WINDOWS PC BACKUP AND RECOVERY STRATEGIES

1
WINDOWS PC BACKUP AND RECOVERY STRATEGIES

• Presentation by Mike Boesen
• for the
• PC Users Group
• 8 March 2008

2
CONTENTS

• MY SYSTEM
• YOU MAY NEED ACCESS TO BACKUP STUFF WHEN ...
• HARDWARE FAULTS THAT CAN LEAD TO DATA LOSS OR
  CORRUPTION OR MALFUNCTIONING
• SOFTWARE PROBLEMS THAT CAN LEAD TO DATA LOSS OR
  CORRUPTION OR MALFUNCTIONING
• POSSIBLE FIXES PRIOR TO DATA RECOVERY
• OPTIONAL TWEAKS PRIOR TO OR AFTER DATA RECOVERY
• DATA RECOVERY ACTIONS THAT REQUIRE EXISTENCE OF
  BACKED UP STUFF
• FEATURES OF A GOOD BACKUP STUFF STRATEGY
• BACKUP TO WHAT?
• BACKUP WHAT?
• BACKUP PLAN A - COMPRESSED IMAGE OF WHOLE DRIVE
• BACKUP PLAN B - CLONING THE WHOLE DRIVE TO A
  BACKUP DRIVE
• DESIRABLE POST-RECOVERY BEHAVIOUR
• REFERENCES

3
MY SYSTEM(Page 1 of 2)

• Pentium 4 (2.8 GHz) single core
• 2 GB RAM (dual channel)
• 200 GB PATA (Parallel ATA) master C drive - 130
  GB used
• Currently includes a small test partition D for
  this demo
• 120 GB SATA (Serial ATA) E drive used for ad
  hoc backing up
• Two 250 GB Parallel ATA drives in caddies used
  for backing up
• Can boot from a drive in either caddy if the
  drive has a bootable system
• Currently one caddy has 6 GB IMB PATA drive
  inserted as F for this demo
• Three other USB2 devices containing hard drives
• Networked (cable)
• Broadband

4
MY SYSTEM(page 2 of 2)

• One operating system XP Pro SP2
• Internet Explorer, Firefox
• Outlook Express
• Many applications installed
• 14 GB - 150,000 files in Program Files folder
• Complex Registry
• 380,000 keys
• 882,000 values
• Strong security
• automatic registry backup (ERUNT)
• router firewall
• Kaspersky Internet Suite
• WinPatrol startup protection

5
MY NEXT SYSTEM
6
MY NEXT SYSTEM WHATS AFFORDABLE!
7
YOU MAY NEED ACCESS TO BACKUP STUFF WHEN

• PC will not boot into Windows operating system
• Windows will not load
• Startup or shutdown takes unreasonably long time
• Application will not start
• Application slows down or freezes or malfunctions
  or triggers the Blue Screen of Death
• Spontaneous and unpredictable shutdown or
  rebooting
• Application-triggered shutdown or rebooting
• New version or update malfunctions and need to
  reinstate prior version
• Need to recover inadvertently lost or deleted
  files
• Need to replace corrupted or mangled files with
  earlier versions

8
Stuff happens! It may not happen overnight but
it WILL happen so be prepared!
9
(No Transcript)
10
STUFF HAPPENS!
11
HARDWARE FAULTS THAT CAN LEAD TO DATA LOSS OR
CORRUPTION OR MALFUNCTIONING

• Faulty power supply
• Insufficient or intermittent power to PC or to
  external devices
• Loose or faulty power cables inside or outside PC
• Overheating of CPU or other PC components
• Overheating hard drive
• Hard drive surface faults
• Mechanical and electronic faults in hard drive or
  CD or DVD drive
• Loose or faulty or wrong types of internal and
  external data cables for drives
• Faulty or badly seating RAM
• Intermittent or total failure of motherboard
  components or other devices

12
SOFTWARE PROBLEMS THAT CAN LEAD TO DATA LOSS OR
CORRUPTION OR MALFUNCTIONING

• Malware viruses, trojans, worms, spyware, etc
• Missing or corrupted operating system files
• Missing or corrupted or inappropriate application
  executables or shared executables
• Conflicts caused by installing a new application
  or an update
• Conflicts caused by installing add-ons or
  helpers (e.g. for browser)
• Corrupted registry (any number of causes)
• Installation of new or updated device drivers
• Hard drive data structure faults (file tables,
  boot records, partitioning, etc)
• Etcetera!

13
(No Transcript)
14
POSSIBLE FIXES PRIOR TO DATA RECOVERY (page 1 of
2)

• Identify hardware faults and fix. Might involve
• check power plugs, sockets, power boards
• check voltages from power supply inside PC (e.g.
  using Everest, test meter)
• check power supply or batteries for external
  device/s
• check temperature for hard drive, CPU, GPU (e.g.
  Everest)
• test transmission speeds of hard drives (e.g.
  hdtach)
• test RAM (e.g. windiag) remove, clean and
  re-seat RAM
• swap cables and devices that are known to be OK
  and appropriate replace if needed
• relocate wireless devices

15
OBVIOUS HARDWARE PROBLEM - 1
16
OBVIOUS HARDWARE PROBLEM - 2
17
POSSIBLE FIXES PRIOR TO DATA RECOVERY (page 2 of
2)

• Fix hard drive faults (bad sectors, file tables,
  boot records, etc). Could involve
• running CHKDSK
• fixing NTLDR
• Run SFC /SCANNOW to check and fix missing or
  corrupt system files
• Check for, fix and prevent malware
• ensure that good anti-malware application/s are
  installed and up to date
• undertake comprehensive scan for malware
• run Microsoft Malicious Software Removal Tool
• install all Microsoft security updates (but not
  todays)
• Uninstall any suspect or non-essential add-ons
  or helpers or extensions

18
OPTIONAL TWEAKS PRIOR TO OR AFTER DATA RECOVERY

• Clean Startup to inhibit loading of bad or
  useless or redundant applications or services
  use WinPatrol or Startup Panel or Autoruns
• backup registry first! use ERUNT
• but requires good information!
• Clean registry
• create Restore point or backup registry first
• run good registry cleaner (e.g. JV16, Tuneup
  Utilities)
• delete errors selectively most errors are
  NOT errors and are benign
• Defragment hard drive only if considerably
  fragmented. (Consider resident defragger e.g.
  IObit Smartdefrag)
• Check and fix mode of operation of hard drives
  and optical drives (DMA or slower PIO mode)

19
DATA RECOVERY ACTIONS THAT REQUIRE EXISTENCE OF
BACKED UP STUFF (page 1 of 3)

• Missing or corrupt system files
• Revert by running Microsofts SFC /SCANNOW
• Requires up-to-date folder of I386 stuff on CD or
  on hard drive
• Problems caused by installation of new devices or
  drivers
• roll back to earlier driver
• or install more up to date driver
• and/or uninstall device
• and/or try different device
• and/or revert to Restore Point or revert registry
  if appropriate CP System
• Missing or corrupt or inappropriate application
  files (executables)
• uninstall and reinstall application
• or install more up to date version
• or install older version
• and/or revert to Restore Point or revert registry
  if appropriate
• Problems caused by updating an application
• uninstall and reinstall older version

20
DATA RECOVERY ACTIONS THAT REQUIRE EXISTENCE OF
BACKED UP STUFF (page 2 of 3)

• Problems caused by installing a new application
• uninstall application
• revert to Restore Point or revert registry if
  appropriate
• Recovering deleted files
• Recover from Recycle bin (if not already emptied)
• If recycle bin is already emptied, may (or may
  not) be able to recover using application such
  as PC Inspector File Recovery
• Recover from a backup set (mount a compressed
  image, or recover directly from a clone backup)
• Reversion of corrupted or mangled files revert
  from a backup set
• from mounted image
• or directly from clone

21
DATA RECOVERY ACTIONS THAT REQUIRE EXISTENCE OF
BACKED UP STUFF (page 3 of 3)

• Corrupted registry revert from
• a suitable Restore Point (but reverts more than
  registry)
• a suitable registry backup (e.g. run ERDNT
  created by ERUNT)
• Other recovery efforts fail or still have
  unsatisfactory performance
• revert partitions from compressed image or clone
  backup
• revert complete hard drive from compressed image
  or clone backup

22
MAKE BACKUPS OF STUFF!
23
FEATURES OF A GOOD BACKUP STUFF STRATEGY

• Easy to remember
• Uncomplicated few steps
• Easy to learn
• Affordable cost for
• hardware
• software
• Affordable time
• Runs unattended start it and have dinner
• Robust and flexible solution
• Reliable results - when recovery is needed, it
  works!
• do a fire-drill!

24
BACKUP TO WHAT? (page 1 of 2)

• Master hard drive
• In boot partition (not good)
• In another partition (not good)
• Secondary internal drive (better)
• Other drive on your network (better still)
• Host server on internet site - e.g. Google (??)
• USB flash drive, thumb drive (limited capacity
  not cost-effective)
• CD, DVD (slow limited capacity)

25
(No Transcript)
26
BACKUP TO WHAT? (page 2 of 2)

• Parallel IDE/UATA drive in removable caddy
  (complex but very good)
• Drive in an external enclosure connected by
• Firewire (very good)
• High Speed USB 2 (very good)
• e-SATA (external Serial ATA) (a little
  complex but best of all)

27
BACKUP WHAT? (page 1 of 3)

• Registry
• Windows-generated Restore Point (saves more than
  the registry) as installation-triggered event or
  ad hoc event
• ERUNT can run in fully automatic mode or ad hoc
  event
• Email stuff
• Copy and paste address book and/or folders of
  emails. Applications like Syncback makes this
  easier.
• If using Outlook Express, save everything in one
  hit using Outlook Express Freebie Backup
• Data files (e.g. Word or Excel documents
  databases tax returns pictures music etc)
• Copy and paste selected folders. Applications
  like Syncback makes this easier.
• Applications such as Roxio, Nero, Picasa have
  some functionality for backing up to CD/DVD

28
BACKUP WHAT? (page 2 of 3)

• A partition or partitions of a drive or the whole
  drive backed up as a compressed image onto the
  same drive or onto another drive
• Acronis True Image paid (version 11)
• Acronis True Image free version
• Seagate Disk Wizard or MaxBlast 5
• both free, re-badged Acronis True Image paid
  (version 10)
• Acronis/Seagate/Maxblast compressed image can be
  mounted as a virtual drive
• Contents can be operated on just like files on
  any other drive

29
BACKUP WHAT? (page 3 of 3)

• A partition of a drive backed up as a clone
  (bit for bit image) onto another drive
• Drive Image ?
• Norton Ghost ?
• A whole drive backed up as a clone (bit for bit
  image) onto another drive
• Acronis True Image paid version
• Seagate Disk Wizard or MaxBlast 5
• Casper for XP
• Drive Image ?
• Norton Ghost?
• If the clone is made from the boot partition, the
  PC could be booted from that drive
• swap drives and cabling
• change drive boot order (in BIOS) for internal
  drives
• insert caddy and change drive boot order (in
  BIOS)

30
BACKUP PLAN A - COMPRESSED IMAGE OF WHOLE DRIVE

• Create a recovery CD and test it to see if it
  is bootable
• Every 10 days
• Connect backup drive in caddy or enclosure
• Make enough space on the backup drive for the
  backup archive to be created (delete stalest
  backup archive if necessary)
• Create backup archive comprising a compressed
  image of the whole of the master drive
• Validate the backup archive
• Mount the backup archive and inspect contents.
  See if files and partitions can be accessed
• Store caddy or enclosure in a safe place
• Once only shut down PC, connect backup caddy or
  enclosure, boot PC using the recovery CD and see
  if it looks like you would be able to revert the
  master drive from the backup archive
• Optional daily Syncback updates for selected
  folders put on any drive other than the master
  drive (e.g. backup drive, 2nd internal drive,
  network drive)

31
BACKUP PLAN B - CLONING THE WHOLE DRIVE TO A
BACKUP DRIVE

• Create a recovery CD and test it to see if it
  is bootable
• Every 10 days
• Connect backup drive in caddy or enclosure
• Create a bit-for-bit clone of the complete master
  drive onto the backup drive
• In Windows Explorer (yuk! xPlorer2 is better!)
  check the contents of the backup drive to see if
  it looks identical to the master drive
• Store caddy or enclosure in a safe place
• Once-only fire drill if you have the skills
  shut down PC, swap the backup drive for the
  master drive, boot using the backup drive, see if
  it behaves just like your master drive. If
  everything works OK, shut down, swap backup drive
  out and master drive in.
• Once-only test of recovery CD boot using the CD
  and rehearse cloning from backup drive onto the
  master drive but dont action the last step.
• Optional daily Syncback updates for selected
  folders put onto any drive other than the
  master drive (e.g. backup drive, 2nd internal
  drive, network drive)

32
DESIRABLE POST-RECOVERY BEHAVIOUR

• Prior to installing any new application or new
  versions of old applications, create
• System Restore Point and/or
• registry backup (use ERUNT)
• Install a good set of anti-malware applications
  (or an integrated suite)
• Configure your internet browser to implement
  strong security
• Install almost all Windows security updates
• Prevent unauthorised changes to Startup
  (Applications, Services, Task scheduler)
• Install a firewall that prevents unauthorised
  inwards and outwards traffic over the internet
• Create regular backups of your master drive onto
  another drive

33
SOME STUDY IS A GOOD IDEA
34
REMEMBER THAT PCs, APPLICATIONS AND OPERATING
SYSTEMS ARE MESSY AND INHERENTLY UNSTABLE!
35
ARTICLES

• My site
• www.pcug.org.au/boesen/
• www.pcug.org.au/boesen/Backups/backups.htm
• www.pcug.org.au/boesen/maintenance/maintenance.htm
  
• See also Terry Bibos site
• www.users.on.net/tbibo/
• This presentation
• www.pcug.org.au/boesen/Backups/backup_presentation
  .pps