Chapter 3: Preparing for Disasters with Disaster Recovery

Exam Objectives

Managing emergency boot disks

Booting Windows into special modes

Understanding the Emergency Repair process

Performing backups and restores

Even with the best planning, things go wrong. And when they do, you need to know your options for dealing with the situation. In this chapter, I show you the available options for recovery that are built into the OS. I also introduce you to the concept of a recovery partition and show you how to use a recovery CD.

Small issues that arise can be dealt with on the fly if you know what tools are available. This chapter reviews the tools that you need to know. When a large issue appears, it is critical to have a backup, and know how to restore files from it. This chapter also shows you how to perform both processes.

Working with Boot Disks

If you find yourself with a computer that will not boot because of an OS problem, you want to use a startup disk or a boot disk to get your system back into a bootable state. A boot disk holds system files and can start the OS on your computer.

Windows XP doesn’t truly have a boot disk like older OSes have, but a disk can be formatted with Windows XP, and the Windows XP boot files can be copied over to the disk. This disk can then take the place of a corrupted boot sector on a Windows XP system. Book V, Chapter 6, describes the files that are required for booting Windows XP and provides details about each. Book VII, Chapter 2, looks at boot issues related to these files and how to resolve the boot issues. The files required on this disk are

NTLDR

NTDETECT.COM

BOOT.INI

NTBOOTDD.SYS (if it exists)

Use a Windows XP boot disk only as a replacement for a damaged or corrupted hard drive boot sector.

A similar disk can be created for Windows Vista or Windows 7, but this disk would require the following files on a Windows Vista– or Windows 7–formatted disk:

bootmgr

ootBCD

Using F8 Options During Boot-up

In Windows XP, a message appears at the bottom of the splash screen at the start of the boot process, telling you to press the F8 key to see the advanced boot options. In Vista and Windows 7, there is no prompt, but you can still access the boot menu by pressing F8 immediately after the POST process. After you open the boot menu, you can choose Safe Mode or Safe Mode with Networking. Windows XP also has a Safe Mode with Command Prompt option that loads cmd.exe as your shell application.

When you access the F8 boot menu at system startup, you reveal several advanced boot options, depending on your OS:

Safe Mode

Safe Mode with Networking

Save Mode with Command Prompt

Enable Boot Logging

Enable VGA Mode

Enable low-resolution video (640x480)

Last Known Good Configuration

Directory Services Restore Mode

Debugging Mode

Disable Automatic Restart on System Failure

Disable Driver Signature Enforcement

Booting into Safe Mode

If the computer hangs or crashes and reboots during the boot process, you might have a device-related error. If a Windows computer fails to boot properly, and you think that the problem is related to a service or driver that is loading, you might be able to boot the computer into Safe Mode.

Windows XP has an option called Enable VGA (Video Graphics Array) Mode, which loads all system drivers with the exception of the video driver. The idea of this option is that with the exception of having the video settings set wrong, the computer will boot and report that some drivers had failed to load — but, it will boot.

When Vista or Windows 7 detects that it failed to boot properly, it may automatically attempt to boot into Safe Mode during the next boot.

When booting into Safe Mode, the OS skips config.sys and autoexec.bat as well as any drivers not considered crucial to the boot process. This means that you get a VGA driver providing video in a daring 640-x-480 resolution (16 colors), a keyboard, and a mouse; while Windows 7 defaults to 800 x 600, it also offers a 640-x-480 resolution from Safe Mode. Initially, you will be presented with a warning telling you that you are entering Safe Mode, after which, the words Safe Mode appear in each corner of your screen, as shown in Figure 3-1. Outside of these devices, you will have very few working devices: no sound cards, scanners, or CD burners. With just the basics running, you should be able to identify the driver that did not load properly and then correct the problem.

Windows also supports an option for Safe Mode with Command Prompt. This mode boots the Windows GUI (graphical user interface) but opens cmd.exe as your shell, rather than explorer.exe. This allows you to perform many actions to correct your problem (by using utilities such as chkdsk.exe or the Registry Editor). When you are done, exiting the Command Prompt reboots your system.

Windows has a boot option for Safe Mode with Networking. This mode is useful when you need to download new drivers for a failed device or access files that might be stored on your server. With the exception of the loading of the networking drivers, this is a standard Safe Mode boot.

Tracking the boot with a bootlog

When choosing the Enable Boot Logging option from the Windows F8 menu, you create a log file called ntbtlog.txt, which is saved to the windows directory. This file is appended to when performing logged boots.

The ntbtlog.txt file is very useful for troubleshooting boot problems. It logs all drivers, services, and resources while they are loading. This file can then be referenced to locate problems with the boot, especially because the system does not give you much indication of what is happening during the boot.

The structure of a ntbtlog.txt file from Windows 7 is shown in Listing 3-1. This listing shows two boots of the system, which is noted by the OS identifier line Microsoft (R) Windows (R) Version 6.1 (Build 7600).

Listing 3-1: A Windows 7 ntbtlog.txt File

Microsoft (R) Windows (R) Version 6.1 (Build 7600)

5 15 2012 07:29:11.500

Loaded driver SystemRootsystem32 toskrnl.exe

Loaded driver SystemRootsystem32hal.dll

Loaded driver SystemRootsystem32kdcom.dll

Loaded driver SystemRootsystem32mcupdate_AuthenticAMD.dll

<Lines Deleted>

Did not load driver @hal.inf,%acpi_amd64.devicedesc%;ACPI x64-based PC

Did not load driver @mdmgen.inf,%gen556%;Standard 56000 bps Modem

Did not load driver @netavpna.inf,%mp-agilevpn-dispname%;WAN Miniport (IKEv2)

Did not load driver @netrasa.inf,%mp-ip-dispname%;WAN Miniport (IP)

Did not load driver @netrasa.inf,%mp-ipv6-dispname%;WAN Miniport (IPv6)

Did not load driver @netrasa.inf,%mp-pppoe-dispname%;WAN Miniport (PPPOE)

<Lines Deleted>

Loaded driver SystemRootsystem32DRIVERSudfs.sys

Did not load driver AFD.SYS

Did not load driver AFD.SYS

Microsoft (R) Windows (R) Version 6.1 (Build 7600)

5 15 2012 07:35:01.500

Loaded driver SystemRootsystem32 toskrnl.exe

Loaded driver SystemRootsystem32hal.dll

Loaded driver SystemRootsystem32kdcom.dll

Loaded driver SystemRootsystem32mcupdate_AuthenticAMD.dll

<Lines Deleted>

Loaded driver SystemRootSystem32DRIVERSsrv2.sys

Loaded driver SystemRootSystem32DRIVERSsrv.sys

Did not load driver SystemRootSystem32DRIVERSsrv.sys

Loaded driver SystemRootsystem32DRIVERSasyncmac.sys

The ntbtlog.txt file in Listing 3-1 lists the devices that were loaded and the order in which they were loaded. Look through the listing to see what other drivers or devices you can identify. When checking the file, look for items that list LoadFailed or Did not load driver because those are failures related to current problems.

Using the Last Known Good Configuration

If you just updated a driver on your Windows-based computer and your computer will not boot, try booting into Safe Mode to troubleshoot the issue. If the driver update is causing problems with Safe Mode as well, you still have options. Later in this chapter, you can read about the Recovery Console or the Emergency Repair Process, but in some cases, it is quicker to restore the Last Known Good Configuration.

The HKEY_LOCAL_MACHINESYSTEMCurrentControlSet Registry key stores the load or startup settings for all devices and services on your computer, including the path to the driver that is to be used. By choosing to restore the Last Known Good Configuration from the F8 boot menu, you can quickly and automatically restore this section of the Registry with a copy that was used during your last successful boot. If your computer had been running for a long time with many potential changes to this Registry key, those other changes will be lost while you are repairing the boot problem. You will have to decide whether the loss of those other changes is worth the quick restoration of a bootable computer.

Other Windows boot options

There are a few other advanced boot options for Windows that you will rarely use, so they are briefly covered here:

Directory Services Restore Mode (for Windows 2003 or Windows 2008 Domain Controllers): This boot option will never be used with Windows XP (even though it is in the Options menu) because it is designed to restore the Active Directory database, which would be running on a server.

Debugging Mode: This option is for use with external debuggers, which you might be asked to set up during troubleshooting sessions with Microsoft Professional Services after placing a support call.

Disable Automatic Restart on System Failure: Some drivers may be configured to cause the system to reboot if they fail to load, but this option prevents the system from rebooting. This option is used to allow the system to complete its boot so that you could perform troubleshooting from within the OS.

Improper Shutdown and Boot

There are times when your computer is not shut down properly. When using Windows XP, Windows Vista, or Windows 7, you will be told when the computer is rebooting that there was a problem. When this message appears, it will only remain for 30 seconds and then the default action will be to start Windows normally. The message for Windows XP is similar to that of Windows Vista and Windows 7 shown in Listing 3-2.

Listing 3-2: Windows Error Recovery for improper shutdown

                           Windows Error Recovery

Windows did not shut down successfully. If this was due to the system not

responding, or if the system was shut down to protect data, you might be

able to recover by choosing one of the Safe Mode configurations from the

menu below:

(Use the arrow keys to highlight your choice.)

   Safe Mode

   Safe Mode with Networking

   Safe Mode with Command Prompt

   Start Windows Normally

Description: Start Windows with its regular settings.

Enter=Choose

In the default configuration, a failed shutdown will result in a 30-second delay on the next reboot, but if there is an actual problem, then successive failures will briefly present this message to the user of the computer. This message is displayed to give users an easy way to get into Safe Mode, where they would be able to perform some additional diagnostics to determine why the computer is not shutting down properly.

These messages are a little different from the messages that you will receive if the computer fails to boot up properly, which varies slightly from version to version in Windows XP, Windows Vista, and Windows 7. The Windows XP and Windows Vista messages convey the information found in Listing 3-3, which is that something has gone wrong and that you may need your OS installation CD/DVD to repair the problem. Since boot problems are often the result of recent changes, you are also given the option of booting the Last Known Good Configuration from this menu. The default action for this menu is to boot Windows normally.

Listing 3-3: Windows Vista failure to boot recovery message

                           Windows Error Recovery

Windows failed to start. A recent hardware or software change might be the

cause. To fix the problem:

1. Insert your Windows installation disc and restart your computer.

2. Choose your language settings, and then click “Next.”

3. Click “Repair your computer.”

Other options:

If power was interrupted during startup, choose Start Windows Normally.

(Use the arrow keys to highlight your choice.)

   Safe Mode

   Safe Mode with Networking

   Safe Mode with Command Prompt

   Last Known Good Configuration (advanced)

   Start Windows Normally

Description: Start Windows with its regular settings.

Enter=Choose

The similar message for Windows 7 is shown in Listing 3-4, which also states that the problem may have been caused by recent changes. Rather than showing the standard Safe Mode options, Windows 7 offers you the choice of using the Startup Repair tool to perform startup troubleshooting. The default action for this menu is to launch Startup Repair.

Listing 3-4: Windows 7 failure to boot recovery message

                         Windows Error Recovery

Windows failed to start. A recent hardware or software change might be the

cause.

If Windows files have been damaged or configured incorrectly, Startup Repair

can help diagnose and fix the problem. If power was interrupted during

startup, choose Start Windows Normally.

(Use the arrow keys to highlight your choice.)

   Launch Startup Repair (recommended)

   Start Windows Normally

Seconds until highlighted choice will be selected automatically: 30

Description: Fix problems that are preventing Windows from starting

Enter=Choose

Emergency Repair

When things go wrong with the boot of Windows, you can try booting into Safe Mode to repair the error, but sometimes the system will not boot at all. At these times, you can make a final attempt to resurrect the system or start the installation. If you choose to attempt the Emergency Repair Process, you should be prepared by creating an Emergency Repair Disk prior to your computer experiencing problems, and you should be familiar with the repair process.

Emergency Repair Disk (ERD)

Windows 2000 and Windows NT both allow you to create an Emergency Repair Disk (ERD), which contains a small replacement version of the system account database and a major portion of the system Registry. This disk can restore the settings and a list of the devices or services on the system. It can also replace the account database with a copy of the account database that existed when you created the ERD.

The ERD is not required when performing an Emergency Repair with Windows XP, Windows Vista, or Windows 7.

With Windows NT, the Emergency Repair Disk is created by the rdisk.exe utility. You can run rdisk.exe from a command window or the run command. This utility updates several system files and places copies of them in a special directory, %winroot% epair, which can be copied to a floppy disk after updating. The normal rdisk command does not update the SAM and SECURITY files (see Book VI, Chapter 4), but these can be updated by using rdisk /s.

For Windows 2000, the Emergency Repair Disk is created with the backup utility found at Start⇒Accessories⇒System Tools⇒Backup. When you open this utility, there is an option to create an Emergency Repair Disk on the Welcome tab.

With each new version of the Windows OS, the Registry has become larger. Until Windows XP was released, the registry was able to fit onto a floppy disk. Windows XP, Windows Vista, and Windows 7 do not use an ERD because it cannot fit the required files onto a disk. The Windows Emergency Repair Process stores its backup copy of the Registry files in the Windows directory, so unless you have a hard drive failure, these files will be available when they are needed.

Emergency Repair Process

The Emergency Repair Process begins with booting the system with the Windows OS CD and starting the setup process. After starting the setup process, the first question you are asked is whether you would like to perform an installation of Windows XP, or if you would like to perform an Emergency Repair. Windows Vista and Windows 7 offer the option to Repair Your Computer on the second screen of the installation process.

After choosing to perform an Emergency Repair, you are asked whether to launch the Recovery Console (discussed in the next section) or perform an Emergency Repair. If you choose an Emergency Repair, you are asked for the Emergency Repair Disk (ERD). If you have your ERD, Windows uses the files on the disk; if you do not have your ERD, the Emergency Repair Process searches your drive for a Windows XP installation. If it finds one, it uses the repair information found in the %winroot%system32 epair directory. You then have four choices for the Emergency Repair Process:

Inspect boot files

Inspect startup environment

Inspect system files

Inspect Registry

If you choose to inspect the boot files or the startup environment, the Emergency Repair Process automatically fixes problems that may exist with either the boot sector or start files, such as boot.ini.

If you choose to inspect the system files, the Emergency Repair Process compares every file that makes up the Windows installation with the originals on the Windows CD. If it finds any files that are different, the files might be corrupted, so the Emergency Repair Process asks whether you want to replace the file with the original copy from the Windows CD.

If you choose to inspect the Registry, you then have three choices:

Load the SYSTEM key.

Load the SOFTWARE key.

Load the SAM and SECURITY keys.

The Inspect Registry option doesn’t so much inspect the sections of the Registry as replace them. The SYSTEM and SOFTWARE sections of the Registry contain settings for services, devices, and applications that are operating on the system. Most services store their settings in the SYSTEM key, but some (for Windows logo requirements) are also stored in the SOFTWARE key. The SOFTWARE key is used primarily for applications.

The SAM and SECURITY keys are replaced as a set. They contain the entire local account database. Replacing the account database on a member server affects only that one computer. If you make the replacement on your Windows domain controller, you will have replaced your entire domain account database. On Windows Server domain controllers, the local account database is not used.

Rather than choosing to perform the emergency repair process, you could choose to launch the Recovery Console, which contains its own repair and troubleshooting tools. For more on the Recovery Console, proceed to the next section.

If you are using Windows Vista or Windows 7, you will come to System Recovery Options screen, which has the following options:

Startup Repair

System Restore

Windows Complete PC Restore

Windows Memory Diagnostic Tool

Command Prompt

Windows Vista and Windows 7 use the Command Prompt option rather than the Recovery Console, but it serves the same purpose. This interface allows you to run commands, such as bootrec.exe and bcdedit.exe.

Recovery Console

Recovery Console is a command line–based OS that can be used to help diagnose and repair problems with your installation of Windows XP. This command line interface comes with several commands that look familiar to MS-DOS or Windows commands, as well as some that are unique to the Recovery Console. Even the commands that are named the same as MS-DOS commands tend to perform different functions.

Keep in mind that this is not MS-DOS, nor is it Windows XP. Recovery Console is a unique OS used to repair Windows XP.

You can access Recovery Console through the emergency repair process, or you can install it into your boot menu by re-running the Windows XP setup program with the cmdcons switch:

<winnt_src>i386winnt32.exe /cmdcons

To initially get into Recovery Console, you have to log into it. Recovery Console checks for copies of Windows XP on your system and lets you log in to one that you choose. To log in, you need the name and password of the local Windows XP administrator account. After providing that information, you will have access only to the files that make up that copy of Windows XP.

By default, you have access only to the windows directory. By limiting your access, Microsoft increases security and restricts the amount of damage/harm you can do. If you are booting to Recovery Console, your computer is likely having major problems that you were not able to solve through other means.

Recovery Console offers you several file management tools. Of these, the most notable are copy, del, and ren. All three commands work with only one file at a time and do not support wildcards like their Windows XP equivalents. format is the other major file management command at the console. format enables you to specify the file system for your partition — FAT, FAT32, or NTFS.

Several commands let you manage the disk and boot sectors on your drive: chkdsk for checking your disk for errors; diskpart for repartitioning, much like fdisk would; and fixboot and fixmbr for rewriting either the boot sector or the Master Boot Record (MBR) to resolve system startup errors.

While fixboot supports a few options, the most common way to run fixboot is without parameters; this will write a new partition boot sector to the current system partition. fixmbr has only one option, which is the drive to which to write a new master boot record, but if you execute fixmbr alone, it will write the boot sector to the boot device.

In addition to using these commands, you often need to control services and devices during the troubleshooting process. To help with this, you can use the following commands:

listsvc lists the available services and devices.

disable disables selected services and devices at boot.

enable enables selected devices and services at boot.

A couple of unclassified commands include the logon and systemroot commands. logon allows you to log on to another local copy of Windows for systems that dual boot. systemroot switches you to the Windows directory that you are logged onto.

With this assortment of tools, you should be able to get an unbootable copy of Windows XP bootable again. Don’t expect to perform much troubleshooting through Recovery Console, but if your computer is having Stop errors on boot, Recovery Console will allow you to get around them. When you are once again running a full copy of Windows XP, you should be able to complete your troubleshooting procedures.

Lab 3-1 gives you some practice working with Recovery Console. For this lab, you need a computer running Windows. In addition, you need an installation CD for the operating system. The labs can be downloaded from the website www.dummies.com/go/aplusaio.

Understanding Backup and Restore

Ensuring data recoverability involves performing a backup (normally to another type of medium) in addition to storing the file on the hard drive. This medium could be (for example) a floppy disk, another hard drive, a tape drive, a Zip drive, or CD-ROM.

If you have lost a single file (or all the files) on your hard drive, you will want to perform a restore. You need to have your backup files or tapes available and use the Windows backup utility to restore your files.

Backing up your computer

The Windows XP backup software is greatly improved over the old Windows NT backup software, and Windows Vista and Windows 7 have improved this process even more. Windows XP backup software picks up where its predecessor left off, allowing you to schedule regular automatic backups and to back up to nearly any medium you like (including, but not limited to, tape drives). Even though the tool is new, Microsoft has kept the name of ntbackup.exe, and supports all the old command line switches for backward compatibility.

The backup utility allows you to create a backup of all local files on your disk drives, as well as the system state. Open files, such as the Registry and system databases, cannot normally be backed up on your computer, but system state allows you to back up these files by using new file locking methods.

Each organization decides how often it needs to back up each of its computers. This decision is often based on the size and ease of use of the backup media and the value that the organization puts on its files. For example, the loss of a week’s worth of invoice records might represent a large amount of revenue to a company, or the loss of a day’s worth of rental records at a video store might put a substantial portion of the video store’s inventory in jeopardy because they will not have a record of where their movies are. These types of costs are weighed against the cost of decent backup hardware. Some organizations back up important data once a week, once a day, or several times a day, depending on the perceived cost of data loss.

You start a typical backup by launching the Backup utility, which can be done in one of two ways on Windows XP:

Run ntbackup.exe.

All options for the backup utility are available via the command line interface. To get a complete list of the options and their command line switches, type ntbackup.exe /? at a command prompt.

Choose Start⇒All Programs⇒Accessories⇒System Tools⇒Backup.

For Windows 7, you can launch the Backup utility by choosing Start⇒Control Panel⇒Back Up Your Computer. Either method launches the backup utility.

The first time you launch the Backup utility on Windows XP, it launches in wizard mode, which can be used for backup, and will allow you to back up files using simplified or default settings. This section guides you through the process using advanced mode, which allows you to set detailed options for your file backup or restore.

If you don’t want to launch it in wizard mode, clear the Always Start in Wizard Mode check box in the Backup or Restore Wizard dialog box and then click the Cancel button or the Advanced Mode hyperlink. The next time you launch the backup utility, it will launch in advanced mode instead of in wizard mode. When the utility is in advanced mode, you can run the Backup, Restore, or ASR wizards. You can also choose the appropriate tabs to perform a manual backup or restore. The last tab available in the program is the Schedule Jobs tab, which is used to schedule automated backup jobs.

To schedule a basic backup of your system without using the wizard mode on Windows XP, follow these steps:

1. Choose Start⇒All Programs⇒Accessories⇒System Tools⇒Backup.

The Backup Utility dialog box should open.

2. If the Backup or Restore Wizard opens, deselect the Always Start in Wizard mode check box and then click the Advanced Mode link.

3. Click the Backup tab.

4. Select all the drives, folders, or files that you want to back up, as well as the System State, by clicking in the Selection boxes to the left of the names.

Backing up the system state backs up core OS files, including files that are open. For Windows, this option normally includes

• COM+ Class Registration database

• Boot files, including the system files

• Registry

If you are backing up a server, the system state may include some or all of the following, depending on what Services are installed on the server:

• Certificate Services database

• Active Directory database

• SYSVOL directory

• Cluster service information

• IIS Metadirectory

System state backups are required to fully restore a computer to its original state and identity on the network. If you are concerned with the data and file system permissions only, you do not need to back up the system state.

5. Select a location to back up to and then click the Start Backup button.

You can back up the files to another local drive or to a tape drive if there is one attached to the computer.

If you are saving to a file on a drive, the default extension for a backup file is .bkf.

6. In the Backup Job Information window, click the Advanced button to set the advanced options for the job.

The main items to be aware of are

• Verify Data after Backup: This option rewinds the tape or rereads the backup file and compares its contents with each file that was backed up. You can disable this option if you find that some files managed by third-party applications become corrupted during the verification process. This is not normally the case.

• Disable Volume Shadow Copy: Volume Shadow Copy is a service that takes a snapshot of all open files on your drive to allow them to be backed up. Some third-party applications might have problems with the Volume Shadow Copy process, so you have the option of disabling this feature, but disabling the Volume Shadow Copy process will prevent some open files from being backed up because the older file lock mechanisms will be attempted.

• Backup Type: You have five options, which are summarized in upcoming Table 3-1.

7. Click OK.

8. In the Backup Job Information window that reappears, click the Schedule button.

You are prompted to save your backup selections into a BKS (backup selections) file.

9. Select a location, name the file, and then click Save.

This file can be stored anywhere on your drive, but for organizational purposes, I suggest that you save it in the same location as the BKF file. Saving the backup selections file allows the utility to know what files are to be copied during each scheduled backup time. The BKS file can be loaded into the backup utility any time you want the same selections for a backup.

The Task Scheduler Service prompts you to enter your credentials. The default Windows Task Scheduler Service is used when creating the scheduled automatic backup jobs that appear on the Schedule Jobs tab of the Backup Utility.

10. Provide the credentials of a user with the OS rights to perform a backup of the system.

This includes members of the Administrators or Backup Operators groups. The system uses the credentials you supply when it automatically starts the scheduled backup process.

11. Click OK.

You are presented with the standard options for the Scheduling Service.

OS rights are similar to file system permissions, but they grant a username the ability to perform an action that is not directly related to an object, such as a file. You assign rights using the Local Security Policy or an Active Directory Group Policy Object (GPO). To learn more about rights, read through Book IX, Chapter 2.

12. Select when you would like the backup to run and then click OK.

Table 3-1 Backup Types

Name	Description
Normal	Backs up all selected files and clears the Archive attribute so that files can be selected by incremental or differential backups if they are modified. If time and storage capacity permit, normal backups are usually the most desirable.
Copy	Backs up all selected files but does not clear or modify the Archive attribute of the file. This allows you to perform a full backup of your files with the intention of giving the backup to another group, such as the finance department at month’s end. Because the Archive attribute isn’t touched, your other incremental or differential backups will still be valid and will work as normal.
Incremental	Backs up any selected files that have their Archive attribute set and then clears the Archive attribute. This means that only files that have changed since the last full or incremental backup will be backed up. To restore the files, you need the last normal backup and all incremental backups that have been taken since the normal backup. Even though you need several backups to perform a restore, each backup will be small in comparison with the normal backup.
Differential	Is similar to incremental backups in that it reduces the time it takes to perform the backup, reduces the space required for the backup, and relies on an existing normal backup. The difference with this backup is that the Archive attributes of files are not touched. So with each backup, more and more files are backed up. The benefit of this is that only the most recent normal backup and the most recent differential backup are required to perform the restore.
Daily	Backs up only the files that were changed today and does not touch the Archive attribute. If my normally scheduled backup runs at midnight, and at 4 p.m., I want to run a utility on my drive that might corrupt data, I can run a Daily backup. Because it backs up only the files that were modified during the day, it will be a quick backup; and because it doesn’t touch the Archive attributes, if the backup isn’t needed, I can continue to use my normal routine for backing up and restoring files. It’s like the backup didn’t happen — much like the Copy type listed above.

By default, backups create a summary log that lists exceptions or the files that were not backed up. After scheduling and running a backup, you can log onto the computer by logging on as the backup user account that was specified when scheduling the job (Step 10 in the previous instructions).You can then open the backup utility and choose Tools⇒Report. This allows you to read the last ten backup logs.

Windows Vista has modified the backup process even further by integrating scheduling into it, as well as streamlining the file selection process. This has been done to make the entire process more user friendly, as shown in Figure 3-2.

Windows 7 has made additional changes to the process to make it easier still. When you launch the Backup tool for the first time on Windows 7, you will have the option to Set Up Backup. This will take you through a very short wizard to configure a backup destination location (which may be local or a network location); then you can choose which files you want to back up or let Windows choose the data to back up. Finally, you will choose a schedule, which defaults to every Sunday at 7:00 p.m., but could be anytime — daily, weekly, or monthly. Upon creating the scheduled backup, you can trigger it to run at any time through the Backup Control Panel applet.

Restoring files from a backup

You should also become familiar with the steps required to restore those files. To restore files on your system without using the wizard mode in the Backup Utility, follow these steps:

1. Choose Start⇒All Programs⇒Accessories⇒System Tools⇒Backup.

The Backup Utility dialog box should open.

2. If the Backup or Restore Wizard opens, deselect the Always Start in Wizard Mode check box and then click the Advanced Mode link.

3. Click the Restore and Manage Media tab.

This tab has two panes. The left pane is used to select and catalog backup files you want to restore from and to display the directory tree in a backup file; the right pane allows you to view information about backup files that have been cataloged and to select items that you want to restore. This dialog should already have a backup file cataloged, which will be the one that you created in Step 6 of the backup process.

If you need to import or catalog a backup file that was created on another computer, or that you have manually deleted from this window, right-click File in the left pane and choose Catalog File, locate and select the backup file that you want to work with, and then click OK.

4. Double-click the Backup Identification Label of the backup file that you want to work with.

5. Using the navigation controls in both panes, navigate through the list of files and folders that are found in the backup and select the files that you want to restore.

6. Select one of the three options for the Restore files to drop-down menu.

• Original location: Restores folders and files to the same locations from which they were backed up.

• Alternate location: Restores folders and files to an alternate location, creating a duplicate of the directory structure that was used during the backup, but places the restored files in the directory specified in the Alternate Location text box. This option is useful when you do not want the current copies of the files overwritten.

• Single folder: Restores folders and files to the location specified in the Alternate Location text box. Does not maintain the original directory structure, but rather places all the files restored into the specified directory. This option is useful when you are looking for a few specific files that are buried or lost in a complicated directory structure.

7. Click Start Restore.

This opens the Confirm Restore dialog box, where you can modify advanced options. I will not explore these options in this book.

8. Click OK to start the restore.

The Restore Progress dialog box opens, displaying the status of the file restore. When this process is complete, Close and Report buttons (top-right of the dialog box) appear.

9. Click Close.

The Restore process is now complete, and you can close the Backup Utility.

As with the backup process, the restore process of Windows Vista and Windows 7 has been streamlined to make this process more user friendly.

Restore points in Windows

With Windows XP, Microsoft introduced a new system for backing out of driver changes — System Restore. When critical operations (say, updating drivers) are conducted on your system, Windows automatically creates a system restore point. This restore point can then be used to revert the system to a previous state in the event of an immediate failure. You can also manually create your own restore points.

If your computer encounters problems related to changes in its system files or settings, you can use a restore point (assuming that you have one saved) to quickly revert your computer to a previous state. It is like having an Undo button for your OS, rather than needing to go through a full restore from backup.

Restore points are a replacement for the F8 boot option of Last Known Good Configuration although Microsoft still supports the older and widely known Restore feature.

Manually creating a restore point or reverting your computer to a previous restore point is done via the System Restore Wizard, shown in Figure 3-3. The following sections show you how.

Manually creating a restore point

You can manually create a restore point from within the System Restore Wizard by following these steps:

1. Choose Start⇒All Programs⇒Accessories⇒System Tools⇒System Restore.

In the System Restore dialog box that opens (refer to Figure 3-3), you can

• Restore My Computer to an Earlier Time

• Create a Restore Point (on Windows XP)

2. Select Create a Restore Point and then click Next.

3. Provide a description and click Create.

A restore point description makes it easier to locate an appropriate restore point during the restore process.

4. When the creation process is complete, click Close to exit System Restore.

For Windows Vista and Windows 7, you will create a restore point by opening the System Protection tab of the System Control Panel and clicking the Create button, which will ask you for a description of the restore point. The easy way to get to the System Control Panel is to open the Start menu, right-click Computer, and choose Properties.

For the System Restore to work, Windows monitors all hard drives on your system. Windows Vista defaults to letting you use up to 12 percent of your drive space for System Restore data, while Windows 7 is a little more dynamic in assigning an initial percentage, maxing out at 100 percent. This system restore cache setting can be adjusted by choosing Start⇒Control Panel and double-clicking the System applet. Then click the System Restore tab. Figure 3-4 shows the dialog box and the settings for the C: drive which I accessed by selecting the drive and clicking the Settings button. You can adjust the system restore cache by moving the slider and clicking OK.

Reducing the size of the cache reduces the disk space used by System Restore but also reduces the number of restore points that Windows will keep track of for you, which also reduces the age of your oldest restore.

If you have only one partition or drive on your computer, you can adjust the cache size without going into the settings for the disk.

Restoring your computer to a previous state

Minor and major disasters can require you to access a restore point to return your computer to working condition. The following instructions guide you through restoring your computer to a previous state by accessing a system restore point:

1. Choose Start⇒All Programs⇒Accessories⇒System Tools⇒System Restore.

The System Restore Wizard (refer to Figure 3-3) gives you two options:

• Restore My Computer to an Earlier Time

• Create a Restore Point (on Windows XP)

2. Select Restore My Computer to an Earlier Time and then click Next.

The wizard presents you with a list of restore points, as shown in Figure 3-5.

3. Select the appropriate restore point and then click Next.

You see a warning you that you will lose recent changes on your system if you choose to restore.

4. Click Next or Finish.

Your system reverts to how it was configured at the restore point you chose, and your computer reboots.

ASR in Windows

Before the development of the Automatic System Recovery (ASR) process, restoring a Windows computer via the backup utility required a complete reinstallation of Windows on the system, followed by a restore of the latest backup from backup media, which would be a file or tape. Now, the ASR process integrates a minimal Windows reinstallation with the backup utility’s restore process to reduce the total time it takes to get a system up and ­running.

To use the ASR features in Windows XP through to Windows 7, you need to first create an ASR backup. On Windows XP, you use the ASR Wizard, which can be opened from within the Windows XP backup utility (choose ASR Wizard from the Tools menu). To run the backup, you need backup media and a blank floppy disk (which the backup process will ask for at the end of the ASR backup, as shown in Figure 3-6). The ASR backup does not perform a complete backup of your system; it backs up only the boot partition and system state. Any data on other partitions needs to be backed up and restored separately.

If you lose your ASR floppy disk, you will not be able to restore that ASR backup.

After the backup is completed, you can restore the system by using the following process:

1. Boot the system from the setup CD.

2. Press F2 when prompted to start the ASR process, as shown in Figure 3-7.

3. Insert your backup disk when prompted, as shown in Figure 3-8.

The Automated System Recovery Wizard appears, as shown in Figure 3-9. The process proceeds automatically, or you can choose to go through it manually. It will perform a base OS installation onto the same partition that was backed up and then attempt to restore the backup that was conducted during the ASR process.

When the process is complete, your system should be in the same state that it was in during the ASR process.

This process was designed to speed up the recovery time for systems that require a restore from backup. With the ASR complete, you can then restore data that is found on other partitions of your system. If the only problems that you encountered were related to your boot partition, your job is complete.

In Windows Vista and Windows 7, this process was again streamlined. When you choose to create a backup, any backup that is created as a Complete PC Backup can then be restored, similar to the ASR, by booting from the Windows Vista or Windows 7 installation CD.

Recovery and Rescue Methods

So far in this chapter, you have seen many different tools that you can use to repair your computer when it is in a nonbooting state. This has included boot disks; Microsoft tools, such as Recovery Console; and the Windows backup utility. This section looks at manufacturer recovery tools, third-party tools, and special Windows installations.

Recovery CDs and recovery partitions

Many large computer companies, such as HP and IBM, provide a quick way to restore your computer to its default factory installation. In the past, this was done by using recovery CDs. When you unboxed your computer, you would get a set of bootable CDs that held some type of image of your computer. If your computer became unusable because of a virus, hard drive failure, or other issue, you could quickly boot from the CDs and restore your computer to its factory state. One problem with this scenario is that it usually meant that you also lost all of your data if it was not otherwise backed up.

Over the years, with vendors prepackaging applications with their computers, the size of that factory image has gotten larger and larger, so that now it would take multiple CDs, or even multiple DVDs, to store all that data. This change in the preparation of the computers has caused some vendors to use a recovery partition instead. This hidden partition contains the tools needed to restore the image to the rest of the hard drive. If you use partitioning tools and delete the partition, you lose your ability to restore the system to its factory default settings. The vendor will usually, however, give you the ability to back up this partition to CDs or DVDs. Usually, this partition is accessed by pressing one of the computer’s function keys during boot-up.

Recovery image

In addition to factory images that are available from some hardware vendors, you have the option of making your own recovery image. You can store this image on a partition on your hard drive, on a network server, or on some type of removable media. To create and restore this image, you can use some type of imaging software, such as Symantec Ghost or O&O Software DiskImage. These tools allow you to create your own custom image to be used for recovery purposes.

Rescue CDs

A rescue CD is a bootable CD that includes tools used to rescue files from a failing hard drive, or to repair problems that occurred with a Windows installation that made it nonbootable. Many third-party rescue CDs are available to the CompTIA A+ Certified Professional. Some rescue CDs are commercially available, but a wide variety of them are available for free. A quick Internet search for Live CD will reveal a wide range of these CDs. It seems that there are as many types of custom Live CDs as there are problems that you need to solve. With a little searching and experimenting, you can find one that meets your most common problems to add to your arsenal of tools.

Many of the key rescue CDs I have used for years are now actually DVDs. (With the extra space for tools, these DVDs are more useful than ever.) You can take the term “rescue CD” to mean “CD or DVD” in this section.

Many rescue CDs run a version of Linux, which has been prepackaged onto a bootable CD or CD image that includes a variety of tools. Knoppix (www.knopper.net/knoppix/), running a version of Debian Linux, is just one of these Live Linux CDs that many people use as a rescue CD, partly because it has a wide selection of tools and partly because it includes a GUI in the form of the X Window System and KDE or Gnome. With the variety of applications bundled on the Knoppix CD and the fact that the system runs entirely off of the CD, Knoppix is a great way to try Linux without having to install it. The following offers a brief overview of some of the rescue options that are available to you when using Knoppix, and most of the other Live CDs offer a similar mix of features. Try a few to find one that works for you.

Conveniently enough, Wiley also publishes Linux Bible, Eighth Edition, by Christopher Negus (published by John Wiley & Sons, Inc.). It covers Knoppix as well as many of the tools you will need to know how to use to diagnose and resolve problems with your Windows installation. With this book, you will be able to do a Linux deep dive; the book will guide you through Linux management from start to finish, including a Linux installation on a flash drive, which can be used in place of a rescue CD.

The Knoppix boot process starts off with a confirmation of your intention to boot into Knoppix, as shown in Figure 3-10. There are advanced boot options that you can access or get information about by pressing F2 or F3, but in most cases, the system will boot without additional information.

If you are not familiar with Linux, here’s a pointer: Linux identifies hard drives with letters and partitions with numbers, so in a typical IDE/ATA system, your four devices or drives are identified as hda, hdb, hdc, and hdd, with the C: drive usually being hda1 (the 1 means partition 1); while on SATA or SAS system your first four devices or drives are identified as sda, sdb, sdc, and sdd. In the case of Knoppix, all local disk partitions are automatically mounted for access and will appear on the desktop, some versions may only mount them as read-only. You can change the properties of the disk to allow writing to it; otherwise, you can browse and read files on your system. Figure 3-11 shows the properties of a Windows shortcut file that is found on sdb1 in a labfiles directory.

The overall desktop should not be alien to Windows users, with an applications menu in the bottom left of the screen, where the applications are stored in categories like Accessories, Education, Games, Graphics, Internet, Office, Sound & Video, and System Tools. Version 7 of Knoppix also includes WINE (a Windows environment for running Windows programs) which may be able to run some of the applications on your hard drive.

With the tools on this Live CD, you can verify many settings and even modify files that are found on your Windows installation. In Figure 3-12, the win.ini file on sda2 (the C: drive) is being modified, but just as easily you could modify the boot.ini file to correct settings for the controller and partition after an unexpected change.

Knoppix has several tools that you will likely find useful, such as partimage (partition image; allows you to perform disk imaging tasks on your partitions) and parted (a command line, disk partition–editing tool). Figure 3-13 shows the interface of GParted (a GUI front end for parted). This interface is reminiscent of Partition Magic. You can use GParted to create, resize, delete, and move partitions around your drive.

To copy files to or from a Windows server on your network, you can use tools like Samba Network Neighborhood to access shared folders on your servers. You can use this tool to copy network drives to a computer that doesn’t have them or to rescue files from a hard drive that is very near failure and can no longer support booting. Figure 3-14 shows the shares that are available on the server 192.168.1.3 as well as in a folder on the local hard drive, making it easy to move data between locations.

Another popular option for a rescue CD is BartPE, which can be created with PE Builder (www.nu2.nu/pebuilder). (PE stands for Preinstalled Environment, which is a minimally installed copy of Windows XP that runs off of a bootable CD.) The unique feature of this disk is that you are running Windows XP, which allows you to run native Windows tools rather than Linux tools. This greatly increases the number and type of tools available to help repair your computer system. Some of the types of tools include

File management

Antivirus

Disk management and maintenance

Internet and download Tools, such as a Web browser

Editors and other Windows applications

Because of licensing and copyright restrictions, PE Builder does not include OS or application files for most applications; but rather, it copies required files from your original OS installation disk and from copies of applications that you already have installed on a working computer. A running copy of BartPE with many of its applications is shown in Figure 3-15.

Many people have created plug-ins for Bart-PE, which are skeleton directory structures that contain instruction files for setting up the applications in PE-Builder. Because most of these are contributed by the user community, duplication can occur, and sometimes one version of a plug-in is better than one contributed by another user.

This disk has gained a great deal of popularity for disk imaging tools such as Symantec Ghost because it supports a wide variety of network drivers by default. This makes loading images off a network very easy, and you are not required to squeeze network drivers and the application onto a 1.4MB floppy disk.

You will find Lab 3-2, Working with PE Builder, which walks you through setting up a BartPE disk. You will require a computer running Windows XP as well as your installation CD for Windows XP. The labs can be downloaded from the website www.dummies.com/go/aplusaio.

Rescue partitions or rescue installations

Many of the quickest ways to repair a Windows installation are actually built into Windows. To repair a Windows installation from a Windows installation, you need only a small amount of planning. If you leave some free, unpartitioned space on your hard drive, you can create a rescue partition. A rescue partition, or rescue installation, of Windows is simply another copy of Windows that is installed onto your computer.

This second copy of Windows is not the default for booting, and is used only to repair problems to your normal installation of Windows. So if your default copy of Windows is installed on Drive C:, your rescue install could be installed on Drive D: or Drive E:. The partition should be used only for the Windows installation, and not used to store data for your normal installation. After installing Windows in the second location, it will be automatically set as the default boot. To change the default booting installation of Windows, follow these steps:

1. Choose Start⇒Control Panel.

2. If your Control Panel folder displays in category view, choose Performance and Maintenance⇒System; if your Control Panel folder displays in classic view, double-click System.

3. In the System properties dialog box that opens, click the Advanced tab and then on Settings in the Startup and Recovery section.

4. In the Startup and Recovery dialog that opens, choose the copy of Windows that you would like to be the default booting installation from the Default Operating System drop-down menu. Then click OK twice to close both open dialog boxes.

Scheduling Preventative Maintenance

This chapter has already walked you through the process of creating scheduled backups to keep your data safe. In addition to backups, many maintenance tasks can be scheduled to keep your computer running smoothly and safely. At a minimum, thought should be given to scheduling at least the following tasks:

Disk defragmentation: This task will optimize the files on the drive to improve disk access speeds. To read more about this tool, review Book II, Chapter 5.

Check disk utility (chkdsk.exe): This task will examine the disk files and directory structures for errors. If errors are found, you can rerun the tool to fix errors. To find out more about this tool, look at Book II, Chapter 5.

To schedule a task, choose Start⇒All Programs⇒Accessories⇒System Tools⇒Task Scheduler. Disk defragmentation should have a default system task, so navigate in the left pane to Task Scheduler Library⇒Microsoft⇒Windows⇒Defrag. Ensure that the task ScheduledDefrag has a status of Ready; otherwise right-click the task and choose Enable.

chkdsk.exe does not have a default system task, so to review how to create a schedule for a task, look into Book VI, Chapter 4. When creating the task, set the command to execute to cmd /k %systemroot%system32chkdsk.exe C:. When this task runs, it will cause a command window to open, which will remain open until you close it.

Getting an A+

This chapter helps you prepare for disasters by covering the following topics:

Using the NTBackup.exe utility to protect your data

F8 boot options that can be used to correct startup problems

System restore points and how to use them to repair configuration ­problems

Recovery CDs and partitions, and rescue CDs and partitions

Prep Test

1 What command would you use from Recovery Console to attempt to repair the boot sector?

A listsvc

B disable

C systemroot

D fixboot

2 Which of the following files is not required on a Windows XP boot disk?

A ntldr

B ntbtlog.txt

C ntdetect.com

D boot.ini

3 A user bought a new video card with 128 MB of RAM. He needs it to play the new version of his favorite video game. After installing the video card, he boots up his Windows XP computer and is overjoyed when he sees the Plug and Play Wizard detect the new hardware. When prompted, he provides the driver disk that came with his computer. After loading the driver for his new video card, his computer reboots. During the next boot, his computer halts and will not respond to any controls. What should he do next?

A Reboot his computer by using the power button. His computer will automatically boot to the Last Known Good Configuration.

B Reboot his computer by pressing Ctrl+Alt+Del and then pressing F8 when he sees the message to Press F8. He will then be able to choose Disable Advanced Video Options from the boot menu.

C Reboot his computer by using the power button. His computer will automatically display the boot menu and attempt to boot to Last Known Good Configuration without user intervention.

D Reboot his computer by pressing Ctrl+Alt+Del and then hold down F9 to enable Safe Mode.

E Reboot his computer by using the power button. When he sees the ­message to Press F8, press it and select either the Last Known Good Configuration or Enable VGA Mode.

4 Where does Windows XP store the boot log file, ntbtlog.txt?

A The root directory of the first hard drive, typically C:

B The C:Windows directory

C The C:Windowssystem32 directory

D The C: ecoveryerrors directory

5 What items are required to perform an ASR system restore? Choose all that apply.

A The ASR floppy disk

B Your most recent backup

C Your ASR backup

D Your ERD floppy disk

E A Windows XP installation CD

6 When you boot the F8 option of Last Known Good Configuration, what action restores the configuration?

A Deleting the recent drivers that have been installed. All driver locations are stored in C:Windowsinf.

B Restoration of old Registry keys from backup tape.

C Execution of rollback.com, to reset the correct configuration.

D Replacing the Registry key HKEY_LOCAL_MACHINESYSTEMCurrentControlSet with a backup copy.

7 What tasks are completed by the Windows XP Emergency Repair Process? Select all that apply.

A Inspect boot files

B Inspect driver configuration

C Inspect system files

D Inspect Registry

8 What type of backup will back up all selected files and clear the archive attribute of all files that are backed up?

A Daily Copy

B Differential

C Copy

D Normal

Answers

1 D. fixboot is the command to repair the boot sector. Review “Recovery Console.”

2 B. The only files that are required on a Windows XP boot disk are ntldr, ­ntdetect.com, and boot.ini. Check out “Working with Boot Disks.”

3 E. Either of these two options, Last Known Good Configuration or Enable VGA Mode, will allow him to boot his computer. If he chooses to boot the Last Known Good Configuration, any changes that he made to the hardware configuration since the last boot will be lost. If he chooses the Enable VGA Mode, he will be able to select a different driver to be used by the graphics controller or apply other software patches to get the system running. Safe Mode should be his next step on correcting the problem. Peruse “Using F8 Options During Boot-up.”

4 B. The boot log file is stored in the Windows directory. For more information, see the section titled “Tracking the boot with a bootlog.”

5 A, C, E. To complete an ASR restore, you need an ASR floppy disk, your ASR backup, and the Windows XP installation CD. After completing the ASR restore, you might want to restore a more recent backup to update any files on your boot drive that were changed since the ASR backup or to restore files from partitions other than the boot partition. The ERD is used when performing emergency repairs on Windows 2000 computers. Take a look at “ASR in Windows.”

6 D. Peek at “Using the Last Known Good Configuration.”

7 A, C, D. The Emergency Repair Process does not inspect driver configurations. Check out “Emergency Repair Process.”

8 D. The Normal backup will back up all selected files and clear the archive attribute on all files that are backed up. Review “Understanding Backup and Restore.”