File and Drive Recovery Techniques

1. File and Drive Recovery Techniques Tech Coordinator Feast 2005 Galesburg Session Terry Sullivan (tsulliva@comwares.net) Technology Director - Shiloh CUSD#1 & Edgar CUD#6

2. Approaches • Proactive Approach – aka backups • Basic recovery techniques • Starter ideas • Microsoft tools • 3rd party tools • Commercial software • OpenSource resources • Recovery Services

3. Best Defense • Good offense • Backup • Recycle Bin – ONLY local drives • MS - VSC (Volume Shadow Copy) • Copy/Paste or command line “xcopy” • CD burner • Onetouch Backup – external drive • Ntbackup • Syncback • Cobian Backup

4. Enabling Quotas • Network shares can be enabled to manage quotas for users • Must be an NTFS volume • Enable quota and set default space limits • Will show remaining space when user checks properties on their network shares.

5. SERVER NTFS Properties

6. Quota Configuration

7. Windows Shadow Copy • Will allow save copies of files and version for document stored on network shares • User can recover their own lost file or deleted/corrupted version • Works automatically with XP and need client for 2000 or older. • The Previous Versions client is a Windows Installer file named TWCLI32.MSI. It is located in the %SystemRoot%\System32\Clients folder

8. Shadow Copy Configuration • VSC • Snapshots 100 Meg default 2/day • Client givesaccess lostor corrupt files • Rt Click on File OR Folder

9. Xcopy – copies files and directory tree XCOPY source [destination] [/A | /M] [/D[:date]] [/P] [/S [/E]] [/V] [/W] [/C] [/I] [/Q] [/F] [/L] [/G] [/H] [/R] [/T] [/U] [/K] [/N] [/O] [/X] [/Y] [/-Y] [/Z] [/EXCLUDE:file1[+file2][+file3]...] • source Specifies the file(s) to copy. • destination Specifies the location and/or name of new files. • /A Copies only files with the archive attribute set, doesn't change the attribute. • /M Copies only files with the archive attribute set, turns off the archive attribute. • /D:m-d-y Copies files changed on or after the specified date. If no date is given, copies only those files whose source time is newer than the destination time. • /P Prompts you before creating each destination file. • /S Copies directories and subdirectories except empty ones. • /E Copies directories and subdirectories, including empty ones. • /V Verifies each new file. • /W Prompts you to press a key before copying. • /C Continues copying even if errors occur. • /Q Does not display file names while copying. • /F Displays full source and destination file names while copying. • /L Displays files that would be copied. • /G Allows the copying of encrypted files to destination that doe not support encryption. • /H Copies hidden and system files also. • /R Overwrites read-only files. • /U Copies only files that already exist in destination. • /K Copies attributes. Normal Xcopy will reset read-only attributes. • /N Copies using the generated short names. • /O Copies file ownership and ACL information. • /X Copies file audit settings (implies /O). • /Y Suppresses prompting to confirm you want to overwrite an existing destination file. • /-Y Causes prompting to confirm you want to overwrite an existing destination file. • /Z Copies networked files in restartable mode.

10. Removable and Network Drives • Zip Drives • CD-RW & DVD+RW • Often include backup software • May need DLA support and UDF format • External USB and FireWire Hard Drives • Network storage • NASLite • Tape Drives –NEED proprietary application interface

11. NASLite • http://www.serverelements.com/naslite.php

12. NTBackup • Creates a scheduled job file list in: • Documents and Settings\%username%\Local Settings\Application Data\Microsoft\Windows NT\NT Backup\data\jobname.bks • Creates a scheduled task – which can be edited • Either command line schtasks OR Accessories-System Tools-Scheduled Tasks • Tasks are stored in the ‘C:\windows\Tasks’ folder

13. NTBackup • Create a .bks text file with folders to be backed up one per line • Example: • Text File “daily.bks” with one directory per line • D:\Pub\ • E:\users\ • SystemState • Can schedule with NTBackup • with AT scheduler OR • With schtasks (new XP scheduler service) • Can run from NTBackup OR command line

14. NTBackup Command Line • Cmd or Batch File version • ====================================== • start /wait rsm.exe refresh /lf"Your_Library_Name" • ntbackup.exe backup "daily.bks“ /v:no /r:no /rs:no /hc:on /m normal /j "daily.job" /l:f /p “4mm DDS" /um • ====================================== • /lf – logical media friendly name • /v – verify • /r – restrict to owner or administrator group • /rs – removable storage database • /hc – hardware compression • /m – type normal, incremental, … • /j – job name • /l – type of log file • /p – media pool • /um – magic bullet – will find 1st media of defined type, format, and use.

15. Cobian Backup - 6 • Features • Cobian Backup is a multi-threaded program that can be used to schedule and backup your files and directories from their original location to other directories/drives in the same computer or other computer in your network. FTP backup is also supported in both directions (download and upload). • Cobian Backup exists in two different versions: application and service. The program uses very few resources and can be running on the background on your system, checking your backup schedule and executing your backups when necessary. Cobian Backup is not an usual backup application: it only copies your files and folders in original or compressed mode to other destination, creating a security copy as a result. So Cobian Backup can be better described as a "Scheduler for security copies". • Cobian Backup supports several methods of compression and strong encryption

16. Cobian Backup - 6 • http://www.educ.umu.se/~cobian/cobianbackup.htm

17. Cobian Installation

18. Application or Service

19. Cobian Interface – build “tasks”

20. SyncBack- by 2BrightSparks • SyncBack Freeware v3.2.8 [1.72 MB]SyncBack is our freeware program that helps you easily backup or synchronize your files to: the same drive; a different drive or medium (CDRW, CompactFlash, etc); an FTP server; a Network; or a Zip archive.The' No Install' version above will not install files into Windows or other PC system directories: there is no uninstaller and you will need to create shortcuts to the folder where you locate the program files.

21. SyncBack • http://www.2brightsparks.com/freeware/freeware-hub.html

22. SyncBack Installation

23. SyncBack Interface

24. Corrupt Floppy Drive • Try another 3.5 drive – (write protect 1st) • Try Norton/Symantec disk doctor • Try a MAC (dual format read) • Try an online utility • FloppyZipRescue • fzdrescue.exe • http://www.winsite.com/winxp/dskutil/ • FloppyRecovery – command line & boot from floppy to start • frec.exe (search on frec floppy) • http://www.programmersheaven.com/zone16/cat923/31679.htm

25. Corrupt Hard Drive or Files • Microsoft • System Restore (roll back to previous version) • Disk Properties – Tools – CheckDisk • Will not run on system drive until reboot • Command Line • chkdsk – check disk • chkdsk /f /r • sfc – system file checker • sfc /scannow

26. Recover / Undelete • Microsoft • recover drive:path filename • Will attempt to recover readable information from a bad or corrupt hard disk • MS-Word documents • File-Open – type “recover text” • Freeware Undelete – SnapFiles • http://www.snapfiles.com/get/restoration.html • restoration.exe – needs no installation

27. PC-Inspector http://www.pcinspector.deFreeWare Utilities

28. Corrupt Hard Drive • Boot from Microsoft System CD • Really need same service pack version • Options • New Install (Enter=Continue) • <R> Boot to Command Prompt • R = Repair –> Recovery Console (may need admin pswd) • “help” – for available commands • Try “chkdsk /p /r” • OR use to navigate and recover files • Type Exit to end recovery console and reboot • Enter – Identify Partition - Repair (Enter=Continue) • Will install over top and replace system files  caution here

29. Corrupt Hard Drive • Install Hard Drive as a slave into another computer • Boot off good drive in other computer • Use Windows Explorer to locate and recover files • Can also be used as an extreme way to remove virus/malware

30. Mechanically Defective HD • Try the freezer trick • Try to free up a stuck head spindle • Gentle tap • Change angle it runs (ex. turn sideways) • DO NOT try opening the case (last resort) • DO NOT try changing out the logic board unless you are certain both units match identically (last resort)

31. SystemRescueCD • Linux bootable CD for system recovery • http://www.sysresccd.org/

32. Knoppix - CD • Linux bootable CD for system recovery • Can boot from CD • mount drive • connect to network drives or FTP sites • some drive management utilities • can try to repair damage or recover important files

33. Knoppix • http://www.knoppix.org/

34. ShockFamily How-to Info • First Aid withKnoppix • http://www.shockfamily.net/cedric/knoppix/

35. Ultimate Boot CD • http://ubcd.sourceforge.net/

36. Bart’s PE • http://www.nu2.nu/pebuilder/

37. Commercial Recovery Services • IF it can be run at all try cloning the drive before attempting any repair • Have clean room • Able to mix/match logic boards and insure matching versions • Able to move platters from defective drive into a new spindle/read-write head unit • Cost -- $$$ -- but may be priceless