File and Drive Recovery Techniques

1
File and Drive Recovery Techniques

• Tech Coordinator Feast
• 2005
• Galesburg Session
• Terry Sullivan
• (tsulliva_at_comwares.net)
• Technology Director - Shiloh CUSD1 Edgar CUD6

2
Approaches

• Proactive Approach aka backups
• Basic recovery techniques
• Starter ideas
• Microsoft tools
• 3rd party tools
• Commercial software
• OpenSource resources
• Recovery Services

3
Best Defense

• Good offense
• Backup
• Recycle Bin ONLY local drives
• MS - VSC (Volume Shadow Copy)
• Copy/Paste or command line xcopy
• CD burner
• Onetouch Backup external drive
• Ntbackup
• Syncback
• Cobian Backup

4
Enabling Quotas

• Network shares can be enabled to manage quotas
  for users
• Must be an NTFS volume
• Enable quota and set default space limits
• Will show remaining space when user checks
  properties on their network shares.

5
SERVER NTFS Properties
6
Quota Configuration
7
Windows Shadow Copy

• Will allow save copies of files and version for
  document stored on network shares
• User can recover their own lost file or
  deleted/corrupted version
• Works automatically with XP and need client for
  2000 or older.
• The Previous Versions client is a Windows
  Installer file named TWCLI32.MSI. It is located
  in the SystemRoot\System32\Clients folder

8
Shadow Copy Configuration

• VSC
• Snapshots 100 Meg default 2/day
• Client givesaccess lostor corrupt files
• Rt Click on File OR Folder

9
Xcopy copies files and directory tree

• XCOPY source destination /A /M /Ddate
  /P /S /E /V /W /C /I /Q /F
  /L /G /H /R /T /U /K /N /O /X
  /Y /-Y /Z /EXCLUDEfile1file2file3..
  .
• source Specifies the file(s) to copy.
• destination Specifies the location and/or name
  of new files.
• /A Copies only files with the archive
  attribute set, doesn't change the attribute.
• /M Copies only files with the archive
  attribute set, turns off the archive attribute.
• /Dm-d-y Copies files changed on or after
  the specified date. If no date is given, copies
  only those files whose source time is newer
  than the destination time.
• /P Prompts you before creating each
  destination file.
• /S Copies directories and
  subdirectories except empty ones.
• /E Copies directories and
  subdirectories, including empty ones.
• /V Verifies each new file.
• /W Prompts you to press a key before
  copying.
• /C Continues copying even if errors
  occur.
• /Q Does not display file names while
  copying.
• /F Displays full source and
  destination file names while copying.
• /L Displays files that would be
  copied.
• /G Allows the copying of encrypted
  files to destination that doe not support
  encryption.
• /H Copies hidden and system files
  also.
• /R Overwrites read-only files.

10
Removable and Network Drives

• Zip Drives
• CD-RW DVDRW
• Often include backup software
• May need DLA support and UDF format
• External USB and FireWire Hard Drives
• Network storage
• NASLite
• Tape Drives NEED proprietary application
  interface

11
NASLite

• http//www.serverelements.com/naslite.php

12
NTBackup

• Creates a scheduled job file list in
• Documents and Settings\username\Local
  Settings\Application Data\Microsoft\Windows NT\NT
  Backup\data\jobname.bks
• Creates a scheduled task which can be edited
• Either command line schtasks OR
  Accessories-System Tools-Scheduled Tasks
• Tasks are stored in the C\windows\Tasks
  folder

13
NTBackup

• Create a .bks text file with folders to be backed
  up one per line
• Example
• Text File daily.bks with one directory per line
• D\Pub\
• E\users\
• SystemState
• Can schedule with NTBackup
• with AT scheduler OR
• With schtasks (new XP scheduler service)
• Can run from NTBackup OR command line

14
NTBackup Command Line

• Cmd or Batch File version
• start /wait rsm.exe refresh /lf"Your_Library_Name"
  
• ntbackup.exe backup "daily.bks /vno /rno
  /rsno /hcon /m normal /j "daily.job" /lf
  /p 4mm DDS" /um
• /lf logical media friendly name
• /v verify
• /r restrict to owner or administrator group
• /rs removable storage database
• /hc hardware compression
• /m type normal, incremental,
• /j job name
• /l type of log file
• /p media pool
• /um magic bullet will find 1st media of
  defined type, format, and use.

15
Cobian Backup - 6

• Features
• Cobian Backup is a multi-threaded program that
  can be used to schedule and backup your files and
  directories from their original location to other
  directories/drives in the same computer or other
  computer in your network. FTP backup is also
  supported in both directions (download and
  upload).
• Cobian Backup exists in two different versions
  application and service. The program uses very
  few resources and can be running on the
  background on your system, checking your backup
  schedule and executing your backups when
  necessary. Cobian Backup is not an usual backup
  application it only copies your files and
  folders in original or compressed mode to other
  destination, creating a security copy as a
  result. So Cobian Backup can be better described
  as a "Scheduler for security copies".
• Cobian Backup supports several methods of
  compression and strong encryption

16
Cobian Backup - 6

• http//www.educ.umu.se/cobian/cobianbackup.htm

17
Cobian Installation
18
Application or Service
19
Cobian Interface build tasks
20
SyncBack- by 2BrightSparks

• SyncBack Freeware v3.2.8 1.72 MB SyncBack is
  our freeware program that helps you easily backup
  or synchronize your files to the same drive a
  different drive or medium (CDRW, CompactFlash,
  etc) an FTP server a Network or a Zip
  archive.The' No Install' version above will not
  install files into Windows or other PC system
  directories there is no uninstaller and you will
  need to create shortcuts to the folder where you
  locate the program files.

21
SyncBack

• http//www.2brightsparks.com/freeware/freeware-hub
  .html

22
SyncBack Installation
23
SyncBack Interface
24
Corrupt Floppy Drive

• Try another 3.5 drive (write protect 1st)
• Try Norton/Symantec disk doctor
• Try a MAC (dual format read)
• Try an online utility
• FloppyZipRescue
• fzdrescue.exe
• http//www.winsite.com/winxp/dskutil/
• FloppyRecovery command line boot from floppy
  to start
• frec.exe (search on frec floppy)
• http//www.programmersheaven.com/zone16/cat923/316
  79.htm

25
Corrupt Hard Drive or Files

• Microsoft
• System Restore (roll back to previous version)
• Disk Properties Tools CheckDisk
• Will not run on system drive until reboot
• Command Line
• chkdsk check disk
• chkdsk /f /r
• sfc system file checker
• sfc /scannow

26
Recover / Undelete

• Microsoft
• recover drivepath filename
• Will attempt to recover readable information from
  a bad or corrupt hard disk
• MS-Word documents
• File-Open type recover text
• Freeware Undelete SnapFiles
• http//www.snapfiles.com/get/restoration.html
• restoration.exe needs no installation

27
PC-Inspector
http//www.pcinspector.de FreeWare Utilities
28
Corrupt Hard Drive

• Boot from Microsoft System CD
• Really need same service pack version
• Options
• New Install (EnterContinue)
• ltRgt Boot to Command Prompt
• R Repair gt Recovery Console (may need admin
  pswd)
• help for available commands
• Try chkdsk /p /r
• OR use to navigate and recover files
• Type Exit to end recovery console and reboot
• Enter Identify Partition - Repair
  (EnterContinue)
• Will install over top and replace system files ?
  caution here

29
Corrupt Hard Drive

• Install Hard Drive as a slave into another
  computer
• Boot off good drive in other computer
• Use Windows Explorer to locate and recover files
• Can also be used as an extreme way to remove
  virus/malware

30
Mechanically Defective HD

• Try the freezer trick
• Try to free up a stuck head spindle
• Gentle tap
• Change angle it runs (ex. turn sideways)
• DO NOT try opening the case (last resort)
• DO NOT try changing out the logic board unless
  you are certain both units match identically
  (last resort)

31
SystemRescueCD

• Linux bootable CD for system recovery

• http//www.sysresccd.org/

32
Knoppix - CD

• Linux bootable CD for system recovery
• Can boot from CD
• mount drive
• connect to network drives or FTP sites
• some drive management utilities
• can try to repair damage or recover important
  files

33
Knoppix

• http//www.knoppix.org/

34
ShockFamily How-to Info

• First Aid withKnoppix
• http//www.shockfamily.net/cedric/knoppix/

35
Ultimate Boot CD

• http//ubcd.sourceforge.net/

36
Barts PE

• http//www.nu2.nu/pebuilder/

37
Commercial Recovery Services

• IF it can be run at all try cloning the drive
  before attempting any repair
• Have clean room
• Able to mix/match logic boards and insure
  matching versions
• Able to move platters from defective drive into a
  new spindle/read-write head unit
• Cost -- -- but may be priceless