Preparing for cataclysmic OS failure.

[Bender Blues]

W10

Assuming the small steps (sfc, restore point etc) all fail, I'm a bit confused on where to start. 

 

What does one need to do, is it having a repair USB stick at ready? I've read theres a lot more but not sure whats needed the most.

What procedures and steps can be done so when there's a meltdown, you're ready to try and restore?

 

* The goal is to restore and keep as much of the OS in tact and in its working state as it was before carnage arrived. 

 

Thank You!

 

 

 

 

[Needfuldoer]

7 minutes ago, Bender Blues said:

The goal is to restore and keep as much of the OS in tact and in its working state as it was before carnage arrived. 

Then you want full system disk images. That's saving a copy of your entire PC in its current state at the time of the backup.

 

 

A mirrored boot drive would protect you from hardware failure, but not viruses and accidentally deleting weddingvideo.mp4.

 

Of course, the most important thing is to make backups of your important documents and keep said backups up to date. Follow the 3-2-1 rule: keep 3 copies of your files, on 2 different types of media, at least 1 of which is stored off-site.

 

USB FLASH DRIVES ARE NOT GOOD BACKUP MEDIA.

[Bender Blues]

39 minutes ago, Needfuldoer said:

Then you want full system disk images. That's saving a copy . . . . . 

lol, I remember that video when it came out, the meme dude 

 

OK, thats the ultimate, a mirror of the OS.

Whats the next step down, having a repair tool ready on USB? Or whatever tool(s) are needed?

 

TY!

[RollyShed]

1 hour ago, Bender Blues said:

W10

What procedures and steps can be done so when there's a meltdown, you're ready to try and restore?

We had total wipe-out and Microsoft deleted everything and went it back to Win7.

 

The fix?

That computer now only runs Linux so it never fails.

Everything had been backed up to the Linux disk before wipe-out.

[maplepants]

On 10/5/2022 at 9:26 PM, Needfuldoer said:

Then you want full system disk images. That's saving a copy of your entire PC in its current state at the time of the backup.

The downside with this method is testing.

 

Any backup solution that you haven't tested is worthless. This is because a backup that you can't restore, or doesn't restore what you wanted, is the same as no backup at all.

 

So if you're going to backup full system disk images then you need to have a plan to test them too. And you test them by completely restoring from backup, a pretty huge task.

 

I would encourage you to plan backup strategy that focuses on the files you care about, and not the state of your OS. Unless your setup is very unusual, restoring your OS settings manually, restoring your games from something like Steam, and restoring your apps through something like Ninite should be easier and more reliable than full disk images.

 

Personally, I backup my Windows files to my NAS using Genie Timeline Home 10, and to the cloud using Backblaze. 

 

This is also extremely easy to regularly test because you just need to restore a single file from local and cloud backup and you're set. 

[Herr.Hoefkens]

actually, your probably best of downloading a linux live usb , using a different pc ofc ,  or placing the drive itself in a different pc running linux (if possible using a decent disk dock, but internal wil do.) ,

note pick a linux distro that has the Paragon Ntfs3 diver build in by default or atleast has it readely available in its packagemanager , (preferably without the ntfs-3g also being on the system to avoid confusion) , this wont be needed in the initial stages but will come in handy later.

 

avoid also any automounting tools or helpers. make sure you have atleast the same amount of free disk space in a single empty piece.

pick your poison :

• dd (good old dd) : `dd is a utility used to copy raw data from source to sink, where source and sink can be a block device, file, or piped input/output. `
• ddrescue6` ddrescue is a tool provided by GNU to retrieve data from failing (block) storage devices like disk drives, CDROMs, or memory sticks, etc. It uses a similar technique as dd and copies block by block, but has an intelligent algorithm to recover failed data. `
• dcfldd: is an enhanced version of GNU dd with features useful for forensics and security.
• pv : (Pipe Viewer) is a command line tool to view verbose information about data streamed/piped through it. The data can be of any source like files, block devices, network streams etc. It shows the amount of data passed through, time running, progress bar, percentage and the estimated completion time
• some custom scripts prolly using one of the ones above or combinations of them anyway

 

make a complete image of  the drive , that is the whole device , not just the partition  you want.  when done and it worked without to many hickups great, if it failed halfway trough or more times, dont panic , dd allows you to reastart with an offset so you can continue where you left off, you might need to disconnect the disk from power for a while and let it cool down before resuming, if it keeps failing on the same spot , increase the offset as needed. when you reached the end , unplugg the disk and dont touch it no more , if all went to plann the disk should not have any extra damage , unless the disk was failing due to physical problems (in wich case only a cleanroom/lab and a willing and experienced recovery expert. use the image of the disk to verify the integrety of the data on the partitions , you can mount the partitions run checkdisk , if  problems occur, testdisk is your friend, if everything checks out or nothing to worse turns up, you can use the image , in a Virtual machine , boot that vm with a windows install iso , and try thee test features privided by the e install environment to check for any defects and fix them if any show up : this might help  :

On 8/17/2021 at 11:45 AM, Herr.Hoefkens said:

here is a list of steps you can follow (without much risk) to fix & test a possibly broken windows installation, without losing any data or having to reinstall windows/software: (run antivirus (if you have one) and spyware removers first ofc)

 

open command prompt as administrator [start]>type "cmd" rightclick on command prompt and click "run as administrator"  and

1 the basics:

c:\> chkdsk c: /f
c:\> sfc /scannow
c:\> chkdsk c: /r /f 		#it will request to run this at next boot save your work and say yes and reboot

you can run the following in a booted windows environment or in windows RE (recovery) you can get to windows RE by booting from a bootable windows usb/cd and choose repair on the  first screen in the setup(left bottom of the window) > and choose comman  prompt on the next.

2:More advanced:

the next are a little more advanced and are preferable done from RE /Safemode (but are not required to be run from RE nor Safemode)

howto get into safemode or RE from a booted windows hold [SHIFT] [and keep holding) whille pressing( [start]/[power]) > reboot 

DISM /Online /Cleanup-Image /ScanHealth
DISM /Online /Cleanup-Image /RestoreHealth

3: if the system image is corrupted as well you can use a (freshly downloaded (run  MD5 check to be sure its a good one ) ) Windows installation image to compare and repair yours.: 

mount the windows 10 iso and:

*where E: is the driveletter of the mounted iso)

**in windows 10 it wil be mounted if you double click by default but if it opens winrar or any else you can still mount it by : [right click] >open with>  explorer.

and run the following in a cmd with administrator rights

DISM /Online /Cleanup-Image /RestoreHealth /Source:E:\Sources\install.wim

 

finally try booting the image in the vm, if it goes file , use dd again to write everything to a new drive, and windows wont be any wiser on what happend and continue to run as good ar bad as it does witouth imminent failure

 

here are some dd scripts/ wrappres i wrote a while back, that may ease up the process as dd does not come with a verry usable progress bar or stats  :

https://github.com/hoefkensj/Scripts/blob/master/sh/biddcopy.sh :

(pv -n $1 | dd of=$2  bs=16M conv=notrunc,noerror) 2>&1 | dialog --gauge "Cloning $1 to $2 ..." 10 70 0

https://github.com/hoefkensj/Scripts/blob/master/sh/pipedd.sh :

#!/usr/bin/env bash
SIZE1=$(lsblk -bdno SIZE $1 2>/dev/null)
SIZE2=$(lsblk -bdno SIZE $2 2>/dev/null)
[[ -z "$SIZE1"  ]]  && SIZE="$SIZE2"
[[ -n "$SIZE1"  ]]  && SIZE="$SIZE1"
pv -per -s $SIZE $1 | dd of=$2 bs=16M conv=notrunc,noerror

https://github.com/hoefkensj/Scripts/blob/master/sh/bb.sh :

#!/usr/bin/env bash

function bytepwr() {
	case "$POW" in
	    K )
		BYTES=$(echo $VAL   *   1024                        |bc )
	    ;;
	    M )
		BYTES=$(echo $VAL   *   1048576                     |bc )
	    ;;
	    G )
		BYTES=$(echo $VAL   *   1073741824                  |bc )
	    ;;    
	    T )
		BYTES=$(echo $VAL   *   1099511627776               |bc )
	    ;;
	    P )
		BYTES=$(echo $VAL   *   1125899906842624            |bc )
	    ;;
	    E )
		BYTES=$(echo $VAL   *   1152921504606846976         |bc )
	    ;;
	    Z )
		BYTES=$(echo $VAL   *   1180591620717411303424      |bc )
	    ;;
	    0 | 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9  )
		BYTES=$3
	;;
	esac

}


NA='N/A'
IF=$1
OF=$2
[[ -n $(lsblk -bno SIZE $IF 2>/dev/null) ]] && ISIZE="$(lsblk -bno SIZE $1)"
[[ -z $(lsblk -bno SIZE $IF 2>/dev/null) ]] && [[ -e $IF ]] && [[ -s $IF ]] && ISIZE=$(du -b $IF)
[[ -n $(lsblk -bno SIZE $OF 2>/dev/null) ]] && OSIZE= $(lsblk -bno SIZE $1)

[[ -z $3 ]] && POW=${3:(-1)} 
[[ -z $3 ]] && VAL=${3::-1}

[[ -z $(lsblk -bno SIZE $OF 2>/dev/null) ]] && [[ ! -e $IF ]] && OSIZE=$BYTES


printf "SOURCE-SIZE:\t\x1b[32m$ISIZE\t\x1b[0m"

 

[wseaton]

Glad you guys don't give advice commercially. 

 

For pete sake just get a big external drive and back it up nightly via Macrium. It's automatic and free. 

 

I haven't messed with restore points in years. If my System drive dies I just restore it with Macriums recovery tool  If you want to drink the kool-aid of thinking a Linux recovery tool will save your butt keep drinking. The Linux guys just want attention. When a client is paying me $175 an hour for DR advice we tell them to use Linux recovery tools on windows.

 

Backing up windows and data and easily restoring it has been established process for 20years. The Macrium image can also be restored to a VM. 

[Bender Blues]

3 hours ago, wseaton said:

Glad you guys don't give advice commercially. 

 

For pete sake just get a big external drive and back it up nightly via Macrium. It's automatic and free. 

 

I haven't messed with restore points in years. If my System drive dies I just restore it with Macriums recovery tool  If you want to drink the kool-aid of thinking a Linux recovery tool will save your butt keep drinking. The Linux guys just want attention. When a client is paying me $175 an hour for DR advice we tell them to use Linux recovery tools on windows.

 

Backing up windows and data and easily restoring it has been established process for 20years. The Macrium image can also be restored to a VM. 

Main drive is just a single TB. So grabbing another 1TB, installing Macrium and it mirrors or backs up the entire main drive at set scheduled times??! 

 

Does that work say.... if primary drive just eats it hard, one can just change the BIOS and boot the backup as primary and you're back like new of sorts?

I'm liking this idea!

 

 

[Herr.Hoefkens]

22 hours ago, wseaton said:

Glad you guys don't give advice commercially. 

 

For pete sake just get a big external drive and back it up nightly via Macrium. It's automatic and free. 

 

I haven't messed with restore points in years. If my System drive dies I just restore it with Macriums recovery tool  If you want to drink the kool-aid of thinking a Linux recovery tool will save your butt keep drinking. The Linux guys just want attention. When a client is paying me $175 an hour for DR advice we tell them to use Linux recovery tools on windows.

 

Backing up windows and data and easily restoring it has been established process for 20years. The Macrium image can also be restored to a VM. 

duh , ofc you want a os that will leave the damn disk allone untill you decide otherwise . i mean macrium boots windows PE , i would not trust any windows to leave a failing disk alone , last thing you need is a disk that is close to failing (and prolly has dozens of bad sectors or only partially readable information) , to be "fixed" by checkdisk while booting and ruin all information in the process (all files that didnt return ok , removed from the filetable, sectors added to the empty space ready to be overwritten with the first thing the system writes after the process of reparing the drive , : the log files , ruining all information in the process. what you want is the disk powered , not mounted and only getting READ instructions (whom cannot ruin more information) and do the rest of the recovery on the image of the disk you make.

 

 

and 20 years ago , partition magic was the tool everyone used, the bootable version. also as far as failing disks go, 20yeas ago they were quitte magnetic , these days you really have to watch out for things like trim, epecially on failing disks , and with "writing" as magnetic disks could take allot more writing abusee then nvme's can

 

ps as far as windows rescue cd's go there are few that can top the combi of these

Chnpw https://en.wikipedia.org/wiki/Chntpw (havent come across any windows based system that provides same functionality)

Rescatux https://www.supergrubdisk.org/rescatux/ has a nice windows section aswell

 

tbh the only tool that lacks a linux version that isnt better or has more functionality is : Victoria (https://hdd.by/victoria/)

wich is unfortunate