Author Topic: Remember to make full drive image backups (Read 19937 times)

mouser · « **on:** October 14, 2012, 11:37 AM »

A family member recently got hit with a nasty malware virus (File Recovery Virus).
The steps required to remove it are numerous and painful, and there is no guarantee you'd get everything.

Let this be a reminder to everyone that the idea of removing all traces of a nasty malware/virus after you are exploited is at best a very troubling solution.

You cannot guarantee you won't be hit by one of these, but the best thing you can do if you are, is have a FULL DRIVE BACKUP on an external hard drive that you can restore, to put your machine back to where it was before the infection.

If you don't yet have a drive imaging tool and an external hard drive, go out and get these now.

It doesn't really matter which brand you use, and many of the external hard drives come with imaging software included.

Decide on a schedule (like once a month) to perform a full drive backup, and follow it religiously.

I'd also add that for optimum safety you probably want to keep that external drive disconnected when not being used for backup, to avoid the possibility that a really evil malware could wipe it -- though that's unlikely.

Bottom line -- put yourself in a position where you don't have to go through the hell of trying to clean your files of an infection and hope you can get all the bad stuff removed and never know for sure. Have a drive image you are willing to go back to.

40hz · « **Reply #1 on:** October 14, 2012, 02:14 PM »

+1 x 10^24!

What we suggest to our non-techy clients for their personal machines:

1. Set up your PC with at least 2 partitions C & D.

2. Put your OS and programs on C

3. Move your MyDocuments folder to D

4. Make a habit of saving all your data to folders on the D drive if you don't like the using the MyDocuments folder for everything.

5. Download a copy of Macrium Reflect Free Edition. Install it and follow the directions for making a rescue CD. Make at least two copies. Store the disks in a safe place.

6. Use Macrium to copy the C (system) partition to an external drive either bi-weekly - or after any major system upgrade or new program installation. Keep the two most recent copies.

7. Use Macrium to copy the D (data) partition to an external drive at least once per week - although daily or every other day would be best. Just kick it off when you're done for the day and walk away. Keep your two or three most recent copies.

8. Stop worrying.

Note: this is far from ideal from an efficiency viewpoint. But it's as close to "no-brainer" as we can make it. Fortunately, once set up, it's easy enough for the most technophobic user to handle and understand.

Carol Haynes · « **Reply #2 on:** October 14, 2012, 02:30 PM »

By the way if you rely on Windows 7 backup for imaging I discovered it no longer works on 3Tb drives (or any drive that has a 4mb block size). Seems Windows backup is optimise for 512kb block size.

Very annoying as a customer just bought a 3Tb Seagate drive to do backups.

It is supposed to be fixed in Windows 8.

FWIW Paragon Free Backup and Recovery seems to do a good imaging job, though it lacks a lot of the subtlety of their paid offerings.

NigelH · « **Reply #3 on:** October 14, 2012, 02:46 PM »

Partition level back tools are somewhat unreliable - even if they offer file level recovery from their image backups.

I'd add a 3rd level of backup.
Use a folder synchronization tool to backup your important data folders to separate external drives or machines with shared folders.
Make sure you do a one way sync - targeting the remote folders.
That way, if you accidentally delete something, the deletion is not sync'd to the remote folders and you can reverse the direction of the folder sync to restore what was deleted. Or to delete from the remote folders what you intentionally deleted on the primary.
Folder level synchronization is also very quick comparatively.
There are free options for this as well as paid options.

If this (conceptually) is difficulty for you to do, get a copy of Fab's AutoBackup 3 (EUR 4.90 or $6.50 ).
Fabs "knows" about most of the default folders on all recent Windows releases and will backup your important stuff.
You can also add separate folders to the backups.
If you restore, it knows how to put everything back in the correct place even if you restore from backups made on an XP machine to a Windows 7 or 8 machine etc.
Fab's backups are "full" backups, i.e. all your data files each time, so this takes a while. But if you start running of space on your target drive, you can delete the older backups.
Fab's Autobackup tools

rjbull · « **Reply #4 on:** October 14, 2012, 02:53 PM »

have a FULL DRIVE BACKUP on an external hard drive that you can restore
-mouser (October 14, 2012, 11:37 AM)

How many levels of old backups is it recommended to keep?

mouser · « **Reply #5 on:** October 14, 2012, 03:15 PM »

How many levels of old backups is it recommended to keep?

as many as you have room for?

the important thing is to understand WHY you dont just want *one* backup -- and that's because it's too easy to end up in a situation where your one last backup was made AFTER the actual problem started -- or worse that it's damaged.

so ideally you'd like a bunch of backups made at different times, so that if you need to you have some options about how far back to restore.

Shades · « **Reply #6 on:** October 14, 2012, 03:50 PM »

Partitionguru by Eossos. Their freeware version (v4 I believe) I have been using lately to fix several Windows PC´s.

This is a piece of software that really belongs in any tech´s toolkit. It easily trumps Partition Magic (in their good days!) and has the abilities of Norton Ghost as well. And I liked the amount and lay-out of shortcut keys, I had no trouble doing all the fixing without a mouse.

The only disadvantage I could find is that the english is not always correct...well, not as I would have translated it. Its origins lie in the Orient (China). Please don´t let this stop you using this brilliant piece of software.

40hz · « **Reply #7 on:** October 14, 2012, 05:35 PM »

Partition level back tools are somewhat unreliable
-NigelH (October 14, 2012, 02:46 PM)

???

Beside Acronis TrueImage's problems a while ago, is there another one you had in mind?

- even if they offer file level recovery from their image backups.

Why would they want to offer file level recovery from a partition image? That's what a traditional backup or sync utility is for. Or going with realtime drive mirroring. Extracting individual files from an image sounds like a good way to risk damaging the integrity of the image.

I was always under the impression that disk and partition images were intended to be used for "all or nothing" recoveries. Did somebody try to create a hybrid?

Carol Haynes · « **Reply #8 on:** October 14, 2012, 06:10 PM »

Why would they want to offer file level recovery from a partition image?
-40hz (October 14, 2012, 05:35 PM)

One of the things I like about Paragon is that you can 'mount' the images as read only drives and recover individual files and folders using normal Explorer methods. This can be handy - but I take your point that file backups are best done with appropriate tools.

I used to like that feature in Acronis but have given up using their bloated bugfest sometime ago when they caused me a lot of embarrassment with clients having recommended their tools. Ever since Acronis TrueImage Workstation 9 it has been a disaster with inconsistent (and random) VSS errors, corrupt archives, random errors with no explanation. They keep adding features - I just wish they could get back to basics and do the simple things well again.

40hz · « **Reply #9 on:** October 14, 2012, 06:37 PM »

One of the things I like about Paragon is that you can 'mount' the images as read only drives and recover individual files and folders using normal Explorer methods. This can be handy - but I take your point that file backups are best done with appropriate tools.
-Carol Haynes (October 14, 2012, 06:10 PM)

Oh I agree with you. It does sound very handy. But it still makes me nervous since it's one more thing that can break. And Murphy's presence is inescapable in our line of business.

I used to like that feature in Acronis but have given up using their bloated bugfest sometime ago when they caused me a lot of embarrassment with clients having recommended their tools.
-Carol Haynes (October 14, 2012, 06:10 PM)

Makes two of us. I actually ended up buying back several copies from clients I had recommended it to. Something that caught me by surprise since TrueImage had worked very reliably up until version 8 based on my experiences.

f0dder · « **Reply #10 on:** October 14, 2012, 07:05 PM »

By the way if you rely on Windows 7 backup for imaging I discovered it no longer works on 3Tb drives (or any drive that has a 4mb block size). Seems Windows backup is optimise for 512kb block size.
-Carol Haynes (October 14, 2012, 02:30 PM)

Wouldn't that be 4kb and 512byte sectors? Interesting if that's preventing a backup utility from working.

Also, mouser, why specifically recommend image-based backups? Sure, it's faster to restore an image than doing a clean reinstall, but other than that? Isn't the most important thing to have backups, and to have several revisions of each file so that you don't overwrite a valid file backup with a corrupt or ransomwared copy? (And yes, it's a good idea to only have the backup drive connected when backing up - even if you don't get hit by a nasty, there's oversurge from lightning or cable cutting fsckups).

mouser · « **Reply #11 on:** October 14, 2012, 07:17 PM »

Also, mouser, why specifically recommend image-based backups?

I've always advocated for a dual approach to backups:

Image entire drives once a month or so.
Keep versioned backups of your documents on a daily basis.

And that remains the soundest advice.

Versioned backups are to protect you from something going wrong with one of your files.
Drive Images are to let you go back to a known good complete computer state.

I wouldn't ever go with just one. If you don't do a lot of document creation/editing you could get away without the versioned backups as long as you drive image frequently and occasionally backup your documents to a usb stick, etc.

I'd hate to be without drive image backups though -- they let you get back up to a running state after a catastrophic hard drive crash or system-wide infection, etc.

NigelH · « **Reply #12 on:** October 14, 2012, 08:17 PM »

Beside Acronis TrueImage's problems a while ago, is there another one you had in mind?
-40hz (October 14, 2012, 05:35 PM)

Acronis was a case in point. But we're talking about relying on the integrity of a single multi-gigabyte file. I suspect many 100s of gigabytes for many people.
Not something I want to trust fully. I don't know how many of these tools are able to handle damaged clusters in an image file on a backup drive.

Extracting individual files from an image sounds like a good way to risk damaging the integrity of the image.
-40hz (October 14, 2012, 05:35 PM)

This was answered by Carol, but your question surprised me seeing that extraction is referring to just reading data from an image file.

Nevertheless, as long as you have your personal data backed up using any competent backup/sync tool, you can recover.
Unless your machine is old, you can't buy a restoration disk from the vendor to put the OS back and you don't know how to get around that.

Carol Haynes · « **Reply #13 on:** October 15, 2012, 02:54 AM »

Wouldn't that be 4kb and 512byte sectors? Interesting if that's preventing a backup utility from working.
-f0dder (October 14, 2012, 07:05 PM)

Sorry yes - brain addled!

Carol Haynes · « **Reply #14 on:** October 15, 2012, 03:03 AM »

why specifically recommend image-based backups?

Both types of backup are useful but with incremental and differential options for image based backup - plus image mounting to retrieve files it can satisfy all needs with just image backups.

The big question is 'do you trust the software to produce faultless images'.

In the case of Acronis I no longer do - I have seen too many failed backups, too many images fail to validate.

Experience so far with Paragon has been good - plus it has the option of backing up offline (using the Windows based recovery disk) if you do come across online issues (which I haven't).

Acronis allows mounting of images in both R/O AND R/W - the latter I think is particulalry stupid and I would never trust Acronis to 'touch' files in images via Explorer - seems like the ideal way to kill an image. I have never really understood why they thought this feature was necessary.

Paragon allow R/O mounting and I don't see any reason why this should damage the image since you are not making changes to the file.

The biggest issue with image files AFAICS is, assuming they are produced without error, the problem of a single bad block appearing on the hard disk rendering the whole image unusable. I have seen no mention from any of the major software houses on mitigation for this issue and when you are talking about images potentially in the 100s of Gb soor or later there is going to be a block error.

IainB · « **Reply #15 on:** October 15, 2012, 04:08 AM »

The big question is 'do you trust the software to produce faultless images'.
In the case of Acronis I no longer do - I have seen too many failed backups, too many images fail to validate.
-Carol Haynes (October 15, 2012, 03:03 AM)

Yes, very good point. After doing any kind of backup, it's a good idea to test it to see if it really works in the restore operation. It's a bit too late to leave that test till you have to carry out a real live restore...

I hadn't heard about Acronis failing to do proper backup/restore. That's a bit scary isn't it? Though I've never used it myself, I had rather gained the impression that it was widely used and recognised as a Good Thing.

nudone · « **Reply #16 on:** October 15, 2012, 04:10 AM »

Just thought I'd mention a couple of issues I encountered that meant my "typical" backup routine didn't work anymore.

Problem 1)
Usually I'd use Paragon or Acronis, no real preference between them, but recently found that such things don't like backing up encrypted drives. Well, Acronis will backup an encrypted system drive but the problem is how do you then recover the backup without a lot of messing about, i.e. creating custom boot disks to deal with the encryption issue or some other convoluted procedure because you can't read the backup (maybe I haven't tried hard enough to find a suitable solution).

Because of this I've abandoned backup programs that make an image file and just use EaseUS Disk Copy http://www.easeus.com/disk-copy/ to make an exact duplicate of the encrypted system drive to another drive. So, this creates a bootable encrypted system drive. I like this method as if a drive dies it will only take me about 1 minute to swap it for its duplicate. (I duplicate the drives about once a month.)

Problem 2)
I've happily used MirrorFolder http://www.techsoftpl.com/backup/ for years to make duplicates of all my important data. Since moving to Windows 7 64 bit and an SSD system drive I started getting regular bluescreens when saving MS Office documents (regardless of Office version). After lots (weeks) of messing around trying to resolve this problem I finally found one single comment somewhere onilne that hinted that MirrorFolder could be the problem - and simply disabling MirrorFolder wasn't enough (which I'd already tried) - it had to be uninstalled (to remove the driver). It worked, MirrorFolder is gone and my system is now super stable.

As a replacement I'm using Allway Sync (pro version) to do all the data backup. I don't use it to do "realtime" duplicates but it seems to work perfectly well backing up after a few seconds of drive inactivity (there are lots of rules you can implement, of course).

As for revisioning, I realise I may have a problem with the encrypted system drive as I may be also duplicating problems from drive to drive. I've not got a good solution for this - using Acronis to make the occasional backup seems to be the answer; it would be acceptable as a last resort, though, I'd have all the issues of restoring the image.

All my important data is also revisioned (kind of) to two external drives. Rotating these so that one remains off site after the backup is done.

f0dder · « **Reply #17 on:** October 15, 2012, 05:56 AM »

Experience so far with Paragon has been good - plus it has the option of backing up offline (using the Windows based recovery disk) if you do come across online issues (which I haven't).
-Carol Haynes (October 15, 2012, 03:03 AM)

Do they still have the offline feature? I received a mail a while ago wrt. Paragon Virtualization Manager, that due to Micrsoft sumfinsumfin they would no longer be able to offer the WinPE based rescue disks :/

The biggest issue with image files AFAICS is, assuming they are produced without error, the problem of a single bad block appearing on the hard disk rendering the whole image unusable. I have seen no mention from any of the major software houses on mitigation for this issue and when you are talking about images potentially in the 100s of Gb soor or later there is going to be a block error.
-Carol Haynes (October 15, 2012, 03:03 AM)

You shouldn't have an entire image ruined because of a single sector error, as image compression is normally done in blocks rather than image-wide... but it will still affect a larger block than a single sector, which can obviously be disastrous (registry hivefiles, executable files, or some of your important damage). Plus, I dunno how restoration deals with these errors - ideally you should be able to let the restoration continue, but get a list of smashed-up files, but I wouldn't be surprised if most software goes "sorry, failed, bummer mate."

PS: never back up (solely) to usb flashdrives, they're way too unreliable.

Stoic Joker · « **Reply #18 on:** October 15, 2012, 06:42 AM »

http://support.kaspe...m/viruses/rescuedisk

Free effective external scan, does wonders for cleanup of all sorts of evilware.

Also, while imaging is fun in a techy sort of way ... The in-box Windows backup actually does work quite well. Mine runs nightly to a network location and affords the option of doing a complete restore from several different versions of the system.

tomos · « **Reply #19 on:** October 15, 2012, 06:46 AM »

Two questions (first is answered I think):

1) [what's the online/offline thing with Paragon?] OK - found this (I think correct):
'online' is image made while windows is running;
'offline' = windows not running - presumably with boot cd then

2) is it important to also create an image (or regular images?) of the 100mb hidden partition in Windows 7?

edbro · « **Reply #20 on:** October 15, 2012, 07:27 AM »

I use a 3 point strategy. When I originally install a new OS I set it up just how I like it and image it before I install any other software. Now, I'm never more than 20 minutes away from a fresh, clean install. I sometimes create a differential image after installing my software but I prefer to reinstall them manually after applying the base image.

For file backups I use Syncback Pro to backup to my NAS.

For versioning I rely on Dropbox to do that for me. I've had occasion to use this feature and it is really good.

Carol Haynes · « **Reply #21 on:** October 15, 2012, 08:22 AM »

Paragon still provide WinPE start up disks but not prebuilt. You have to download and install Windows AIK from MS then use Paragon's tool to build the disk. Previously they provided an ISO prebuilt. You can also burn a Linux startup CD version but I prefer to use WinPE with pure windows systems as I have had a few issues with Linux based boot CDs in the past.

SyncBack Pro, SE or even free provide a good solution for making mirror backups, even across a network.

I still use FileHamster for versioning.

mouser · « **Reply #22 on:** October 15, 2012, 10:00 AM »

You know what thing we need to add to our "kit" of tools recommended for dealing with data loss situations is: A second PC.

A decade ago that advice would be impractical for most folks due to the price of computers. But these days, having a second PC you can use to help you deal with data loss situationsis practical and extremely helpful -- i dare say essential.

Whether it's being able to surf the web, download stuff, burn cds, copy hard drives, etc., a second PC makes recovering from data loss a million times easier.

40hz · « **Reply #23 on:** October 15, 2012, 10:08 AM »

Also add a "live" bootable Linux CD/DVD (or USB key) to the toolkit.

You don't need one of the "system rescue" distros either. Anything with a a Gnome desktop (to make things easy for a Windows users) will do.

When Windows flat out refuses to boot, juts pop in the CD/DVD/USB key, boot from that, and move your files over to an external drive.

Far from ideal - but at least you'll be able to copy your data off the harddrive without too much of a hassle prior to reformatting and reinstalling Windows.

Sometimes when things go completely south and your images and backups aren't working (for whatever reason) this is your only alternative.

SeraphimLabs · « **Reply #24 on:** October 15, 2012, 12:02 PM »

I actually don't bother backing up the workstations at work.

Everything important on them is saved to the company server, and all of the software they use has the installers in a secure on-site archive.

Then what happens is if a workstation gets damaged, wipe and reload with a max typical downtime of 2 hours.

The server itself stores everything on a RAID1 array, with twice-daily rysnc to an external hard drive, and a weekly encrypted rsync to an offsite server.

Always make 3 copies of anything important, and store them separately.