Anchoring / Snapshot Questions

Am in the process of installing FDISR. Just finished reading the holy moly killer thread, "New FD-ISR user - Can anyone help with these questions?". The core of that thread should definitely be edited into a sticky. Great stuff guys.
https://www.wilderssecurity.com/showthread.php?t=180395

1. I get that the secondary (rollback snapshot) or archived (save my bacon) snapshot is there for me to recover back to in case of problems.

2. But am I right that the primary Snapshot isn't as static as the word implies. If I install new software, is that new software now a part of my primary snapshot which boots up each day? (Not using the freeze function.)
-------------------------------------------------------------------------
3. Anchoring. I get the concept. I get that My Documents needs to be anchored.

4. I use Firefox/Thunderbird and a few other programs with profiles located elsewhere. Do you guys Anchor the entire Mozilla and Thunderbird folders in the Docs & Settings/(USER NAME)/application data/ section where the profiles are housed?

5. How does this impact extensions?

6. Now it's been many years since I even saw a virus come near my system, but if I got one, and the entire Thunderbird profile is Anchored, would the clean up process be to run a scan, wipe the virus, then boot back to the secondary or archived snapshot to ensure no vestiges of the virus were still around?

7. And the same thing for any programs (Quickbooks, SONAR - music recording, Outlook Express)?

8. What about Skype? MS Word or Excel Templates? Do you guys anchor those or just rely on your major ATI or SP backup image to retrieve that?

Thanks,
Bruce

 

Hmmm...(sound of rethinking)...okay. I really appreciate the guidance to not mess with forces beyond my scope. With that in mind, I also want to make sure that I am not leaving gaping holes in my approach. So, a few scenarios.

Scenario 1:
A. I don't anchor.
B. I back up ATI full image/differentials nightly. Online backup to Mozy daily.
C. Mid-day, I play with new software and it screws up my system.
D. Boot back to secondary or retrieve my primary archive.

Result: I will only have data that existed when I last created my snapshots. Subsequent data will be gone and possibly only partially retrievable depending on when my ATI or Mozy backups ran. Possible loss of data. Yes?

Question: So how would you have handled this scenario differently? I can see in controlled circumstance when knowing that new software might adversely affect things, I could update my secondary and/or archived snapshot. Then the data would be there. But not all circumstances are so neatly controlled.
----------------------------------------------------------------------

Scenario 2:
A. I do anchor, but only My Documents.
B. Mid-day, I play with new software and it screws up my system.
C. Boot back to secondary or retrieve my primary archive.

Result: I will have a clean functioning system, with My Documents intact.

Question: If not anchoring Thunderbird/Firefox and the other programs with emails, financial data (Quickbooks), wouldn't all the email and other data added to or changed on my system be lost?


Thanks,
Bruce

 

You already moved the profiles folder of Firefox/Thunderbird, which means that you don't have to anchor anything anymore.

The Mozilla website warns you that extensions might not work properly anymore when you move the profiles folder to another location and this has NOTHING to do with FDISR. Some extensions are not programmed for this folder move and that's why they don't work properly anymore.
http://kb.mozillazine.org/Moving_your_profile_folder

If you didn't have problems with extensions until now, they will work even when FDISR is installed.

 

Sorry Erik, I think my communication wasn't clear. I haven't moved the folders. I was just referring to where they are located --- their natural residence.

With that in mind, can you take another look at my original and follow up post and provide some feedback?

Thanks!
Bruce

 

You have only 3 choices and you have to choose one of them :
1. You don't anchor anything and that means that EVERYTHING is stored in your snapshots and archives, including your data.

2. You anchor folders or files of your choice and that means that every anchored folder or file will be excluded from your snapshots and archives.
Anchored folders and files are shared by all snapshots, because FDISR ignores them.

3. You store all your personal files on another partition and then you don't need any anchoring. In that case you have to create a partition first.

 

This scenario is always a risk, with any backup regime there is always a blindspot between one backup and another.
As you have already worked out, you can anchor certain folders, the other way around this is to separate your system from your data, as in partitioning, I have done this with my desktop, where permitting you can now move certain folders to the data partition, these will not be re-written when an snapshot recovery takes place, as fdisr is only designed to look after the system partition. Bit of a pain, if your system is already up and running and you only use a single partition.

Yes, anything on the system partition that is not anchored will be rolled back to your last saved state.
Using this sort of program takes a little learning, as it usually makes you think in different ways that you have up to now, but it is worth it. All it takes is a little planning, once you understand the principle of how the program works.

 

I'm getting it. It seems that most of you aren't anchoring. I recognize that's a personal decision, but wondering who out there IS anchoring and how those that do anchor handle Thunderbird, Firefox, etc.

 

On an unpartitioned drive I anchor My Documents, as it contains lot of music files some video and quite a few photos

 

As long you do NOT use a frozen snapshot, anchoring has only one practical purpose : reducing the size of your snapshots and archives.

If I would have everything on one partition, then I would store all my personal data under "My Documents" and anchor the folder "My Documents".

If my system = 10gb and my data = 50gb and
1. I don't anchor "My Documents", my snapshot = 60gb and its archive too + all other snapshots.
2. I do anchor "My Documents", my snapshot = 10gb and its archive too + all other snapshots.
I wouldn't anchor Firefox or Thunderbird, unless its volume was very big, which is not the case, but my data volume is about 50gb at this moment.
If I had 3 snapshots without anchoring, than my volume[C:] = 3 x 60gb instead of 3 x 10 gb, quite a difference.
Of course I don't need anchoring because I have my data on another harddisk/partition[D:].

 

My wife is an amateur photographer and has nearly 12gb, yes, that's gb, of photos in her photo folder. She uses anchoring only for that one folder, but we also back up her pictures on two other hard drives "just in case". Obviously, we save a ton of space in the other Snapshots by using Anchoring (yes, we have two licenses for FD).

Acadia

 

My wife is a photographer as well = 8GB
I'm a musician = 17GB
My wife is a writer / interviewer (audio interviews) = 15GB
Total in My Documents = 50GB

Entire C: drive = 80GB

of which
Program Files = 8GB
Windows Folder = 4GB

Another 18GB of whatever

 

All graphical files take alot of space compared with text-files, but the worst graphical files are movies. I had one time the complete movie "The Godfather II" (180m) on my harddisk = 11+gb and that is just one movie.
Since then I decided not to keep movies on harddisk anymore, I just burn them on DVD, which is an infinite storage media.

 

Good grief, good thing Seagate is coming out with a 5tb hard drive by 2011, with 37.5tb soon to follow:

http://www.pcworld.com/article/id,137480-page,5-c,futuretechnology/article.html

Acadia

 

Yes, you'd have to anchor that, a copy / update would take all night otherwise

 

That is the main reason, why I don't want to backup my data with FDISR, although it is technical possible when you don't anchor.
You can't backup your data with FDISR forever, unless you have a rather small and stable data volume.
So I didn't like the idea to ground my data backup on an ISR-software and how many ISR-softwares allow you to do this ? I know only one : FDISR, which has no future anymore.

AFAIK most ISR-softwares recommend you to separate your data from your system. They don't say it always frankly, but users usually do it to make it more liveable. I know that ShadowUser recommended this separation already in their manual 3 years ago. Returnil provides a Virtual Partition to store your data. DeepFreeze users have usually also a separate data partition to make it more comfortable.
Switching constantly between frozen and unfrozen mode to store your data isn't practical either and unfrozen mode means vulnerable for infections.

Anchoring objects in a FDISR-snapshot reduces the volume, but anchoring objects in a frozen FDISR-snapshot doesn't only reduce the volume, it makes the frozen snapshot also vulnerable for infections. That's why I didn't do any anchoring in my frozen on-line snapshot.

The bottom line is that IMO system/data separation and using ISR-softwares go together, because freezing data is a nightmare. My setup allows at least to use any ISR-software.

 

Jumped in and did my anchoring of "My Documents", my Cakewalk (.wav) music recording data file, and the mail sections (not the programs) in Thunderbird. At the end of the process there was a message that said there were 4 errors but I can't seem to find what those errors are and am concerned about the validity of the snapshot. Here is the log below...any guidance?

Oops, retrieving log, be right back...

 

Here's the log...

11/4/2007 08:37 0010 FirstDefense-ISR Service [Professional Version 3.21.205] started
11/4/2007 08:37 0084 Pre-boot Check ... OK
11/4/2007 19:50 5060 Anchored files set to: C:\Cakewalk Projects;C:\Documents and Settings\Bruce & Simone\Application Data\Thunderbird\Profiles\7mxly7bz.default\mail.mailboxname1.com;C:\Documents and Settings\Bruce & Simone\Application Data\Thunderbird\Profiles\d50jurj2.mailboxname2.com\Mail\mail.mailboxname2.com;C:\Documents and Settings\Bruce & Simone\Application Data\Thunderbird\Profiles\ekan1u26.mailboxname3.com\mail.dc3.adelphia.net;C:\Documents and Settings\Bruce & Simone\Application Data\Thunderbird\Profiles\fnqb7y98.mailboxname4\Mail\mail.mailboxname4.com;C:\Documents and Settings\Bruce & Simone\My Documents
11/4/2007 19:52 4510 Snapshot "Secondary Snapshot" created
11/4/2007 19:52 1000 CMD> COPY "Primary Snapshot" "Secondary Snapshot" EXCLUDE *.tmp
11/4/2007 19:52 1032 Copying snapshot "Primary Snapshot" to "Secondary Snapshot"
11/4/2007 20:46 1035 Copied 17.58 Gb (77538 files, 8296 dirs); Errors 4; 53 minutes
11/5/2007 09:08 0010 FirstDefense-ISR Service [Professional Version 3.21.205] started
11/5/2007 09:08 0084 Pre-boot Check ... OK

 

On my version, cause I'm not usre who makes yours, and if it's the same, next to this line....

there would be a blue cross, if you click tha it will open the detail log.....now you might want to grab a cup of coffee a this point, cause its a long log, but you can go through it and find the exact errors. Which may give you an idea if it's important or not.
Alternatively ensure all your security software is off / disabled and run another copy / update and see if there are still errors.

 

I'll check the detail log now, and no, I didn't have anything turned off. Is that a standard thing to do for snapshots? AV, Spysweeper, Comodo Firewall

 

comodo has a setting under Security > Advanced > Miscellaneous "Protect own registry keys and files from unauthorised modifications" this setting is checked by default and if not unchecked I believe it can cause copy errors. Also AV's and AS's if active can interfere, Avast! causes errors on mine if I don't disable it.

 

I'm still searching the detailed log for the errors. It's not so easy as there are so many files in programs with the word error, that it's taking a while to locate, e.g.,
11/4/2007 20:22:31 Adding "Program Files\Intuit\QuickBooks 2007\Components\Help\HS_Cat_ERROR.html" to "Secondary Snapshot"

After I get back from working with clients, I'll run a new snapshot with all security turned off and see what happens!

Thanks for the input,
Bruce