Anchoring / Snapshot Questions

Discussion in 'FirstDefense-ISR Forum' started by Chamlin, Nov 2, 2007.

Thread Status:
Not open for further replies.
  1. Chamlin

    Chamlin Registered Member

    Joined:
    Aug 8, 2006
    Posts:
    449
    Am in the process of installing FDISR. Just finished reading the holy moly killer thread, "New FD-ISR user - Can anyone help with these questions?". The core of that thread should definitely be edited into a sticky. Great stuff guys.
    https://www.wilderssecurity.com/showthread.php?t=180395

    1. I get that the secondary (rollback snapshot) or archived (save my bacon) snapshot is there for me to recover back to in case of problems.

    2. But am I right that the primary Snapshot isn't as static as the word implies. If I install new software, is that new software now a part of my primary snapshot which boots up each day? (Not using the freeze function.)
    -------------------------------------------------------------------------
    3. Anchoring. I get the concept. I get that My Documents needs to be anchored.

    4. I use Firefox/Thunderbird and a few other programs with profiles located elsewhere. Do you guys Anchor the entire Mozilla and Thunderbird folders in the Docs & Settings/(USER NAME)/application data/ section where the profiles are housed?

    5. How does this impact extensions?

    6. Now it's been many years since I even saw a virus come near my system, but if I got one, and the entire Thunderbird profile is Anchored, would the clean up process be to run a scan, wipe the virus, then boot back to the secondary or archived snapshot to ensure no vestiges of the virus were still around?

    7. And the same thing for any programs (Quickbooks, SONAR - music recording, Outlook Express)?

    8. What about Skype? MS Word or Excel Templates? Do you guys anchor those or just rely on your major ATI or SP backup image to retrieve that?

    Thanks,
    Bruce
     
  2. Peter2150

    Peter2150 Global Moderator

    Joined:
    Sep 20, 2003
    Posts:
    17,057
    True. Just bare in mind you can boot to snapshots, but not archives.

    When you are working in any snapshot, it's just like working on any computer. Add software and it's there. Take some away and it 's gone. Same with data.
    -------------------------------------------------------------------------
    Depends. When I maintained two working snapshots, I did anchor my documents. Now that I don't maintain two working snapshots, but a Primary working snapshot, a primary archive, and a stripped secondary snapshot that is just for recovery booting, I don't anchor. I want my archive to reflect everything.[/QUOTE]

    I would strongly urge you NOT to anchor any of these things. Some of these Doc's and Settings area's are tied to software and the system. You'll get yourself into all kinds of trouble.

    If it is in My Documents and you anchor it fine. As a beginner, I would totally recommend you not anchor anything else. Honestly in the beginning, I'd skip anchoring until you get a feel for the program and how you are going to use it.

    Pete
     
  3. Chamlin

    Chamlin Registered Member

    Joined:
    Aug 8, 2006
    Posts:
    449
    Hmmm...(sound of rethinking)...okay. I really appreciate the guidance to not mess with forces beyond my scope. With that in mind, I also want to make sure that I am not leaving gaping holes in my approach. So, a few scenarios.

    Scenario 1:
    A. I don't anchor.
    B. I back up ATI full image/differentials nightly. Online backup to Mozy daily.
    C. Mid-day, I play with new software and it screws up my system.
    D. Boot back to secondary or retrieve my primary archive.

    Result: I will only have data that existed when I last created my snapshots. Subsequent data will be gone and possibly only partially retrievable depending on when my ATI or Mozy backups ran. Possible loss of data. Yes?

    Question: So how would you have handled this scenario differently? I can see in controlled circumstance when knowing that new software might adversely affect things, I could update my secondary and/or archived snapshot. Then the data would be there. But not all circumstances are so neatly controlled.
    ----------------------------------------------------------------------

    Scenario 2:
    A. I do anchor, but only My Documents.
    B. Mid-day, I play with new software and it screws up my system.
    C. Boot back to secondary or retrieve my primary archive.

    Result: I will have a clean functioning system, with My Documents intact.

    Question: If not anchoring Thunderbird/Firefox and the other programs with emails, financial data (Quickbooks), wouldn't all the email and other data added to or changed on my system be lost?


    Thanks,
    Bruce
     
  4. ErikAlbert

    ErikAlbert Registered Member

    Joined:
    Jun 16, 2005
    Posts:
    9,455
    You already moved the profiles folder of Firefox/Thunderbird, which means that you don't have to anchor anything anymore.
    The Mozilla website warns you that extensions might not work properly anymore when you move the profiles folder to another location and this has NOTHING to do with FDISR. Some extensions are not programmed for this folder move and that's why they don't work properly anymore.
    http://kb.mozillazine.org/Moving_your_profile_folder

    If you didn't have problems with extensions until now, they will work even when FDISR is installed.
     
    Last edited: Nov 3, 2007
  5. Chamlin

    Chamlin Registered Member

    Joined:
    Aug 8, 2006
    Posts:
    449
    Sorry Erik, I think my communication wasn't clear. I haven't moved the folders. I was just referring to where they are located --- their natural residence.

    With that in mind, can you take another look at my original and follow up post and provide some feedback?

    Thanks!
    Bruce
     
  6. ErikAlbert

    ErikAlbert Registered Member

    Joined:
    Jun 16, 2005
    Posts:
    9,455
    You have only 3 choices and you have to choose one of them :
    1. You don't anchor anything and that means that EVERYTHING is stored in your snapshots and archives, including your data.

    2. You anchor folders or files of your choice and that means that every anchored folder or file will be excluded from your snapshots and archives.
    Anchored folders and files are shared by all snapshots, because FDISR ignores them.

    3. You store all your personal files on another partition and then you don't need any anchoring. In that case you have to create a partition first.
     
  7. stapp

    stapp Global Moderator

    Joined:
    Jan 12, 2006
    Posts:
    7,309
    Location:
    England
    Chamlin it is difficult at first to get your head around the FD-ISR concept. Aside from Peter and Eric's very knowledgable answers I'll just add this,


    I have a look at some software online and decide I want to try it. I update (or copy, it means the same) my secondary snapshot from the primary one so they are both the same.

    In my primary snapshot I install Lelesoftware (could be anything) and have a play with it , it either is not to my liking or causes big problems, I want rid of it.

    I boot into my secondary snapshot and update the primary form the secondary so they are both the same.

    When I boot back to the primary snapshot...the software I tried is gone...it was never there.
     
  8. tradetime

    tradetime Registered Member

    Joined:
    Oct 24, 2006
    Posts:
    1,000
    Location:
    UK
    This scenario is always a risk, with any backup regime there is always a blindspot between one backup and another.
    As you have already worked out, you can anchor certain folders, the other way around this is to separate your system from your data, as in partitioning, I have done this with my desktop, where permitting you can now move certain folders to the data partition, these will not be re-written when an snapshot recovery takes place, as fdisr is only designed to look after the system partition. Bit of a pain, if your system is already up and running and you only use a single partition.
    Yes, anything on the system partition that is not anchored will be rolled back to your last saved state.
    Using this sort of program takes a little learning, as it usually makes you think in different ways that you have up to now, but it is worth it. All it takes is a little planning, once you understand the principle of how the program works.
     
  9. Peter2150

    Peter2150 Global Moderator

    Joined:
    Sep 20, 2003
    Posts:
    17,057
    In your scenario 1. Here is what I would do.

    Before installing the new software, do a copy/update of your primary to your secondary. Now both are the same. Now install new software in primary.

    Then at this point there are a couple of additonal options.

    1. Test software. IF immediately you know you don't like it, then get rid of it by bootng to secondary and refresh primary with copy/update.

    2. If you know immediately you want to keep it, then refresh your secondary with a copy/update from primary

    3. Your not sure, and you don't want a data loss.

    a) Do step 1. and reinstall later and play some more.
    b) Create a third snapshot, leaving the software in it, and remove it from primary. Then play in third snapshot. At this point your data in third snapshot will start to get out dated. If you don't want to keep new program, just delete third snapshot. If you do want it, then just install it again in your up to date primary and again delete third snapshot.

    Confusing at first yes, but think it thru and it will make sense.

    Pete
     
  10. Chamlin

    Chamlin Registered Member

    Joined:
    Aug 8, 2006
    Posts:
    449
    I'm getting it. It seems that most of you aren't anchoring. I recognize that's a personal decision, but wondering who out there IS anchoring and how those that do anchor handle Thunderbird, Firefox, etc.
     
  11. tradetime

    tradetime Registered Member

    Joined:
    Oct 24, 2006
    Posts:
    1,000
    Location:
    UK
    On an unpartitioned drive I anchor My Documents, as it contains lot of music files some video and quite a few photos
     
  12. ErikAlbert

    ErikAlbert Registered Member

    Joined:
    Jun 16, 2005
    Posts:
    9,455
    As long you do NOT use a frozen snapshot, anchoring has only one practical purpose : reducing the size of your snapshots and archives.

    If I would have everything on one partition, then I would store all my personal data under "My Documents" and anchor the folder "My Documents".

    If my system = 10gb and my data = 50gb and
    1. I don't anchor "My Documents", my snapshot = 60gb and its archive too + all other snapshots.
    2. I do anchor "My Documents", my snapshot = 10gb and its archive too + all other snapshots.
    I wouldn't anchor Firefox or Thunderbird, unless its volume was very big, which is not the case, but my data volume is about 50gb at this moment.
    If I had 3 snapshots without anchoring, than my volume[C:] = 3 x 60gb instead of 3 x 10 gb, quite a difference.
    Of course I don't need anchoring because I have my data on another harddisk/partition[D:]. :)
     
    Last edited: Nov 3, 2007
  13. Acadia

    Acadia Registered Member

    Joined:
    Sep 8, 2002
    Posts:
    4,048
    Location:
    SouthCentral PA
    My wife is an amateur photographer and has nearly 12gb, yes, that's gb, of photos in her photo folder. She uses anchoring only for that one folder, but we also back up her pictures on two other hard drives "just in case". Obviously, we save a ton of space in the other Snapshots by using Anchoring (yes, we have two licenses for FD).

    Acadia
     
  14. Chamlin

    Chamlin Registered Member

    Joined:
    Aug 8, 2006
    Posts:
    449
    My wife is a photographer as well = 8GB
    I'm a musician = 17GB
    My wife is a writer / interviewer (audio interviews) = 15GB
    Total in My Documents = 50GB

    Entire C: drive = 80GB

    of which
    Program Files = 8GB
    Windows Folder = 4GB

    Another 18GB of whatevero_O
     
  15. Peter2150

    Peter2150 Global Moderator

    Joined:
    Sep 20, 2003
    Posts:
    17,057
    Cough! Okay, I would keep all that in My Documents and anchor it. I would also keep another copy off your main drive, just in case.
     
  16. ErikAlbert

    ErikAlbert Registered Member

    Joined:
    Jun 16, 2005
    Posts:
    9,455
    All graphical files take alot of space compared with text-files, but the worst graphical files are movies. I had one time the complete movie "The Godfather II" (180m) on my harddisk = 11+gb and that is just one movie.
    Since then I decided not to keep movies on harddisk anymore, I just burn them on DVD, which is an infinite storage media.
     
  17. Acadia

    Acadia Registered Member

    Joined:
    Sep 8, 2002
    Posts:
    4,048
    Location:
    SouthCentral PA
  18. tradetime

    tradetime Registered Member

    Joined:
    Oct 24, 2006
    Posts:
    1,000
    Location:
    UK
    Yes, you'd have to anchor that, a copy / update would take all night otherwise ;)
     
  19. ErikAlbert

    ErikAlbert Registered Member

    Joined:
    Jun 16, 2005
    Posts:
    9,455
    That is the main reason, why I don't want to backup my data with FDISR, although it is technical possible when you don't anchor.
    You can't backup your data with FDISR forever, unless you have a rather small and stable data volume.
    So I didn't like the idea to ground my data backup on an ISR-software and how many ISR-softwares allow you to do this ? I know only one : FDISR, which has no future anymore.

    AFAIK most ISR-softwares recommend you to separate your data from your system. They don't say it always frankly, but users usually do it to make it more liveable. I know that ShadowUser recommended this separation already in their manual 3 years ago. Returnil provides a Virtual Partition to store your data. DeepFreeze users have usually also a separate data partition to make it more comfortable.
    Switching constantly between frozen and unfrozen mode to store your data isn't practical either and unfrozen mode means vulnerable for infections.

    Anchoring objects in a FDISR-snapshot reduces the volume, but anchoring objects in a frozen FDISR-snapshot doesn't only reduce the volume, it makes the frozen snapshot also vulnerable for infections. That's why I didn't do any anchoring in my frozen on-line snapshot.

    The bottom line is that IMO system/data separation and using ISR-softwares go together, because freezing data is a nightmare. My setup allows at least to use any ISR-software. :)
     
    Last edited: Nov 4, 2007
  20. Chamlin

    Chamlin Registered Member

    Joined:
    Aug 8, 2006
    Posts:
    449
    Jumped in and did my anchoring of "My Documents", my Cakewalk (.wav) music recording data file, and the mail sections (not the programs) in Thunderbird. At the end of the process there was a message that said there were 4 errors but I can't seem to find what those errors are and am concerned about the validity of the snapshot. Here is the log below...any guidance?

    Oops, retrieving log, be right back...
     
  21. Chamlin

    Chamlin Registered Member

    Joined:
    Aug 8, 2006
    Posts:
    449
    Here's the log...

    11/4/2007 08:37 0010 FirstDefense-ISR Service [Professional Version 3.21.205] started
    11/4/2007 08:37 0084 Pre-boot Check ... OK
    11/4/2007 19:50 5060 Anchored files set to: C:\Cakewalk Projects;C:\Documents and Settings\Bruce & Simone\Application Data\Thunderbird\Profiles\7mxly7bz.default\mail.mailboxname1.com;C:\Documents and Settings\Bruce & Simone\Application Data\Thunderbird\Profiles\d50jurj2.mailboxname2.com\Mail\mail.mailboxname2.com;C:\Documents and Settings\Bruce & Simone\Application Data\Thunderbird\Profiles\ekan1u26.mailboxname3.com\mail.dc3.adelphia.net;C:\Documents and Settings\Bruce & Simone\Application Data\Thunderbird\Profiles\fnqb7y98.mailboxname4\Mail\mail.mailboxname4.com;C:\Documents and Settings\Bruce & Simone\My Documents
    11/4/2007 19:52 4510 Snapshot "Secondary Snapshot" created
    11/4/2007 19:52 1000 CMD> COPY "Primary Snapshot" "Secondary Snapshot" EXCLUDE *.tmp
    11/4/2007 19:52 1032 Copying snapshot "Primary Snapshot" to "Secondary Snapshot"
    11/4/2007 20:46 1035 Copied 17.58 Gb (77538 files, 8296 dirs); Errors 4; 53 minutes
    11/5/2007 09:08 0010 FirstDefense-ISR Service [Professional Version 3.21.205] started
    11/5/2007 09:08 0084 Pre-boot Check ... OK
     
  22. tradetime

    tradetime Registered Member

    Joined:
    Oct 24, 2006
    Posts:
    1,000
    Location:
    UK
    On my version, cause I'm not usre who makes yours, and if it's the same, next to this line....
    there would be a blue cross, if you click tha it will open the detail log.....now you might want to grab a cup of coffee a this point, cause its a long log, but you can go through it and find the exact errors. Which may give you an idea if it's important or not.
    Alternatively ensure all your security software is off / disabled and run another copy / update and see if there are still errors.
     
  23. Chamlin

    Chamlin Registered Member

    Joined:
    Aug 8, 2006
    Posts:
    449
    I'll check the detail log now, and no, I didn't have anything turned off. Is that a standard thing to do for snapshots? AV, Spysweeper, Comodo Firewallo_O
     
  24. tradetime

    tradetime Registered Member

    Joined:
    Oct 24, 2006
    Posts:
    1,000
    Location:
    UK
    comodo has a setting under Security > Advanced > Miscellaneous "Protect own registry keys and files from unauthorised modifications" this setting is checked by default and if not unchecked I believe it can cause copy errors. Also AV's and AS's if active can interfere, Avast! causes errors on mine if I don't disable it.
     
  25. Chamlin

    Chamlin Registered Member

    Joined:
    Aug 8, 2006
    Posts:
    449
    I'm still searching the detailed log for the errors. It's not so easy as there are so many files in programs with the word error, that it's taking a while to locate, e.g.,
    11/4/2007 20:22:31 Adding "Program Files\Intuit\QuickBooks 2007\Components\Help\HS_Cat_ERROR.html" to "Secondary Snapshot"

    After I get back from working with clients, I'll run a new snapshot with all security turned off and see what happens!

    Thanks for the input,
    Bruce
     
Thread Status:
Not open for further replies.