How do you optimize 'data anchoring'?

Discussion in 'FirstDefense-ISR Forum' started by wilbertnl, May 6, 2006.

Thread Status:
Not open for further replies.
  1. wilbertnl

    wilbertnl Registered Member

    Joined:
    Dec 29, 2004
    Posts:
    1,850
    Location:
    Tulsa, Oklahoma
    Hello All,

    I'm in my 14-day trial period for ISR and I need some input.

    I've been using Acronis True Image and Farstone Restore-it for a long time. Both solutions are excellent and at the same time have minor disadvantages.
    For now that means that I have to change my system concept from disk imaging to snapshots.

    So, in order to use disk imaging the easy way, I had a system partition and a data partition, restoring the system partition took a few minutes. (I'm shocked to see how ISR changes to a different snapshot instantly!)

    For the 14-day IRS evaluation, I reinstalled windows and removed the data partition: C:\ is the one and only for system and data.

    I'm trying to develop a strategy for the data anchors and I found out that the amount of folders/files to anchor is limited.
    Which means that I need to create a folder which functions as data container, similar to the previous data partition.
    So, I would create a c:\userdata folder which holds %username%\desktop, %username%\my documents, %username%\favorites and %username%\mozilla or %username%\outlook, like I had on the previous data partition.

    Do I understand this right? Or do you guys have different strategies?
    Also: When data is added or changed in the anchors, this doesn't affect the snapshots themselves? An archive of some snapshot is stored without the anchors? right?

    Also, it seems that a snapshot isn't static like a diskimage.
    With reloading a diskimage I knew to which status I would revert beforehand. It took actually some time to create a diskimage with all the settings to my liking.
    So, I get the understanding that I need to archive a snapshot to approach the same idea of securing a certain status.
    I understand that a frozen snapshot means: "do whatever you like until the next reboot", is that correct? (Very nice when I want to test software)

    With disk images, I usally had an image of OEM, aka "right after install, with updated drivers and hotfixes", and then another (incremental) image of a complete system with additional installed software. I wished that I was able to create am image tree: OEM with more than one incremental derivate:
    OEM - 1. betatest trendmicro internet security
    --- - 2. betatest NOD32 antivirus
    This seems exactly possible with ISR, right?

    Anyway, I'm struggling with the transit of concept from image to snapshot and I appreciate some help in this area.

    ISR looks very promissing.
    Thank you,
    Wilbert
     
  2. Rilla927

    Rilla927 Registered Member

    Joined:
    May 12, 2005
    Posts:
    1,710
    Is this true that Data Anchoring is limited? If so, how limited?

    Thanks

    Rilla927
     
  3. Peter2150

    Peter2150 Global Moderator

    Joined:
    Sep 20, 2003
    Posts:
    17,041
    I honestly don't know, but then I've only tried anchoring My Doc's Doing much beyond that would become self defeating.
     
  4. wilbertnl

    wilbertnl Registered Member

    Joined:
    Dec 29, 2004
    Posts:
    1,850
    Location:
    Tulsa, Oklahoma
    "Anchored file list too long":
     

    Attached Files:

    Last edited by a moderator: May 7, 2006
  5. Peter2150

    Peter2150 Global Moderator

    Joined:
    Sep 20, 2003
    Posts:
    17,041
    Off the top of my head I see stuff I wouldn't recommend anchoring. Like the desktop, and also Local settings application stuff. That is stuff that can be easily messed up and you want it protected by FDISR. I would suggest just anchoring My Documents. That should cover all your data.

    The other stuff can be kept current by refreshing the other snapshot(S)

    Pete
     
  6. Peter2150

    Peter2150 Global Moderator

    Joined:
    Sep 20, 2003
    Posts:
    17,041
    Another factor on Data anchoring is for "Backup" purposes I also keep an archive with no data anchoring. Having a long list would make that a nightmare. Adding and removing my documents is easy

    Pete
     
  7. wilbertnl

    wilbertnl Registered Member

    Joined:
    Dec 29, 2004
    Posts:
    1,850
    Location:
    Tulsa, Oklahoma
    Yes, the desktop might hold shortcuts that are invalid in some snapshots, but it may also hold complete files. Especially my wife has a habit of storing anything she downloads visible on her desktop. :)

    The local settings path points to the Outlook Express storage.
    I rearranged the data that I want to anchor as subfolders of an 'anchor folder', like c:\anchor\%username%\Outlook Express, c:\anchor\%username\my documents.
    Pretty much the same as maintaining a separate data partition, would you not agree?
     
  8. wilbertnl

    wilbertnl Registered Member

    Joined:
    Dec 29, 2004
    Posts:
    1,850
    Location:
    Tulsa, Oklahoma
    I'm still confused in this area, I don't understand how I can update my current snapshot.
    I open the copy/update wizard, select as source the current snapshot, but then I can only select other snapshots or 'create new snapshot'.
    I don't see where the update function is?
     
  9. Acadia

    Acadia Registered Member

    Joined:
    Sep 8, 2002
    Posts:
    4,048
    Location:
    SouthCentral PA
    How could you, and why would you want to update your current Snapshot; it is always up-to-date.

    Acadia
     
    Last edited: May 7, 2006
  10. Peter2150

    Peter2150 Global Moderator

    Joined:
    Sep 20, 2003
    Posts:
    17,041
    Hi Wilbertnl

    At this point the best recommendation is to read, reread, and reread again, the help documentation. This is essential for this program.

    Pete
     
  11. Acadia

    Acadia Registered Member

    Joined:
    Sep 8, 2002
    Posts:
    4,048
    Location:
    SouthCentral PA
    I would do as Peter recommended; I had to read all three, the User Guide, the FAQs, and the Knowledgebase, each several times before I began to understand this program. It is only complicated because it is so flexible. :cool:

    Acadia
     
  12. crofttk

    crofttk Registered Member

    Joined:
    May 15, 2004
    Posts:
    1,976
    Location:
    Eastern PA, USA
    Yep, you current snapshot is THE ONE YOU'RE OPERATING FROM, and you are "updating" it by writing changes to your hard drive.

    Now, you CAN, update your "secondary" snapshot whenever you feel the need or on a schedule. "Secondary" snapshot here is simply a point in time copy of your primary (or "operating") snapshot.

    Also, regarding anchoring any of the stuff besides your "My Documents" structure, like desktop, local settings, application data, etc., remeMber that alot of these files are linked to your installed programs and the registry (even contains some of the registry !) and you could have big problems reverting to a snapshot for which these folders and their data is not in synch with the instaqll programs and entire registry of that particular snapshot. Itwould be a risky and complex strategy, IMO (humble or not, don't matter -- it's my opinion good or bad:p ).

    Plus, consider that if you start developing separate snapshots for sandboxing or experimenting with new/beta programs you don't want to affect your baseline system, you have to think carefully through the usefulness, or NOT, of data anchoring in that situation -- I'm sure Peter2150 can tell you plenty about that.

    And, YES, read the documentation, take a break, and then keep coming back and reading it again until it sinks in -- that's what it took for me.
     
  13. wilbertnl

    wilbertnl Registered Member

    Joined:
    Dec 29, 2004
    Posts:
    1,850
    Location:
    Tulsa, Oklahoma
    Well, I have been reading the manual and FAQ's, but sometimes I miss an example to clarify the information.

    I do appreciate the concerns about my choice of anchored data, but to me this is the same choice I made when I used disk imaging of the system partition. I'm aware of possible flaws, but it works for me. I make sure that I only anchor data, and not settings.

    Crofttk:
    You say that I update my current snapshot when I make changes to my system. But when I boot from the snapshot, it all reverts to the original status of when the snapshot whas created, right?

    With diskimaging I made changes and was able to update any selected image.
    [for example load OEM image, update drivers, save OEM image]
    It seems to work different with ISR.
     
  14. Peter2150

    Peter2150 Global Moderator

    Joined:
    Sep 20, 2003
    Posts:
    17,041
    No. Assuming you aren't messing with Freezing, and I wouldn't recommend that at first, when you leave a snapshot, it remains as you left it. The snapshot you are working in is just like your system without FDISR. You came back and it is like when you left it. Only when you do a copy from one to another is one changed. Note if you are comparing to Rollback, they are totally different.

    Pete
     
  15. Acadia

    Acadia Registered Member

    Joined:
    Sep 8, 2002
    Posts:
    4,048
    Location:
    SouthCentral PA
    Good point, they operate in totally different ways. There is NEVER any need to update the Snapshot that you are in; if you leave it to go to another Snapshot, then come back to it, you will find it exactly as you left it.

    Acadia
     
  16. Leapfrog Software

    Leapfrog Software Leapfrog Management

    Joined:
    Jan 25, 2006
    Posts:
    251
    Location:
    Northern Nevada, USA
    Greetings All,

    Ok, let me put in my 2 cents, this time as only a user of the ISR technology.

    I personally Data Anchor "My Documents" and "Favorites". Lots of folks also add "Desktop" as well, but I like to keep all documents, projects, etc. in a common folder like "My Documents". I even redirect Outlook and Outlook Express+address book to a sub-folder in “My Documents”. If I need to backup my data or transfer it to another system, it just makes it easier to drag and drop one or two folders. As the years pass and CRS (Can't Remember *Stuff*) sets in, one can benefit from all the organization one can get!

    I have found the more folks Data Anchor, the more they forget what they have anchored over the long run, and/or boot to a snapshot that had something Data Anchored deep in Local Settings, Application Data, etc. that *Bill G* did not want one to mess with, and now holds the possibility of being out of sync with the registry or another application.

    Now, from a LSI perspective, the number of Data Anchored folder is limited because of the above reason as well. During our intensive and initial beta testing, folks found all sorts of ways to Data Anchoring and make our task of troubleshooting, shall we say, interesting.

    I hope this helps. If you need more information on a few best practices of Data Anchoring, check out this application note.
     
    Last edited: May 7, 2006
  17. wilbertnl

    wilbertnl Registered Member

    Joined:
    Dec 29, 2004
    Posts:
    1,850
    Location:
    Tulsa, Oklahoma
    With documents and data I'm compulsively organized. [team workers praise me for that].
    With disk imaging I had my stuff on a data partition, and I got the feeling that data anchoring would eliminate the need to create a container for important data.

    I see your point that you don't want to anchor stuff in hidden folders with names that start with '{' and end with '}'. But fact is that to prepare my data for anchoring, I still find myself editing registry entries to change pointers on the disk. For each and every user on my computer.

    Hmm...

    I would rather see it like this: "Anchor 'c:\documents and settings' except for registry files and other settings data"
     
  18. TonyW

    TonyW Registered Member

    Joined:
    Oct 12, 2005
    Posts:
    2,634
    Location:
    UK
    I anchor 'My Documents' and the OE email storage.
     
  19. Acadia

    Acadia Registered Member

    Joined:
    Sep 8, 2002
    Posts:
    4,048
    Location:
    SouthCentral PA
    Has anyone ever given any thought as to how easy it might be for a computer virus to spread to other Snapshots if the virus contaminates something that is Anchored? This is the only reason that I do not use the Data Anchor feature. Is this a reasonable fear or not?

    Acadia
     
  20. wilbertnl

    wilbertnl Registered Member

    Joined:
    Dec 29, 2004
    Posts:
    1,850
    Location:
    Tulsa, Oklahoma
    What you sayo_O
    You don't use the most powerful feature of this software?

    No, I think this is very close to mysophobia.
    You copy updated address books and other documents to each snapshot, then?
    Or do you have a secret second partition, which in effect has the same potential of hazard.
     
  21. Peter2150

    Peter2150 Global Moderator

    Joined:
    Sep 20, 2003
    Posts:
    17,041
    Hi Acadia

    Depends on what you Anchor. I doubt many virii attack what is in my doc's

    Pete
     
  22. Acadia

    Acadia Registered Member

    Joined:
    Sep 8, 2002
    Posts:
    4,048
    Location:
    SouthCentral PA
    Peter, I'm mostly thinking email. I've only ever contracted three viruses in my 7 years of computing, and all three of them came thru the email. Also, using MacroExpress I've created macros that enable me to quickly copy files (My Docs, Email, Favs) from a Snapshot over to my other hard drive in case I want to put those files into another Snapshot. I just have this thing of wanting to keep my Snapshots COMPLETELY separated from one another, no "connection" between them.

    Acadia
     
    Last edited: May 8, 2006
  23. wilbertnl

    wilbertnl Registered Member

    Joined:
    Dec 29, 2004
    Posts:
    1,850
    Location:
    Tulsa, Oklahoma
    Acadia,

    I can see how you don't need your Office documents when you are in your gaming snapshot.

    But when I beta-test antivirus software then I need this software in a separate snapshot and at the same time I need to be be able to use my computer without data limitations.
    In my lifetime of computer experience I have been infected only once, and a couple virii have been caught in time.

    When your concern is getting infected through e-mail, would it help you if you don't use a local email client anymore, but only webmail?
    I'm using an IMAP mailserver, which means that the mail is never downloaded to my computer, until I open it. And as long as I'm able to connect to the IMAP server, I'm able to read my e-mail wherever I am.
     
  24. Acadia

    Acadia Registered Member

    Joined:
    Sep 8, 2002
    Posts:
    4,048
    Location:
    SouthCentral PA
    I don't do any gaming.

    Webmail is NOT an acceptable solution, I do not want my important email with sensitive information stored on someone else's server; I only use webmail for unimportant stuff and as spam traps.

    Acadia
     
  25. Peter2150

    Peter2150 Global Moderator

    Joined:
    Sep 20, 2003
    Posts:
    17,041
    Hi Acadia

    You make a point, but I've nailed that coffin pretty tightly with other security software. For example zip files are tightly controlled in that 1) only explorer is allowed to start winzip, so for example Outlook which can conceiveably start winzip can't without specific permission. Also anything run automatically from with in winzip has to be started by winzip. I have it set so it has to ask before it can do that. Also KAV 6.0's PDM module monitors office macro's for behavior so anything in a doc file that's bad gets flagged. Plus I do a full AV scan of my system every night. Only takes a few minutes.

    Agreed if I wasn't doing all this I might go the same way you are.

    Pete
     
Thread Status:
Not open for further replies.