Recovering remote NT/W2K/XP desktops with a network boot CD/DVD

re: Recovering remote NT/W2K/XP desktops with a network boot CD/DVD

jørn martinessen — Fri, 28 Aug 2009 22:02:12 GMT

i hope this can bring me from a meningless live, and back to my friends and others

re: Recovering remote NT/W2K/XP desktops with a network boot CD/DVD

cash advances — Mon, 29 Jun 2009 11:16:21 GMT

I found port25.technet.com very informative. The article is professionally written and I feel like the author knows the subject very well. port25.technet.com keep it that way.

Calling All Questions!

Port 25 — Thu, 12 Oct 2006 20:49:15 GMT

We're interested in hearing about your biggest - and smallest - IT challenges. Send them in - your toughest pains, trivial pet peeves - and we'll try & answer them....

re: Recovering remote NT/W2K/XP desktops with a network boot CD/DVD

ringerc — Sun, 30 Apr 2006 20:05:00 GMT

A Windows Live CD for recovery (and kiosks) would be amazing. I woudn't want to be in charge of coming up with an appropriate licensing scheme for it though.

That's not really an available (legal) option right now. Your best bet is probably a CD like systemrescueCD (http://sysresccd.org/) that includes the reverse-engineered read-only NTFS driver for Linux, as well as disk imaging tools. This at least offers some facility for data recovery prior to re-imaging a machine, because we all know how good users REALLY are at keeping backups.

I use sysresccd and a Sysprep'd OS image with the drivers for all the common hardware at work to handle most failures. Usually it's not necessary to pull anything off the local disk because we use network home directories with the domain, but sometimes users manage to find ways to stash files on the machine despite all instructions. [Insert foaming rant about apps that must run as Admin]. Once I've mounted the disk and their network home dir I just copy any files across, unmount, reimage the machine and reboot.

re: Recovering remote NT/W2K/XP desktops with a network boot CD/DVD

Wesley Parish — Sat, 29 Apr 2006 12:50:09 GMT

I had a similar problem recently with a disk becoming almost inoperable because of drive electronics problems. Following the proverbial night in the freezer, I was able to recover most of my data - an almost full 160 GB partition - by booting with a Knoppix disc and using 'cp -r /dev/unhealthy-hard-disk/partition /dev/healthy-hard-disk/partition' .

Point is, I seriously doubt Microsoft has the cojones to risk a minor loss of earnings due to a policy - permitting free copying for techies maintaining Microsoft (operating and office) systems - and a major loss of face - being proved wrong in a matter in which they have spent a major part of 25 years arguing that unrestricted or semi-restricted copying is wrong.

It's far better to forget Microsoft when matters this serious come up -
"The cabins that they give us,
"They say are mighty fine,
"Built to keep the rain out,
"But only when it's fine!"

"But I still wanna stay a camper here,
"Please Mum, I wanna stay(x3) here!"

re: Recovering remote NT/W2K/XP desktops with a network boot CD/DVD

eitan — Fri, 28 Apr 2006 21:56:02 GMT

I was having trouble a while back using g4l because of a certain lack of drivers, don't remember which. Anyway, I picked up g4l (Ghost For Linux) and it seemed to do the job. Linux seems to be ahead of NetBSD when it comes to hardware support. Something interesting I noticed is that those two Open Source projects had certain copyright disputes:
http://software.newsforge.com/print.pl?sid=05/08/18/1557202

re: Recovering remote NT/W2K/XP desktops with a network boot CD/DVD

remdotc — Fri, 28 Apr 2006 19:36:25 GMT

While I am not going to go into the DCMA, which is a good example of congress representing big buiness over the people, I will stick the to matter at hand, recovering anything via remote

The problem with G4u is that it relies upon the fact you have the same disk geometery, ie SIZE. It does not work with any raided system, and each drive or file system has to be backed up manually. While that presents more of a problem on POSIX based systems, the opererable word is recovery, not replacement.

While any administrator worth a grain of salt backs everything up, most home users, small buinesses and students rarely do so. So a complete reimaging of a drive is not what they want, as they want the files intact, as the case pointed out by the above poster

For remote recovery, not reimaging, I suggest the following
1. Create a linux boot disk image with networking support, and custom compile the kernel with ntfs support and any one of the following dependent upon your network
samaba (nt networks)
ssh (any ssh enabled ftp server)
ftp (any ftp server)
or NIS

Next login to the machine and copy the contents of the user data to a file server. Since most viruses whilst they do crash the system to the point of non boot, most do not delete user data, and the ones that do, usually do not overwrite the deleted data , so most files are recoverable. While there are many comerical, freeware and opensource products for this, usually when a Windows machine goes down, its do to one of the following
1. MBR set wrong
2. Virtual driver deleted or registery value changed to point to an invalid location
3. Corrupt or missing system files

Just copy the users data to a file server.
after this is complete you can either reimage the machine or spend your time attempting to recover the machine by downloading various os dependent files.

re: Recovering remote NT/W2K/XP desktops with a network boot CD/DVD

fluke — Fri, 28 Apr 2006 17:58:22 GMT

g4u is a very interesting project. I have been using Novell's ZEN Image which boots a light (less than 12MB) version of SuSE to do imaging. And just like g4u, it supports be started via CD boot or PXE network boot.

However, you did not answer the question about *RECOVERY* of an existing installation at all.

At the University, we have several students that are getting hit with the "Blackworm." Several of these Dell laptop users don't even have a Windows install CD, but rather a Ghost boot CD that puts the drive back to OEM default (in some cases also without SP2). It would be nice to have a "Live CD" based on the XP kernel. This way, even if the user has hardware not supported by alternative OSes, a recovery enviroment could be booted that is ensured not automatically start any rootkits from the hard drive. We could then use network access to the "Live CD" enviroment to try to remove the infection or at least remotely back up critical data files.

But the problem is one of license terms instead of any technical issue. While several people claim that Windows is simply a victim of it's own popularity and if Mac OS or Linux became the popular desktop then it would also be the target of malware. To some extent that might be true but the people that make this claim do not seem to take into account what methods of recovery could be made available to the different personal desktop users.

If a Mac OS port of Blackworm came out, we could create a bootable recovery CD based on Darwin that uses Apple's offical HFS+ file system code and is able to support all the same hardware drivers as the hard drive installed OS. Once such a recovery CD is created, we could then redistribute it to the students under the licensing terms of Darwin.

If a GNU/Linux port of Blackworm came out, we could create a bootable recovery CD based on the GNU/Linux distribution that uses the distribution's offical file system code and is able to support all the same hardware drivers as the hard drive installed OS. Once such a recovery CD is created, we could then redistribute it to the students under the licensing terms of the GNU/Linux distribution.

But now that XP version of Blackworm is out, we have tried creating a bootable BartPE CD that uses the offical MS kernel, NTFS driver and other XP drivers. But, then the terms of redistribution on any work derived using the XP kernel and other resources prohibits us from redistributing it to the students.

We don't want to cheat Microsoft but we don't want to cheat our students either. Ultimately, copyright law wins out and our ability to help the students is greatly hindered. Our Microsoft sales rep will only confirm that we don't have any reasonable method of redistributing BartPE CDs regardless of what our intentions are.

Much like you, Dell and Microsoft's answer involves re-imaging the laptop which does not address keeping any of the data they need to pass their classes.

"and went for coffee (anytime is a good time for coffee J )"

Well... if you can recommend any good coffee, it might at least make our students feel better about loosing to the Blackworm their end of semester papers that are due today.

If only malware authors where restricted by the same laws that hinder us from fighting their creations.