How do I find where the image is being stored?

I'm helping out some people that just started a small business. They have two Gateway MX644 laptops and each has an external USB HD attached. A friend of theirs set up a system that I think is much more complex than necessary.

I checked their startup logs and there is 25 pages of items in that log. Tons of .dll's , 11 pages worth. Aprox 25 normal startup enteries.

They have Acronis True Image, both v. 3.3 and v.9. ??

The only reason I can think this happened is that this guy wrongly set up Acronis to backup, or image to the startup folder. Can someone tell me where I need to go within the program to see where the backups are being stored.

According to the normal startup items, there does not appear to be any virus or malware running. The have Norton a/v running.

 

Sounds like both systems need some good "houskeeping" procedures run on them first - Registry cleaners, Cookies, Temp, and Temporary Internet Files cleaning.

If you're sure one of the TI versions is 3.3, that is probably only good for the garbage bin now. Version 9 is okay if it is the latest build.

The previous person probably put the backup files in the Secure Zone - a foolhardy place to keep them in todays times. I wouldn't use Norton if they paid me - not when there are free programs that are just as good out there.

 

Unless as Ralphie says they're in a SZ, you'll be looking for files with a tib ending.

Colin

 

Thxs for the responses. It's at least giving me a start point. I'll search for the tib extension to see what I find. Yes, a major cleanup and reordering of everything is in order. This is the 'New Orleans' of computer catastrophe's. Agree totally with the Norton thing and will be switching them to AVG asap. But I like to understand how a system is set up before I start mucking around.

I'd say there is a strong possibility he has used the Secure Zone as I tried to access the USB backup drives and couldn't see a thing on them. Will have to check the size next time. I call these kind of helpful friends Hot Rodders. They have to tweak and change everything but can't explain to anyone else why or where. He basically had a blank checkbook when setting everything up.

Below is a small sample of the hundreds of items in the startup log. Note, they dont' even have a registry path. Any ideas?

$ncsp$ $ncsp$.inf NT AUTHORITY\SYSTEM Startup
$ncsp$ $ncsp$.inf .DEFAULT Startup
$winnt$ $winnt$.inf NT AUTHORITY\SYSTEM Startup
$winnt$ $winnt$.inf .DEFAULT Startup

12520437 12520437.cpx NT AUTHORITY\SYSTEM Startup
12520437 12520437.cpx .DEFAULT Startup
12520850 12520850.cpx NT AUTHORITY\SYSTEM Startup
12520850 12520850.cpx .DEFAULT Startup

16-aol 16-aol.ico NT AUTHORITY\SYSTEM Startup
16-aol 16-aol.ico .DEFAULT Startup
32-aol 32-aol.ico NT AUTHORITY\SYSTEM Startup
32-aol 32-aol.ico .DEFAULT Startup

AUTOEXEC autoexec.nt NT AUTHORITY\SYSTEM Startup
AUTOEXEC autoexec.nt .DEFAULT Startup

ddPort addport.ini NT AUTHORITY\SYSTEM Startup
AddPort addport.ini .DEFAULT Startup


BCMWLCPL bcmwlcpl.cpl NT AUTHORITY\SYSTEM Startup
BCMWLCPL bcmwlcpl.cpl .DEFAULT Startup


freecell freecell.exe NT AUTHORITY\SYSTEM Startup
freecell freecell.exe .DEFAULT Startup

help help.exe NT AUTHORITY\SYSTEM Startup
help help.exe .DEFAULT Startup

TweakUI tweakui.exe NT AUTHORITY\SYSTEM Startup
TweakUI tweakui.exe .DEFAULT Startup

c_037 c_037.nls NT AUTHORITY\SYSTEM Startup
c_037 c_037.nls .DEFAULT Startup
c_10000 c_10000.nls NT AUTHORITY\SYSTEM Startup
c_10000 c_10000.nls .DEFAULT Startup
c_10006 c_10006.nls NT AUTHORITY\SYSTEM Startup
c_10006 c_10006.nls .DEFAULT Startup
c_10007 c_10007.nls NT AUTHORITY\SYSTEM Startup
c_10007 c_10007.nls .DEFAULT Startup
c_10010 c_10010.nls NT AUTHORITY\SYSTEM Startup