that /MIR can overwrite the destination directory’s security settings. A path typo or an unexpectedly incomplete source can therefore turn a valid destination into a deletion target.

Do not add /MIR to the staged-copy example. If a mirror is genuinely required, use a dedicated destination whose contents are disposable or independently recoverable. Run the same planned arguments with /L, inspect every path and extra item, confirm source and destination roots with a second person for high-impact data, and only then schedule the real operation with a fresh log and backup. /L prevents the preview from deleting data; removing /L from a /MIR command restores the destructive behavior. A dry run is not authorization to delete.

Avoid /MOV and /MOVE during a first-pass migration as well: Microsoft defines them as deleting source files or directories after copying. Use a separate, approved cleanup phase after destination verification and application cutover.

Operational checklist

  • Confirm that source and destination are the intended roots and that the destination is not the only copy of important data.
  • Preview with /L, capture /X extras, and review full paths in the log.
  • Use /E for a non-purging copy, explicit copy metadata, and a finite retry policy.
  • Interpret Robocopy’s documented exit code, inspect the log, and verify file contents at the assurance level the migration requires.
  • Keep the source until the owner approves cutover and the rollback window closes.
  • Treat /MIR, /PURGE, /MOV, and /MOVE as separate deletion decisions, not harmless “sync” conveniences.

Related:

Sources:

Comments