WINDOWS PC BACKUP AND RECOVERY STRATEGIES

1. WINDOWS PC BACKUP AND RECOVERY STRATEGIES Presentation by Mike Boesen for the PC Users Group 8 March 2008

2. CONTENTS • MY SYSTEM • YOU MAY NEED ACCESS TO BACKUP STUFF WHEN ... • HARDWARE FAULTS THAT CAN LEAD TO DATA LOSS OR CORRUPTION OR MALFUNCTIONING • SOFTWARE PROBLEMS THAT CAN LEAD TO DATA LOSS OR CORRUPTION OR MALFUNCTIONING • POSSIBLE FIXES PRIOR TO DATA RECOVERY • OPTIONAL TWEAKS PRIOR TO OR AFTER DATA RECOVERY • DATA RECOVERY ACTIONS THAT REQUIRE EXISTENCE OF BACKED UP STUFF • FEATURES OF A GOOD BACKUP STUFF STRATEGY • BACKUP TO WHAT? • BACKUP WHAT? • BACKUP PLAN A - COMPRESSED IMAGE OF WHOLE DRIVE • BACKUP PLAN B - CLONING THE WHOLE DRIVE TO A BACKUP DRIVE • DESIRABLE POST-RECOVERY BEHAVIOUR • REFERENCES

3. MY SYSTEM(Page 1 of 2) • Pentium 4 (2.8 GHz) single core • 2 GB RAM (dual channel) • 200 GB PATA (Parallel ATA) master “C” drive - 130 GB used • Currently includes a small test partition “D” for this demo • 120 GB SATA (Serial ATA) “E” drive used for ad hoc backing up • Two 250 GB Parallel ATA drives in caddies used for backing up • Can boot from a drive in either caddy if the drive has a bootable system • Currently one caddy has 6 GB IMB PATA drive inserted as “F” for this demo • Three other USB2 devices containing hard drives • Networked (cable) • Broadband

4. MY SYSTEM(page 2 of 2) • One operating system: XP Pro SP2 • Internet Explorer, Firefox • Outlook Express • Many applications installed • 14 GB - 150,000 files in Program Files folder • Complex Registry • 380,000 keys • 882,000 values • Strong security: • automatic registry backup (ERUNT) • router firewall • Kaspersky Internet Suite • WinPatrol startup protection • Sole user • In the future ......

5. MY NEXT SYSTEM

6. MY NEXT SYSTEM – WHAT’S AFFORDABLE!

7. YOU MAY NEED ACCESS TO BACKUP STUFF WHEN: • PC will not boot into Windows operating system • Windows will not load • Startup or shutdown takes unreasonably long time • Application will not start • Application slows down or freezes or malfunctions or triggers the Blue Screen of Death • Spontaneous and unpredictable shutdown or rebooting • Application-triggered shutdown or rebooting • New version or update malfunctions and need to reinstate prior version • Need to recover inadvertently lost or deleted files • Need to replace corrupted or mangled files with earlier versions • etcetera

8. Stuff happens! It may not happen overnight but it WILL happen – so be prepared!

10. STUFF HAPPENS!

11. HARDWARE FAULTS THAT CAN LEAD TO DATA LOSS OR CORRUPTION OR MALFUNCTIONING • Faulty power supply • Insufficient or intermittent power to PC or to external devices • Loose or faulty power cables inside or outside PC • Overheating of CPU or other PC components • Overheating hard drive • Hard drive surface faults • Mechanical and electronic faults in hard drive or CD or DVD drive • Loose or faulty or wrong types of internal and external data cables for drives • Faulty or badly seating RAM • Intermittent or total failure of motherboard components or other devices • Conflicts caused by installation of new devices etcetera

12. SOFTWARE PROBLEMS THAT CAN LEAD TO DATA LOSS OR CORRUPTION OR MALFUNCTIONING • Malware: viruses, trojans, worms, spyware, etc • Missing or corrupted operating system files • Missing or corrupted or inappropriate application executables or shared executables • Conflicts caused by installing a new application or an update • Conflicts caused by installing “add-ons” or “helpers” (e.g. for browser) • Corrupted registry (any number of causes) • Installation of new or updated device drivers • Hard drive data structure faults (file tables, boot records, partitioning, etc) • Etcetera!

14. POSSIBLE FIXES PRIOR TO DATA RECOVERY (page 1 of 2) • Identify hardware faults and fix. Might involve: • check power plugs, sockets, power boards • check voltages from power supply inside PC (e.g. using Everest, test meter) • check power supply or batteries for external device/s • check temperature for hard drive, CPU, GPU (e.g. Everest) • test transmission speeds of hard drives (e.g. hdtach) • test RAM (e.g. windiag); remove, clean and re-seat RAM • swap cables and devices that are known to be OK and appropriate; replace if needed • relocate wireless devices

15. OBVIOUS HARDWARE PROBLEM - 1

16. OBVIOUS HARDWARE PROBLEM - 2

17. POSSIBLE FIXES PRIOR TO DATA RECOVERY (page 2 of 2) • Fix hard drive faults (bad sectors, file tables, boot records, etc). Could involve: • running CHKDSK • fixing NTLDR • Run SFC /SCANNOW to check and fix missing or corrupt system files • Check for, fix and prevent malware: • ensure that good anti-malware application/s are installed and up to date • undertake comprehensive scan for malware • run Microsoft Malicious Software Removal Tool • install all Microsoft security updates (but not today’s) • Uninstall any suspect or non-essential “add-ons” or “helpers” or “extensions”

18. OPTIONAL TWEAKS PRIOR TO OR AFTER DATA RECOVERY • Clean Startup to inhibit loading of bad or useless or redundant applications or services – use WinPatrol or Startup Panel or Autoruns • backup registry first! – use ERUNT • but requires good information! • Clean registry: • create Restore point or backup registry first • run good registry cleaner (e.g. JV16, Tuneup Utilities) • delete “errors” selectively – most “errors” are NOT errors and are benign • Defragment hard drive – only if considerably fragmented. (Consider resident defragger e.g. IObit Smartdefrag) • Check and fix mode of operation of hard drives and optical drives (DMA or slower PIO mode)

19. DATA RECOVERY ACTIONS THAT REQUIRE EXISTENCE OF BACKED UP STUFF(page 1 of 3) • Missing or corrupt system files: • Revert by running Microsoft’s SFC /SCANNOW • Requires up-to-date folder of I386 stuffon CD or on hard drive • Problems caused by installation of new devices or drivers: • roll back to earlier driver • or install more up to date driver • and/or uninstall device • and/or try different device • and/or revert to Restore Point or revert registry if appropriate [CP; System] • Missing or corrupt or inappropriate application files (executables): • uninstall and reinstall application • or install more up to date version • or install older version • and/or revert to Restore Point or revert registry if appropriate • Problems caused by updating an application: • uninstall and reinstall older version • revert to Restore Point or revert registry if appropriate

20. DATA RECOVERY ACTIONS THAT REQUIRE EXISTENCE OF BACKED UP STUFF (page 2 of 3) • Problems caused by installing a new application: • uninstall application • revert to Restore Point or revert registry if appropriate • Recovering deleted files: • Recover from Recycle bin (if not already emptied) • If recycle bin is already emptied, may (or may not) be able to recover using application such as PC Inspector File Recovery • Recover from a backup set (“mount” a compressed image, or recover directly from a clone backup) • Reversion of corrupted or mangled files: revert from a backup set : • from mounted image • or directly from clone

21. DATA RECOVERY ACTIONS THAT REQUIRE EXISTENCE OF BACKED UP STUFF (page 3 of 3) • Corrupted registry: revert from: • a suitable Restore Point (but reverts more than registry) • a suitable registrybackup (e.g. run ERDNT created by ERUNT) • Other recovery efforts fail or still have unsatisfactory performance: • revert partitions from compressed image or clone backup • revert complete hard drive from compressed image or clone backup

22. MAKE BACKUPS OF STUFF!

23. FEATURES OF A GOOD BACKUP STUFF STRATEGY • Easy to remember • Uncomplicated; few steps • Easy to learn • Affordable cost for • hardware • software • Affordable time • Runs “unattended” – start it and have dinner • Robust and flexible solution • Reliable results - when recovery is needed, it works! • do a fire-drill!

24. BACKUP TO WHAT? (page 1 of 2) • Master hard drive: • In boot partition (not good) • In another partition (not good) • Secondary internal drive (better) • Other drive on your network (better still) • Host server on internet site - e.g. Google (??) • USB flash drive, thumb drive (limited capacity; not cost-effective) • CD, DVD (slow; limited capacity)

26. BACKUP TO WHAT? (page 2 of 2) • Parallel IDE/UATA drive in removable caddy (complex but very good) • Drive in an external enclosure connected by: • Firewire (very good) • High Speed USB 2 (very good) • e-SATA (external Serial ATA) – (a little complex; but best of all)

27. BACKUP WHAT? (page 1 of 3) • Registry: • Windows-generated Restore Point (saves more than the registry) as installation-triggered event or ad hoc event • ERUNT – can run in fully automatic mode or ad hoc event • Email stuff: • Copy and paste address book and/or folders of emails. Applications like Syncback makes this easier. • If using Outlook Express, save everything in one hit using Outlook Express Freebie Backup • Data files (e.g. Word or Excel documents; databases; tax returns; pictures; music; etc): • Copy and paste selected folders. Applications like Syncback makes this easier. • Applications such as Roxio, Nero, Picasa have some functionality for backing up to CD/DVD

28. BACKUP WHAT? (page 2 of 3) • A partition or partitions of a drive or the whole drive backed up as a compressed image onto the same drive or onto another drive: • Acronis True Image paid (version 11) • Acronis True Image free version • Seagate Disk Wizard or MaxBlast 5 – • both free, re-badged Acronis True Image paid (version 10) • Acronis/Seagate/Maxblast compressed image can be “mounted” as a virtual drive: • Contents can be operated on just like files on any other drive

29. BACKUP WHAT? (page 3 of 3) • A partition of a drive backed up as a “clone” (bit for bit image) onto another drive: • Drive Image ? • Norton Ghost ? • A whole drive backed up as a “clone” (bit for bit image) onto another drive: • Acronis True Image paid version • Seagate Disk Wizard or MaxBlast 5 • Casper for XP • Drive Image ? • Norton Ghost? • If the clone is made from the boot partition, the PC could be booted from that drive • swap drives and cabling • change drive boot order (in BIOS) for internal drives • insert caddy and change drive boot order (in BIOS)

30. BACKUP PLAN A - COMPRESSED IMAGE OF WHOLE DRIVE • Create a “recovery CD” and test it to see if it is bootable • Every 10 days: • Connect backup drive in caddy or enclosure • Make enough space on the backup drive for the backup archive to be created (delete stalest backup archive if necessary) • Create backup archive comprising a compressed image of the whole of the master drive • “Validate” the backup archive • “Mount” the backup archive and inspect contents. See if files and partitions can be accessed • Store caddy or enclosure in a safe place • Once only: shut down PC, connect backup caddy or enclosure, boot PC using the recovery CD and see if it looks like you would be able to revert the master drive from the backup archive • Optional: daily Syncback updates for selected folders: put on any drive other than the master drive (e.g. backup drive, 2nd internal drive, network drive)

31. BACKUP PLAN B - CLONING THE WHOLE DRIVE TO A BACKUP DRIVE • Create a “recovery CD” and test it to see if it is bootable • Every 10 days: • Connect backup drive in caddy or enclosure • Create a bit-for-bit clone of the complete master drive onto the backup drive • In Windows Explorer (yuk! – xPlorer2 is better!) check the contents of the backup drive to see if it looks identical to the master drive • Store caddy or enclosure in a safe place • Once-only fire drill if you have the skills: shut down PC, swap the backup drive for the master drive, boot using the backup drive, see if it behaves just like your master drive. If everything works OK, shut down, swap backup drive out and master drive in. • Once-only test of recovery CD: boot using the CD and rehearse cloning from backup drive onto the master drive – but don’t action the last step. • Optional: daily Syncback updates for selected folders: put onto any drive other than the master drive (e.g. backup drive, 2nd internal drive, network drive)

32. DESIRABLE POST-RECOVERY BEHAVIOUR • Prior to installing any new application or new versions of old applications, create: • System Restore Point and/or • registry backup (use ERUNT) • Install a good set of anti-malware applications (or an integrated suite) • Configure your internet browser to implement strong security • Install almost all Windows security updates • Prevent unauthorised changes to Startup (Applications, Services, Task scheduler) • Install a “firewall” that prevents unauthorised inwards and outwards traffic over the internet • Create regular backups of your master drive onto another drive

33. SOME STUDY IS A GOOD IDEA

34. REMEMBER THAT PCs, APPLICATIONS AND OPERATING SYSTEMS ARE MESSY AND INHERENTLY UNSTABLE!

35. ARTICLES My site: www.pcug.org.au/boesen/ www.pcug.org.au/boesen/Backups/backups.htm www.pcug.org.au/boesen/maintenance/maintenance.htm See also Terry Bibo’s site: www.users.on.net/~tbibo/ This presentation: www.pcug.org.au/boesen/Backups/backup_presentation.pps