Software for worst case scenario...

[innerpeace]

excluding complete HDD failure. I've finally made my first images of my internal HDD and saved them to my ext. HDD. I've been using Seagate DiscWizard's boot cd to make my images. I also have created a D: partition on my internal HDD and moved the My Documents folder there. I have backups for it too.

What other bootable software do I need if my system partition becomes corrupted? Privacy is not a concern but a clean starting point is needed I guess (for efficiency?). What do I need to do to fix or recreate the C: partition easily? Do I need a zero tool? Would it leave the D: partition untouched? I don't want to build a cd, but an all in one would work. I need to keep it simple for now :).

Also, if you would, could you please briefly explain what the suggested tools do and why they are needed? I'm still unfamiliar with the inner workings of the MBR, partition tables, etc.

Thanks,
innerpeace

[Hairy Coo]

Howdy Innerpeace-

Congratulations-a good result.

You dont really need any other software immediately,as Seagate-Acronis Recovery CD should do it all-restore the image, including the partitions and the MBR exactly as you backed up the original image-it will do the lot.

Nothing else is required.

I have uninstalled ATI,but I think it will also backup more than one partition as long as its on the same disk-therefore you are also able to backup My Documents with the other partition-you can test this-otherwise back them up separately onto the external HDD.

Using the Seagate-TrueImage Linux based recovery disk is fine ,but sometimes when there are a lot of incremental images and I mean a lot,then restore using it can be slow.

A WinPE Bart disk using Mustang's TrueImage PlugIn plus any other items(you will have to find out which version of True Image corresponds to Seagate-he will tell you) is quicker-but that can wait!

All I would do at the moment is make a test restore and work out a safe backup schedule-I used to do a full backup weekly and two incrementals daily.

If you want top security,use Karens Replicator to back up your data between the Seagate backups, when you think there may be a risk.

Edit; From memory , you have Paragon Hard Disk-if you can make a recovery disk from that it could be handy.

[lucas1985]

Consider a CD toolkit like UBCD, UBCD4Win, BartPE, etc, loaded with imaging software, partitioning software, zeroing software, file explorer, malware scanning software, CD/DVD burning, etc.

[EASTER]

Excellent idea.

Just curious innerpeace and/or others who also have INSTALLED this Seagate's DiscWizard by chance. I did to one of my drives and experienced a BSOD at almost every boot up but the next try always went OK. I just suspected it was a minor glitch of Acronis :dry: and uninstalled it in favor also of the Boot CD. I understand it's an older version and likely why it was allowed to go free by some agreement with Seagate. Still a little curious if this was an isolated incident or something more wide-spread with it when installed.

Thanks EASTER

[lucas1985]

There're various reports of incompatibilities between the snapshot drivers of ATI and other imaging tools. It's better to have installed only one VSS provider and if you want/need/like to image with another application, do it outside of Windows (DOS, BartPE, Linux, etc)

[innerpeace]

-{ Quote: "Howdy Innerpeace-

Congratulations-a good result.

You dont really need any other software immediately,as Seagate-Acronis Recovery CD should do it all-restore the image, including the partitions and the MBR exactly as you backed up the original image-it will do the lot.

Nothing else is required." }-
G'day Hairy Coo and thanks. I had good help along the way :thumb:.

I currently have all 4 services/processes disabled for DiscWizard and I have only used the boot cd for 3 backups. I like DiscWizard, but it's huge and currently unneeded at the moment. I should have created the boot cd before I reinstalled XP so I wouldn't have it on my drive. Live and learn I guess.

I'm not sure if mine included BartPE or not when I made the cd. I think I ticked all the options. I know the cd has the option for safe and full versions or whatever. I just booted to it and I see it has a wipe feature. The help file was confusing. I'm not sure if I can wipe a single partition or if it wipes the whole drive.

I also have Karen's Replicator, but haven't installed it. I normally run everything manually and my system is fairly stagnant. It's also a pain to shut down my computer then turn on my ext. HDD then boot back up to image anything. I may decide to try the USB, but I know it will be slower. This isn't a mission critical computer, but it's getting close to being setup that way. Now, if I just had a mission :P.

Is it best to format or zero/wipe a partition before restoring an image? I'm more concerned with speed afterwards rather than privacy.

lucas1985
I was looking at UBCD4Win when you posted that LOL. It was an old bookmark that I never gave it a second thought because I have never had a XP install disk until now. I also thought there was another boot cd of some kind, but I failed to bookmark it. Any ideas?

Easter
Greetings! According to my notes, I installed DiscWizard after a fresh install of XP and installing my drivers. I then created my boot cd and rebooted to it (boot cd) and created my 1st image to my ext. HDD. No BSOD's so far.

To the best of my knowledge, everything I have is still using vssvc.exe and I just checked and the service is set to manual. I also have never used DiscWizard from the gui (other than looking around). The last month, especially from the 17th to the 22nd has been a huge learning experience for me ;).

Thanks to all,
innerpeace

[Hairy Coo]

Innerpeace,

"Is it best to format or zero/wipe a partition before restoring an image? I'm more concerned with speed afterwards rather than privacy."

Absolutely not-this would destroy the whole concept of backups,let Seagate do all the work for you.

In a real disaster,I have used several of these disaster Cds,but found them of limited use-usually what helps is if you can get the partition working again by formatting and being recognised,then you can restore.

One which has a lot of apps included is Ultimate Boot Disk download here (http://www.ultimatebootcd.com/).

Get an XPE one that can incorporate the Mustang ATI plug I was talking about,that may be a real help.

[ErikAlbert]

In case the Recovery CD of ShadowProtect fails, probably caused by a destructive malware, I have :

1. Partition Magic to repair partitions, but that isn't enough for me.

2. Zero tool from the manufacturer (Western Digital in my case), which is specialized in zeroing my kind of HDD's.
I will always use this tool first for two reasons :

1. Zeroing your HDD doesn't require any knowledge, while repairing partitions might require more knowledge.

2. After a destructive malware attack, I like to zero my HDD completely to remove any trace of the malware and the damage it caused.
If I was a malware-writer, I would do at least 2 things or more, not just one thing. I first would infect the computer with a sensational visual effect to distract the user, like a magician does. Then I would do one or more sneaky infections to create an aftermath or permanent bad situation.
After all you don't really know what a malware program REALLY does, until you have the source code.
If I have to believe the Rustock C,D,E and hardware virus ghost stories, even a zero tool won't help. :)

[Peter2150]

-{ Quote: "

In a real disaster,I have used several of these disaster Cds,but found them of limited use-usually what helps is if you can get the partition working again by formatting and being recognised,then you can restore.

" }-

Shouldn't need to do that with SP. As part of any restore, I always have SP delete the volume first. Then first thing is create a new partition based on what is in the image. Then restore.

[zapjb]

Sorry. This topic is mislabeled. Calling it, "Software for worst case scenario...". Then excluding complete HDD failure is foolish.

[Hairy Coo]

-{ Quote: "Shouldn't need to do that with SP. As part of any restore, I always have SP delete the volume first. Then first thing is create a new partition based on what is in the image. Then restore." }-


Great tip-that Disk Map is a real help.

I presume its for malware issues ,otherwise whats the advantage?

[Peter2150]

-{ Quote: "Great tip-that Disk Map is a real help.

I presume its for malware issues ,otherwise whats the advantage?" }-

You know, I am not sure, I just started doing it out of habit. I guess I started when I was doing the testing, and was restoring the image of the machine, after having messed it up pretty badly. Just became a habit.

Pete

[innerpeace]

-{ Quote: "Sorry. This topic is mislabeled. Calling it, "Software for worst case scenario...". Then excluding complete HDD failure is foolish." }-
Actually, I have to disagree. I'm prepared for my internal disks hardware failure by having an image of it on my external HDD. My worst case scenario is not being able to get that image restored. I'm looking for the knowledge and tools to get my system up and running again :).

[trjam]

-{ Quote: "In case the Recovery CD of ShadowProtect fails, probably caused by a destructive malware, I have :

1. Partition Magic to repair partitions, but that isn't enough for me.

2. Zero tool from the manufacturer (Western Digital in my case), which is specialized in zeroing my kind of HDD's.
I will always use this tool first for two reasons :

1. Zeroing your HDD doesn't require any knowledge, while repairing partitions might require more knowledge.

2. After a destructive malware attack, I like to zero my HDD completely to remove any trace of the malware and the damage it caused.
If I was a malware-writer, I would do at least 2 things or more, not just one thing. I first would infect the computer with a sensational visual effect to distract the user, like a magician does. Then I would do one or more sneaky infections to create an aftermath or permanent bad situation.
After all you don't really know what a malware program REALLY does, until you have the source code.
If I have to believe the Rustock C,D,E and hardware virus ghost stories, even a zero tool won't help. :)" }-
I am curious Erik, what do you do in case of a fire.;)

[zapjb]

-{ Quote: "Actually, I have to disagree. I'm prepared for my internal disks hardware failure by having an image of it on my external HDD. My worst case scenario is not being able to get that image restored. I'm looking for the knowledge and tools to get my system up and running again :)." }-
Then I applaud you for taking complete HDD failure into account. :thumb:

[innerpeace]

Thanks everyone! I'll have a look at the tools you've mentioned and see what I can come up with. If something goes wrong and I can't restore, then I need to wipe/zero the disk and re-partition. I'll also have another look at Seatools, I screwed up the first time making the disk and it's not bootable :-[ . It's able to perform a low level format (zero) a drive also.

innerpeace

[farmerlee]

I actually use two imaging programs (trueimage and driveimage) and backup to two different types of media just in case one should fail to work. I also have paragon hard disk manager in case i need to mess around with my hard drive.

[ErikAlbert]

-{ Quote: "I am curious Erik, what do you do in case of a fire.;)" }-
You must have missed Peter's experience with the KillDisk Trojan.
His Recovery CD didn't work anymore. How are you going to restore your computer ?

[innerpeace]

-{ Quote: "I actually use two imaging programs (trueimage and driveimage) and backup to two different types of media just in case one should fail to work. I also have paragon hard disk manager in case i need to mess around with my hard drive." }-
I also have a free Paragon DM to install. I may do that just to make the boot cd, but it's not a full version. You also have reminded me that I need to make images to my dvd's. I've been at this 10 days and I think before it's all over, I will end up reinstalling everything again :blink:.

FWIW, I restored an image today with the DiscWizard (ATI) boot cd and it worked perfectly.

[EASTER]

-{ Quote: "In case the Recovery CD of ShadowProtect fails, probably caused by a destructive malware, I have :

1. Partition Magic to repair partitions, but that isn't enough for me.

2. Zero tool from the manufacturer (Western Digital in my case), which is specialized in zeroing my kind of HDD's.
I will always use this tool first for two reasons :

1. Zeroing your HDD doesn't require any knowledge, while repairing partitions might require more knowledge.

2. After a destructive malware attack, I like to zero my HDD completely to remove any trace of the malware and the damage it caused.
If I was a malware-writer, I would do at least 2 things or more, not just one thing. I first would infect the computer with a sensational visual effect to distract the user, like a magician does. Then I would do one or more sneaky infections to create an aftermath or permanent bad situation.
After all you don't really know what a malware program REALLY does, until you have the source code.
If I have to believe the Rustock C,D,E and hardware virus ghost stories, even a zero tool won't help. :)" }-

The most mystical approach of all would be to install a time-bomb virus, set to go off at a predetermined date/time and wreak maximum destruction on the level of KillDisk Trojan, and i venture plenty of users been caught with their britches down (defense) enough that they try not to miss a beat from the latest developments in curtailing such code intrusions.

I can't believe however that a software can literally SCRATCH a HD disk surface in the same fashion as a Plastic cd/DVD disk, and that's exactly whats being implied here with some of these killdisk and other viruses.

Perhaps someone like to expound further on just what the steps are that make viruses like KillDisk so unique except for the fact that they disrupt the sector code in partition table and perhaps even MBR which BOTH should be quite repairable with correct tools to undo such manipulation.

But then again i don't discount a single possibility when it comes to these electrical devices, i just lost 2 perfectly good partitions that seem to mysteriously drop right out of view of what i thought were the best tools on the market at relocating missing partitions for whatever reasons, but they came up empty, and wouldn't you just know it, a total 100% freeware program TESTDISK run from a bootdisk named PartedMagic did not only locate them both but identified correctly all corresponding data/label/sizes etc and even re-wrote them back to disc for plain viewing and 100% ACCESSING in complete working order again, even for Windows Disk Management.

[Hairy Coo]

-{ Quote: "I also have a free Paragon DM to install. I may do that just to make the boot cd, but it's not a full version" }-

In any case this little beauty is an alternative to Paragon-download the ISO file and burn.

Its a find by Easter called Parted Magic-Download (http://www.partedmagic.com/)

[Peter2150]

Killdisk can't physically scratch the disk. What it does is corrupt the partition table. This prevents imaging recovery programs from restoring the images because they can't access the partition table that is there. Any utility that can delete the partition, solves the problem.

[innerpeace]

-{ Quote: "In any case this little beauty is an alternative to Paragon-download the ISO file and burn.

Its a find by Easter called Parted Magic-Download (http://www.partedmagic.com/)" }-
I'm glad you and Easter mentioned Parted Magic. I saw it as a plug-in for UBCD4win and was wondering about it. I will give it a shot.

Thanks,
innerpeace

[Mrkvonic]

-{ Quote: "Killdisk can't physically scratch the disk. What it does is corrupt the partition table. This prevents imaging recovery programs from restoring the images because they can't access the partition table that is there. Any utility that can delete the partition, solves the problem." }-

Hello,
You meant restore or delete?
Mrk

[Peter2150]

-{ Quote: "Hello,
You meant restore or delete?
Mrk" }-

I guess either. I deleted the partition with Diskpart on the XP CD. Once deleted the ShadowProtect could restore the image. Didn't try restoring the partition.

Main point is if the partition table is corrupt, and that messes up any recovery program that tries to read it first.

Pete

[EASTER]

-{ Quote: "I guess either. I deleted the partition with Diskpart on the XP CD. Once deleted the ShadowProtect could restore the image. Didn't try restoring the partition.

Main point is if the partition table is corrupt, and that messes up any recovery program that tries to read it first.

Pete" }-

Then if a user happens to have a program that saves the PT to say a floppy, then in theory that would be your solution if i read this right. Some thierd party tools allow to make a save of these in event they are needed for whatever reason, and if KillDisk corrupts the PT, a simple overwrite of the corrupt PT with this type app should recover the PT. Does this seem acceptable?

[Peter2150]

-{ Quote: "Then if a user happens to have a program that saves the PT to say a floppy, then in theory that would be your solution if i read this right. Some thierd party tools allow to make a save of these in event they are needed for whatever reason, and if KillDisk corrupts the PT, a simple overwrite of the corrupt PT with this type app should recover the PT. Does this seem acceptable?" }-

In theory yes. But since I've not tested I can say for sure.

[EASTER]

-{ Quote: "In theory yes. But since I've not tested I can say for sure." }-

In a pinch theres usually no time to dig up such utilities when there is a dependable alternative. But this is something worth investigating myself.

As soon as i can clear my table agenda i'll test this on one of my spare HD's with KillDisk to see exactly which utilities, including some free CD partition undelete apps, partition editors, to determine if they can really be of any use in such a sequence.

Regards EASTER