Welcome, Guest. Please Login
 
  HomeHelpSearchLogin FAQ Radified Ghost.Classic Ghost.New Bootable CD Blog  
 
Pages: 1 2 3 4 5
Send Topic Print
Ghost 2003, Img XP > DVD, INCOMPLETE ?? (Read 38567 times)
henriette
Technoluster
***
Offline


I Love Radified!

Posts: 147
Heidelberg Germany


Back to top
Re: Ghost 2003, Img XP > DVD, INCOMPLETE ??
Reply #15 - Jun 9th, 2012 at 7:17am
 
@
Dan Goodell & NightOwl

I have to admit, I did not do a *clean* job by deleting manually - as described in http://www.tech-pro.net/how-to-remove-ntuninstall-folders.html

So I will use the "Windows XP Update Remover* from now on.

Question #1:
Will that tool possibly clean leftovers from the registry (which I did not delete)  Huh

Question #2:
I have never touched the IE7 + IE8 updates [just the updates of both add to 534MB!]. Would you recommend me to delete those as well ?
(thought they might be needed in case of XP-repair or whatever).
Since I restore images instead, I might not need those updates, anymore  Huh

Thank you both for your excellent support!

henriette  Smiley
 

The problem's not the computer - the problem sits right in front of it ...
 
IP Logged
 

Dan Goodell
Special Guest
*****
Offline



Posts: 552
N California


Back to top
Re: Ghost 2003, Img XP > DVD, INCOMPLETE ??
Reply #16 - Jun 9th, 2012 at 5:32pm
 
henriette wrote on Jun 9th, 2012 at 7:17am:
So I will use the "Windows XP Update Remover* from now on.

Will that tool possibly clean leftovers from the registry (which I did not delete)


I don't know, and I don't have a system with that condition to test.

Earlier, you said, "CCleaner and/or TuneupUtilities will remove the registry keys (KBs - from other registry hive, I assume) thereafter."

I'm still not clear what that refers to. Perhaps I haven't seen that feature merely because I haven't had systems with orphaned KB registry entries, I don't know.  Maybe if I had, one of those utilities might have offered to clean them up.

You seem to be more familiar with what those utilities are doing in this case--has it been your experience that they were cleaning the orphaned registry keys after you manually deleted the backup folder?  If so, then maybe you don't have any orphaned keys left.



Quote:
I have never touched the IE7 + IE8 updates [just the updates of both add to 534MB!]. Would you recommend me to delete those as well ?
(thought they might be needed in case of XP-repair or whatever).
Since I restore images instead, I might not need those updates, anymore


That's exactly my rationale, so I delete those backup folders, as well.

Once you have a stable, working Windows installation, you can delete all backups except for the last couple months, then image it.  I might leave the last month or two just in case there's some problem with a recent update that you haven't noticed yet.  That leaves you the chance to still uninstall it if you needed to.

But I would never, ever, uninstall a very old update after months of subsequent updates have been applied.  You just never know how intertwined they may be, and if there are a lot of subsequent updates it seems to me that increases the odds that uninstalling an old update might break something else.  That's the kind of situation in which I'd roll back to a prior image instead.

 
 
IP Logged
 
Dan Goodell
Special Guest
*****
Offline



Posts: 552
N California


Back to top
Re: Ghost 2003, Img XP > DVD, INCOMPLETE ??
Reply #17 - Jun 9th, 2012 at 5:37pm
 
In case it helps, let me describe my long-term imaging strategy.

Let's assume a starting point of some pristine, stable OS installation.  It may be a brand new computer, or a used computer restored to factory state, or a clean install from CD/DVD--that doesn't matter.   The point is I have a known good, stable, virus-free installation that hasn't been sullied by daily use yet.  I make an image and set it aside for a year.

After a year my OS has been pounded by daily use, new programs have been installed, some programs have been uninstalled, some programs have installed unwanted bundleware I've had to remove, there have been hundreds of Windows updates, some of those updates have subsequently been superceded by other updates, and there have been countless registry additions/changes/deletions.  Who knows, maybe even some malware snuck by a some point and damaged some dll or left some detritus before my AV program killed it.  In effect, it's like a used car that's picked up dings and dents along the way.

At the end of the year, I first make a note of what new programs were installed over the year that I've kept, then I restore the OS from my pristine, year-old backup image.  I delete all the old WU backup folders (on the principle they've proven over the year that they're keepers).  Then I re-add the new programs that were keepers, and let Windows apply the intervening year's update patches.  (Note this neatly avoids most of the "oops" patches that Microsoft subsequently repatched.)  Then I reimage this updated, pristine installation, and set it aside for another year.

A year later, the process is repeated.  This practically guarantees that each year I am starting with a known-good, virus-free, corruption-free, pristine OS, with no excess cruft or detritus from daily use.  It's basically the same as doing a clean install once a year.  I've got a system that's as lean and fast as it could possibly be.  (I've got an 8-yr old desktop and a 5-yr old laptop that still boot in well under a minute and run faster than most users' more modern machines.)

I'll still make interim backup images at significant breakpoints throughout the year (like before installing some major program or applying a SP update), but those are images just in case of emergency.  I may never need them.  In contrast, the yearly pristine images definitely get used at the end of a year.


 
 
IP Logged
 
henriette
Technoluster
***
Offline


I Love Radified!

Posts: 147
Heidelberg Germany


Back to top
Re: Ghost 2003, Img XP > DVD, INCOMPLETE ??
Reply #18 - Jun 11th, 2012 at 5:53am
 
Dan, I understand what you mean. And it's a good point you make Smiley

The idea of a *pristine* image in my case, though, is most unlikely (don't think I have such an image) - couldn't tell  Cheesy
I have ~ 70 images from the very beginning of XP install to yesterday. Hard/software have changed that much & often, it would take *forever* to get all that up-to-date.

note: I write daily records of each step. So I might have to struggle through several hundred pages, still having doubts whether "this is it" or not ... not even "this may be it" Roll Eyes

If I had gotten your advice years ago, I would have handled it different = the way you do it. Too late now.

However, I probably will have to get used to restoring earlier images - after 2014 = end of XP.
I intend to stick with XP. My hardware is not win 7-ready in the least!
Old board, CPU, +++, and = still EIDE/PATA.

Addition: Yesterday I used *windows xp update remover*.
Only "IE7-updates" (+ 1 latest KB which I didn't touch) were shown. Not so "IE8" - I guess it's because I have IE8 in use.

Thanks for your great support.

henriette  Kiss

 
 

The problem's not the computer - the problem sits right in front of it ...
 
IP Logged
 
Dan Goodell
Special Guest
*****
Offline



Posts: 552
N California


Back to top
Re: Ghost 2003, Img XP > DVD, INCOMPLETE ??
Reply #19 - Jun 11th, 2012 at 6:27pm
 
henriette wrote on Jun 11th, 2012 at 5:53am:
If I had gotten your advice years ago, I would have handled it different = the way you do it. Too late now.

However, I probably will have to get used to restoring earlier images - after 2014 = end of XP.
I intend to stick with XP.

If it were me, I think I'd probably bite the bullet and start over from a clean install.  Yes, it will be painful, but since you're adamant about keeping it for the long haul, it might make sense.

Most people would look at such a system and say, "Yeah, maybe it could be cleaner, but it works okay and I don't want to reinstall and start over, so I'll live with it."  But when it eventually becomes unbearable they can fall back on just buying a new computer.  They won't be able to get XP and may not like Win7 (or Win8), but they'll accept that as the tradeoff for avoiding a clean install/startover.

You already can't get XP, and in another year you won't be able to get Win7, either.  So if you're adamant about sticking with XP, starting over with a new computer will be out of the question.  In your case it's not really a question of when Microsoft's official support ends, you want to keep your XP running smoothly for as long as possible, whether Microsoft's supporting it or not.







 
 
IP Logged
 
NightOwl
Radministrator
*****
Offline


"I tought I saw a puddy
tat..."

Posts: 5801
Olympia, WA--Puget Sound--USA


Back to top
Re: Ghost 2003, Img XP > DVD, INCOMPLETE ??
Reply #20 - Jun 12th, 2012 at 2:23pm
 
@
Dan Goodell

Dan Goodell wrote on Jun 9th, 2012 at 5:37pm:
Let's assume a starting point of some pristine, stable OS installation.It may be a brand new computer, or a used computer restored to factory state, or a clean install from CD/DVD--that doesn't matter. The point is I have a known good, stable, virus-free installation that hasn't been sullied by daily use yet.I make an image and set it aside for a year.

At the end of the year, I first make a note of what new programs were installed over the year that I've kept, then I restore the OS from my pristine, year-old backup image.  I delete all the old WU backup folders (on the principle they've proven over the year that they're keepers).  Then I re-add the new programs that were keepers, and let Windows apply the intervening year's update patches.  (Note this neatly avoids most of the "oops" patches that Microsoft subsequently repatched.)  Then I reimage this updated, pristine installation, and set it aside for another year.

Interesting *imaging strategy*--but, unless I'm missing something, as the years go by you will be gradually adding more and more programs--some of which may cause slight system slowdowns that you are not really aware of at the time--you just know you want to continue to use them.  So those programs build up year after year in your yearly *pristine installation*.  And the gradual additive effect on system performance could slow things down eventually.  Seems like this method just *delays* the process by one year because you only go back one year each time.  (Yes, I understand that you have *cleaned* out the detritus left behind by the various installs and uninstalls--but, you're not really going back to a *pristine* state--just last years state with all the software you had at that time.  Seems like you are still gradually *bloating*.

Don't get me wrong--not *criticizing* the method--I just find it hard to find time to analyze what programs I have installed during the last year and I want to keep, and when I restore back one year, I now have to reinstall all those programs that I didn't keep track of all that well to begin with.

I do regular image backups and special backups before any major program installations or updates or upgrades.  If the system goes down from one of those, I revert to the most recent known good, stable system, and try again or move on.  (Crossing my fingers)--It has worked well so far--and hope it continues in the future  Smiley !


 

____________________________________________________________________________________________

No question is stupid ... but, possibly the answers are Wink !
 
IP Logged
 

NightOwl
Radministrator
*****
Offline


"I tought I saw a puddy
tat..."

Posts: 5801
Olympia, WA--Puget Sound--USA


Back to top
Re: Ghost 2003, Img XP > DVD, INCOMPLETE ??
Reply #21 - Jun 12th, 2012 at 2:35pm
 
@
henriette

henriette wrote on Jun 11th, 2012 at 5:53am:
The idea of a *pristine* image in my case, though, is most unlikely (don't think I have such an image) - couldn't tell

Well, it may not be *pristine*, but you could consider your current system state (assuming it's stable and running smoothly) to be this year's *pristine* starting point, and then go forward with what Dan is suggesting.

But, with WinXP support going away in Aug, 2014, I suspect all the Windows Updates for WinXP will end then too.  I don't know that you would want to restore *last years* backup--because you will loose all the updates between your last years backup and the end date of Windows Update for WinXP.  So if those Updates are no longer available, you loose them.  So make a final *pristine* image that includes those updates through the end date of support for WinXP!
 

____________________________________________________________________________________________

No question is stupid ... but, possibly the answers are Wink !
 
IP Logged
 
Dan Goodell
Special Guest
*****
Offline



Posts: 552
N California


Back to top
Re: Ghost 2003, Img XP > DVD, INCOMPLETE ??
Reply #22 - Jun 12th, 2012 at 4:57pm
 
NightOwl wrote on Jun 12th, 2012 at 2:23pm:
So those programs build up year after year in your yearly *pristine installation*. And the gradual additive effect on system performance could slow things down eventually. Seems like this method just *delays* the process by one year because you only go back one year each time. (Yes, I understand that you have *cleaned* out the detritus left behind by the various installs and uninstalls--but, you're not really going back to a *pristine* state--just last years state with all the software you had at that time. Seems like you are still gradually *bloating*.


No, my strategy is indeed almost as pristine as doing a genuine clean install every year.  If I do a clean install and image it, then add programs A & B and reimage, and then add programs C & D and reimage ... how is the result much different from doing a clean install and adding programs A, B, C & D all at once?

BTW, nothing is ever uninstalled from the pristine image.  Programs A, B, C & D are in the image because I've already determined they're keepers.  If I did a clean install every year, they'd still be included in the reinstall.

To be clear, only programs I'm sure about are added to the pristine image.  Let's say that during the intervening year I've installed programs #1-2-3-4-5-6, uninstalled #2 and decided I don't really use #3 & 6: then I would only add #1-4-5 to the pristine image ... just like my system would be if I did a complete reinstall of everything from scratch.

Programs that I've only recently installed (say, the last 2 months) are never included because it takes me longer than 2 months to decide if a program is really a keeper.  So let's say there's also programs #7-8 that were recently installed:  I'll restore from last year's pristine image, add programs #1-4-5, reimage to update my pristine image, then add programs #7-8 and put the rebuild into service.  A year from now I'll know whether #7-8 are candidates for next year's pristine update.

The most likely exception to the "nothing uninstalled" rule is probably going to be printer drivers.  They may be keepers for several years and then be rendered surplus when you buy a new printer.  In that case, I'll uninstall when updating the pristine image.  (I change printers so seldom, though, that this may only happen once or twice during the lifetime of a pristine image.)

My method isn't completely identical to a yearly clean install, though, because there may be program updates.  For example, let's say my pristine image has version 4 of some hypothetical program, and during the year my in-service system was gradually upgraded to versions 5-6-7-8.  (That's bad for bloat.)  My strategy would have the program jump from ver.4 to ver.8 (that's better) when pristine is reimaged, whereas a genuine clean install would start straight from ver.8 at the outset (that's best).

Nevertheless, the impact on bloat is extremely minor and practically inconsequential.  Sure, there's bloat because of the hundreds of Windows updates, but you'll have that with a clean install, too, so that doesn't count.  What we're looking at is the difference between my strategy vs. a genuine clean install.

Remember, it's not like a daily use system which gradually bloats through 365 days of constant use and updates.  There's one day of updates  *per year*.  If the lifetime of your system is 10 years, that's like subjecting your system to updates only 10 times, as compared to 3,650 times for a system in constant daily use.

To me, the minimal bloat is more than worth it, particularly if the alternative--a genuine clean install once a year--is so daunting that it doesn't get done.  When he started this website, Rad wrote that the best imaging app is the one you'll actually use.  Likewise, a genuine clean install is of no benefit if it doesn't get done.





 
 
IP Logged
 
Dan Goodell
Special Guest
*****
Offline



Posts: 552
N California


Back to top
Re: Ghost 2003, Img XP > DVD, INCOMPLETE ??
Reply #23 - Jun 12th, 2012 at 5:11pm
 
NightOwl wrote on Jun 12th, 2012 at 2:35pm:
with WinXP support going away in Aug, 2014, I suspect all the Windows Updates for WinXP will end then too.  [...]  So make a final *pristine* image that includes those updates through the end date of support for WinXP!

I could be wrong, but I don't think they're yanking the ability to update a XP reinstall.  I think it just means MS won't be putting out any *new* updates after that date.  If you reinstall XP SP3, I think you'll still be able to update it with any updates released prior to Aug 2014.

For instance, MS has already ended support for XP SP2 in Jul 2010.  (The Aug 2014 date is for XP SP3.)  Yet, I can restore an old SP2 image and if there are any updates prior to Jul 2010 that haven't been installed, it will notify me, "Updates are available," and will install them.

Nevertheless, what you say is good advice and recommended practice.




 
 
IP Logged
 
henriette
Technoluster
***
Offline


I Love Radified!

Posts: 147
Heidelberg Germany


Back to top
Re: Ghost 2003, Img XP > DVD, INCOMPLETE ??
Reply #24 - Jun 13th, 2012 at 4:26am
 
Hiya  Smiley

Dan Godell wrote:
Quote:
I don't think they're yanking the ability to update a XP reinstall.  I think it just means MS won't be putting out any *new* updates after that date.  If you reinstall XP SP3, I think you'll still be able to update it with any updates released prior to Aug 2014.

I was told the same.

Apart from that, there are *offline update packs* available (German/English language - scroll down a bit for English):
http://www.wsusoffline.net/

... + other links in German language only.
That should be the least problem  Wink

My present XP is running fine.

XP3 came already with my XP-installing-CD.
Not so e.g. IE8 etc.!
One of the many reasons why I wouldn't want to restore images from ages ago  Roll Eyes

I'll stick with _my_ imaging method, as long as there's no major problem.

The only thing that scares me is catching an MBR-virusShocked
IMHO there wouldn't be any other way to get rid of it than doing a fresh XP install. Perhaps I will not see that day.

note: *repair console* (or what you call it) doesn't work on my PC, the option was not available when trying it once [file missing or something ...]. Maybe one has to install the *repair console*.

Be it as it may, I'm getting old & bold ... hoping for the best  Grin

henriette  Smiley
 

The problem's not the computer - the problem sits right in front of it ...
 
IP Logged
 
NightOwl
Radministrator
*****
Offline


"I tought I saw a puddy
tat..."

Posts: 5801
Olympia, WA--Puget Sound--USA


Back to top
Re: Ghost 2003, Img XP > DVD, INCOMPLETE ??
Reply #25 - Jun 13th, 2012 at 8:49am
 
@
henriette

Quote:
The only thing that scares me is catching an MBR-virus.   
IMHO there wouldn't be any other way to get rid of it than doing a fresh XP install.

Actually, having Ghost backup images can *save the day*!  You have to use a utility in DOS that can *zero* the MBR.  A simple re-format does not automatically create a new MBR that would wipe out a MBR virus.

If you are doing *whole disk* images, then Ghost 2003 will put the MBR that was present when you made that particular image--so it would have to be an image that was pre-MBR virus infection.  This only occurs if an existing HDD has had the MBR wiped clean--which means the virus is gone too.

If you are doing only *partition* images, it's a little more complicated--because restoring a partition image to a partition requires that there be a partition already there as a destination.  You can, however, tell Ghost 2003 to do a *Partition-to-Disk* (that's *whole disk*).  Now Ghost will restore that partition to a HDD that has no partition--and the MBR from when that image was taken will also be restored.  Again the HDD has to have a *zeroed* MBR.  And, I can't remember for sure--but, I think you will get the opportunity to specify how much of the destination HDD should be used.  So, if the OS image comes from a source HDD that had multiple partitions, you would restore the OS partition using *Partition-to-Disk*, and then create the other partitions later.

So, the key, is *zeroing* the MBR before the restore of the image!

Quote:
note: *repair console* (or what you call it) doesn't work on my PC, the option was not available when trying it once [file missing or something ...]. Maybe one has to install the *repair console*.

You can install the *Recovery Console* on your HDD--but, it will take up a bit of room--maybe push you over to that second DVD when backing up.  You can also use the WinXP installation disc to boot from, and from there elect to load the *Recovery Console* from the CD.  And, the Recovery Console, with the correct command, can replace the viral infected MBR with a new MBR from the Console.  That process too solves the MBR viral problem!

Here's a Google search with relevant links:  installing WinXP recovery console



 

____________________________________________________________________________________________

No question is stupid ... but, possibly the answers are Wink !
 
IP Logged
 

Dan Goodell
Special Guest
*****
Offline



Posts: 552
N California


Back to top
Re: Ghost 2003, Img XP > DVD, INCOMPLETE ??
Reply #26 - Jun 13th, 2012 at 5:05pm
 
henriette wrote on Jun 13th, 2012 at 4:26am:
The only thing that scares me is catching an MBR-virus.  IMHO there wouldn't be any other way to get rid of it than doing a fresh XP install.

Not true.  A full-disk image can easily restore everything, but even with separate partition images you can completely wipe the HDD so nothing's on it, create fresh empty partitions, then restore each partition from its image.  You'll have to go on memory to determine your partition sizes, but it doesn't have to be exact so that's usually not important to people.

NightOwl discusses whether the MBR bootstrap code gets restored, but understand the bootstrap code is nothing special.  Many partitioning utilities may add generic or common bootstrap code if they see the HDD doesn't already have it.  Even if they don't, it's easy to recreate.

There are two kinds of MBR or boot sector viruses.  The more sinister kind actually moves your partition table to its own location and zeroes the original, so if you boot through the virus your partitions are all there, but if you remove the virus your partitions appear to be gone, too.  (They actually aren't, but most users don't know that and end up reformatting, thereby killing the hidden partitions themselves.)

If you want to protect yourself, either make a whole-disk image, or if you use partition images then backup the MBR separately.  Terabyte's freebie, MbrWork, is great for that.  Use it to backup Track 0.  If/when the time comes, a full disk restore can be accomplished by using MbrWork to restore Track 0 (which will restore your virus-free MBR and partition table), and then restoring the contents of each partition from your images.



 
 
IP Logged
 
henriette
Technoluster
***
Offline


I Love Radified!

Posts: 147
Heidelberg Germany


Back to top
Re: Ghost 2003, Img XP > DVD, INCOMPLETE ??
Reply #27 - Jun 14th, 2012 at 10:38am
 
Huh Huh Huh

NightOwl wrote:
Quote:
the key, is *zeroing* the MBR before the restore of the image!

How to do that  Embarrassed


NightOwl wrote:
Quote:
You can also use the WinXP installation disc to boot from, and from there elect to load the *Recovery Console* from the CD.  And, the Recovery Console, with the correct command, can replace the viral infected MBR with a new MBR from the Console.  That process too solves the MBR viral problem!

As I said, I tried that once. I think it didn't work because I was asked to insert a floppy, which I don't think I have.
Is that possible  Huh > XP CD = XP SP3 professional.

Whatsoever - I don't want to install/use the *recovery Console*. Seems too complicated.


FYI: I create images of C:\ only,,, to my 2nd internal HDD | 1st partition. lack of space!!!, since Ghost 2003 won't recognize my 1.5TB external HDD = too big].

Just once I created a *whole-drive-image* (just enough space on HDD 2), when I had to replace my HDD ~ 1 year ago, then I restored the image to the brandnew HDD. Thanks to NightOwl's  Kiss detailed instructions it worked excellently   Smiley

I do intend to create another *whole-drive-image* to HDD 2 (internal | 1st partition). Just thought I'd wait for another while. > Both internal HDDs had been replaced by brandnew ones about 1 year ago.

Dan Godell wrote:
Quote:
if you use partition images then backup the MBR separately.   Terabyte's freebie, MbrWork, is great for that.  Use it to backup Track 0.  If/when the time comes, a full disk restore can be accomplished by using MbrWork to restore Track 0 (which will restore your virus-free MBR and partition table), and then restoring the contents of each partition from your images.

Huh ---> Why couldn't I _if I knew how to accomplish that *zeroing MBR*_:
1. restore an image of C:/ (= Ghost image)
2. Copy back the data onto the other partitions (I *create* regular up-to-date backups of each partition!) - no Ghost images, though.

Please understand that I have to read your posts over & over again to *get* what I'm supposed to do at all ...
...  Undecided ... how do I *zero* the MBR --- where is "it situated" and so far ...

> I will do a search for MBR in German, maybe I'll understand  Tongue

henriette <confused>

 

The problem's not the computer - the problem sits right in front of it ...
 
IP Logged
 
henriette
Technoluster
***
Offline


I Love Radified!

Posts: 147
Heidelberg Germany


Back to top
Re: Ghost 2003, Img XP > DVD, INCOMPLETE ??
Reply #28 - Jun 14th, 2012 at 11:46am
 
I read WIKI + found an article that UBCD (Ultimate Boot CD)
http://www.ultimatebootcd.com/

should do the trick.

Users say in forums: "bootrec /fixmbr".

Just what tool should I use ?

questions:
Would that also work if I had a virus ? I mean, would I get rid of a boot virus by using just that ?
I presume that the HDD (partly, at least) would be wiped.

What & how to do before & after  Huh ... Wow, it's getting most weird  Cheesy

Prerequisite is that my PC is booting, of course.

note: I've used UBCD for years, checked HDDs + RAM.

henriette  Smiley


 

The problem's not the computer - the problem sits right in front of it ...
 
IP Logged
 
Dan Goodell
Special Guest
*****
Offline



Posts: 552
N California


Back to top
Re: Ghost 2003, Img XP > DVD, INCOMPLETE ??
Reply #29 - Jun 14th, 2012 at 4:18pm
 
Some Definitions:

The MBR ("Master Boot Record") is in the first sector (LBA 0) of the first track (Track 0) of your HDD.  This sector contains your partition table, a randomized DiskID (to differentiate disks), and bootstrap code.  In some contexts, "MBR" refers to just the bootstrap code, while in others it is used to refer to the entire first sector--all three parts.  (Less commonly, some references may also refer to the MBR as being the entire first track.)  The lesson here is don't take the term too literally when reading various articles because you may not be sure what, exactly, they're referring to.

Track 0 is not part of any partition--hence, why it is not typically captured in a partition image.  Think of it like a book with chapters and a table of contents.  Your partitions are the "chapters" and Track 0 contains your TOC.  If you photocopy just one chapter from a book, you don't usually also copy the TOC.

A whole-disk image will capture all parts.  Alternatively, you can achieve the same result with individual images of each partition plus a Track 0 backup.

It's okay that you're not imaging your data partition--I don't, either.  Like you, my data is backed up by copying, not imaging.  Only the OS partition requires imaging.  So the equivalent of a whole-disk image would be a Track 0 backup, an image of the OS partition, and duplicates of all your data files.


Viruses and the Boot Process:

When your computer boots, the BIOS does its thing and then turns control over to the first sector, LBA 0, on the HDD.  You computer would hang at that point if there's no bootstrap code there.  The bootstrap code's job is to continue the boot process by determining which partition in the partition table control should be transferred to.

A boot sector virus (aka, MBR virus) is one that replaces the LBA 0 bootstrap code with itself.  The more sophisticated/sinister viruses will also move the partition table.  So, if you boot through such a virus the process goes BIOS > infected LBA-0 > alternate partition table > OS partition.  Everything appears to be there, infection notwithstanding.

If you subsequently replace the bootstrap code to remove the virus, the boot process now goes BIOS > LBA-0 > real partition table > hang.  If the real partition table hasn't also been repaired, the repaired bootstrap code will think your hard disk has no partitions.  Understand, however, that the virus only tinkered with your "table of contents" here, not your "chapters".  If the TOC says there are no chapters, the bootstrap code isn't sophisticated enough to figure out they may actually still be there.  As I mentioned, this is where many users go wrong.  Instead of repairing the partition table, they think the virus deleted their partitions so they reformat and start over, thereby destroying the partitions themselves instead of recovering them.


Repairing the MBR:

When NightOwl referred to zeroing the MBR, that was strictly in the context of inducing Ghost to restore the MBR bootstrap code (if it had saved it).  I think he was saying that Ghost doesn't restore bootstrap code if it sees something there already, so zeroing the MBR is meant to trick Ghost into restoring the copy (if it made it) of your bootstrap code.  However, use MBR-clearing tools with caution.  Most tools that clear the MBR will also clear the partition table, so only use them if you have other means of repairing or restoring your partition table.

If you're going to be restoring your bootstrap code by other means, you don't need to zero the MBR.  All you need to do is overwrite whatever is there, zeroes or not.

The "bootrec /fixmbr" command is Microsoft's command to replace the MBR bootstrap code with known good code.  It does not alter the other parts of LBA 0 or Track 0, such as the DiskID or partition table.  That will get rid of the virus, and you don't have to zero the MBR first.  However, that alone won't be enough if the virus was sophisticated enough to move your partition table.

FYI, note that "bootrec /fixmbr" is not concerned with restoring the exact bootstrap code you had before, it simply says, "We don't know what you had before, but we know this code works so that's what we're using."  (That's what I meant when I earlier said the bootstrap code wasn't anything special.)

In contrast, MbrWork backs up and restores what you actually had.  It not only backs up all of LBA 0 (the bootstrap code, the DiskID, and the partition table), but goes further and backs up all of Track 0.  When you restore Track 0, you end up restoring all three parts of LBA 0, so even if the virus had moved your partition table it won't matter because MbrWork is restoring your saved partition table, too.

There are similar tools that can backup and restore LBA 0, and will work as well.  What I like about MbrWork is it backs up more than just the first sector.  If you've installed a multiboot manager, for instance, it not only replaces your generic bootstrap code with the multiboot manager, it typically needs to put extra code in other sectors of Track 0.  Backing up only LBA 0 may not be enough to backup your multiboot manager, so if you should need to restore from that backup you'd probably need to also reinstall the multiboot manager.  Backing up all of Track 0 may be able to ameliorate that.

It's not always necessary to backup more than LBA 0, but I don't bother trying to figure out whether I need to or not.  The backups are tiny, so I backup all of Track 0 as a matter of routine.




 
 
IP Logged
 
Pages: 1 2 3 4 5
Send Topic Print