Determining Data Protection Requirements
If you were to ask a large number of business managers to tell you which of the data in their environments is important, youd expect to hear many say all of it. In an ideal world it would be practical to provide full redundancy and frequent backups for all of an organizations computers and the information that they contain. Real-world constraints can quickly burst that bubble, however. The costs for hardware, software, networking devices, and employee time to implement and manage such a solution would present an unrealistic expenditure for almost any organization. Therefore compromises are made.
Given innite resources, the simplest approach might be to back up all of the data on the network. But much of this data may not be valuable, and some information could be more difcult to restore than to recreate. A common example is the operating system and related program les on every computer. Many IT departments spend signicant time backing up operating system and Program Files directories on their systems. However, even in environments that consist of only a few machines this can lead to signicant redundancy of backed up data. Furthermore, almost all such information can be rebuilt using operating system and software installation media. When determining which data should be backed up, IT managers and system administrators should consider the importance of various types of information. A good way to do this is to closely examine the recovery requirements for the information a topic that well cover next.
Determining Data Recovery Requirements
The real purpose of performing backups is to allow for the possibility of data recovery should the need arise. As mentioned earlier, many IT departments focus on the backup aspect of the job, taking a well cross that bridge when we come to it approach to recovery operations. Well-managed IT environments should take the opposite approach, however, since recovery is the real goal of data protection and should be the basis for any backup plan. Table 1 provides an example of how an organizations data can be categorized. Based on these categories, acceptable data loss and recovery time estimates can be developed.

Type of Server

Customer Relationship Management Software Engineering Workstation

Type of Data

Customer contacts, sales leads, and support information Software development tools; source code

Acceptable Data Loss

4 hours
Acceptable Recovery Period

2 business hours

Sales staff relies on CRM information; downtime can lead to immediate revenue loss Loss of source code may cause significant rework and project delays Employees depend on HR data for benefits; data loss can cause significant work for HR staff Current web content should also be present on webmasters machines Users should back up data to file servers; impacts of data loss are serious, but may affect fewer users

3 business hours

Human Resources Application

Human Resources records

8 hours

Intranet Server

Company news and information; department home pages Marketing tools
Marketing Department Workstation

3 hours

1 business day
Table 1. Example data recovery requirements for various company resources
IT managers who have never analyzed their organizations data recovery requirements in this way may be surprised by the results. Operations that were once afterthoughts in the process may become critical to the success of the plan. By creating such a list and making it available to managers throughout the company, the IT department can ensure that it meets the needs of its customers. Ideally this also assures that when data loss or systems failures do occur there will be no surprises as to what can and cant be recovered.

Understanding Costs

When dealing with data protection and data recovery, its important to understand the true costs related to these mission-critical operations. Though IT managers may lump all of these costs together into a general IT operations budget, it can be helpful to understand where personnel time and backup technical resources are being consumed. In this section well take a closer look at some of these costs.
Estimating Downtime Costs
IT managers can use downtime cost estimates to make better decisions about exactly what level of data protection is required. Table 2 provides some example calculations based on the roles of various systems within an organization.

Computer Role

Accounting Server

Number of Users

Downtime Cost (per hour)

$3,250

Downtime Cost (per day)*

$26,000

May cause delayed billing and other issues Users may be able to operate other machines Cost is based on downtime only (not loss of data) Costs will vary significantly by department and job functions of users who access the server
Accounting Workstation Email Server

$16,500

$132,000

File/Print Server

100 (Average)

$20,000

$160,000
Warehouse Inventory Data Engineering Source Code Control Decision Support Server End-User Workstation

$12,000

$96,000
May also affect customers and suppliers Engineering users can work off line for up to 1 day Decision Support database is not mission-critical Costs will vary based on the job function of the affected user(s)

$5,500

$4,000
Table 2. Example system downtime costs
* Calculations are based on an average of 8 hours of usage per working day.

Additional Costs

One approach to determine the value of backups is to consider the cost of not having them at all. We have already looked at one such example: downtime costs. In addition, IT managers should consider several other factors when evaluating the true costs of data protection. These factors include:
Planning costs: Ad-hoc backup strategies tend to leave gaps. For example, when a new server is brought online, system administrators may add the resources necessary to perform full backups without totally understanding the purpose of the server or developing and communicating its recovery requirements. This may result in surprises when downtime and data loss occur something that every IT department should seek to avoid. Though it takes time, the best data protection approaches require planning. Personnel costs: All backup solutions require some degree of human intervention. For example, system administrators must regularly change tapes and ensure that they are stored properly. Users may be responsible for routinely copying their data over the network to a shared le server. Even though the automation of technical processes can reduce the time required to manage backups, personnel costs are generally a large part of the true cost structure.
Later in this White Paper well look at how relatively small investments in data recovery tools can dramatically reduce the costs associated with data protection. However, lets rst take a detailed look at ways to plan for system recovery.
Successful recovery operations are almost always based on solid planning; well-organized IT environments do not simply wait for disasters to occur before they decide how to deal with them. Instead, they determine what steps should be taken when various types of data loss or system failures occur before emergencies are encountered. The goal is to ensure that recovery operations are performed in the most efcient and safest ways. In this section, well take a look at some important considerations that should be taken into account when planning for system recovery.

All of us would gladly welcome a single cure for all of our problems. Imagine, for example, if there were one button on your dashboard to x any problem that might occur with your car. Or, imagine that you could completely repair any computer issue by clicking on a single button. Unfortunately, few universal solutions like these exist anywhere. In an attempt to reach an ideal recovery state for software and operating systems, some IT departments make it a policy to solve a wide range of systems issues by reinstalling the operating system and program les. The idea is to rebuild damaged system environments from the ground up instead of taking time to troubleshoot each problem. However, this can be a very time-consuming and error-prone process. In order to improve reliability, modern operating systems often include built-in tools to solve common problems. In cases where operating systems do not provide a ready x for a failure or other problem, third-party utilities are often available to provide a solution.

Reasons for Re-imaging

An approach used by some IT organizations is to re-image systems whenever serious problems occur. The process begins with creating a full backup of all storage resources following the initial installation and conguration of each machine imaging the systems. The idea is to have the capability to return each system to its initial conguration when necessary. There are situations where system re-imaging may be a logical choice. These include:
Test environments: For specic testing purposes, IT staff and other users might often want to reset their system congurations to a consistent baseline condition. For example, if testing an application installation routine for a software development company, it may be useful to restore the computer to a base conguration between test runs. In such cases, re-imaging can provide a quick and easy solution. Training rooms: The process of re-imaging can be very useful in training environments where instructors might require that all users begin a class with identical system congurations. Since the number of images will likely be small, this solution can be easy to setup and maintain.
Although re-imaging is a good solution for certain environments, it may be much less desirable in other situations. Lets take a look at why.
Problems with Re-imaging and Reinstallation
While rebuilding an entire system in the event of a major problem or even manually reinstalling the machines operating system and program les may provide a straightforward and repeatable method for repair, problems exist with this approach. These include:

Inability to perform diagnosis and root-cause analysis: When organizations rely on re-imaging systems instead of on basic troubleshooting, system administrators and Help Desk staffers are far less likely to nd the root causes of a problem. And while re-imaging may get a system working in a predictable time frame, it does very little to prevent a problem from reoccurring. Take, for example, cases where failures are caused by user error or by unsupported or poorly written applications. It is entirely possible that user training, conguration changes, or other relatively simple steps can address the root cause. But when the policy is to rely primarily on re-imaging, it may be quite difcult to determine the real source of a problem. User disruption: In a best-case scenario, a computer can be re-imaged in under an hour. However, the time required for this operation often belies the hours or days of disruption experienced by end-users once the re-imaging is complete. After systems are re-imaged, administrators must work with end-users to ensure that all of their required applications are installed and congured correctly. When application updates, user data, and other options are factored in, this process can easily consume many hours spread across several days. And, once the basic conguration is established, the end-user will still have to recreate various options and settings made to facilitate their job. Even seemingly simple issues like restoring current browser and le shortcuts can be disruptive. The bottom line is that re-imaging can result in decreased productivity and frustration for the end-user. Reluctance to call IT: Those organizations that rely too heavily on re-imaging increase the chances that user systems will be completely wiped out if Help Desk personnel cannot nd a quick and easy solution. This alone makes some users hesitant to call IT. The result is that more users may try the self-help approach to solve their own problems, adding to the potential for lost productivity and further system problems. And, since even experienced end-users may be unaware of IT standards and the importance of

security and conguration settings, completely new issues can be introduced that may go undetected. In the worst case, a policy that relies too heavily on re-imaging can lower end-user efciency and introduce a culture of distrust between users and the IT staffers who are there to support them.
The human factor fostering IT skills: By developing an organization with the knowledge and resources needed to troubleshoot a wider range of system issues, IT managers can increase their staff members skills, job satisfaction, and value to the organization. Cultivating a more exible, better prepared IT staff maximizes the odds of successful and rapid recovery when one of the organizations critical system resources is in need of repair. Lack of consistency: A goal of re-imaging an operating system or a computer conguration is to get the system back to a basic, known-good conguration. Ironically, the process of re-imaging can result in unexpected conguration problems. Unless images are updated very frequently, it is likely that signicant, time-consuming updates to the re-imaged system will be needed to make the system productive again. Creation of images: In all but the simplest of corporate environments, many different system images must be created and maintained. Typically a different image is required for each hardware platform that is supported. Even if the IT department has specied a small set of supported hardware platforms (including make, manufacturer, model, and conguration), small changes in the hardware platform can cause problems with device drivers and conguration settings. Its much more likely that multiple hardware platforms will be supported in order to accommodate different types of users. For example, images for Desktop Basic User, Desktop Power User, and Notebook Sales might all require different congurations. Furthermore, different images may be created based on job functions. For example, Sales, Engineering, and Executive images may be needed. Creating and managing all of these images can take signicant time and effort, not to mention resources such as network bandwidth and storage space. Image quality: Creating an image of a computer systems conguration can be a difcult task. Its important for system administrators to ensure that all of the appropriate conguration settings are made in the image. Often this process is an iterative one, requiring many retry attempts to get the perfect image. In many cases IT staffers will only get close, and the image will come with instructions to re-image the system, and then follow these 10 steps. The problem with this approach is that it negates some of the potential benets of imaging systems in the rst place, as signicant time might be spent in carrying out the additional steps. Maintenance of images: As difcult as the task of creating images can be, it is often far more difcult, time consuming, and tedious to maintain them. To provide images with the applications that end users require, IT departments must constantly keep up with changing software congurations used throughout the organization. For example, if a patch for a Human Resources application is installed on all HR computers, the IT department has two main options. The rst is to update the appropriate image(s) that contain an installation of an application. The second is to make a note of the update and then manually apply the patch every time the image is used.

Any of these types of problems can result in prolonged downtime and the inability of affected users to do their jobs. Should the problem occur on important servers, hundreds or thousands of users may be affected at once.

Data Corruption

Data corruption can occur due to many different types of problems. Hardware faults such as a failed hard disk array are likely to cause a complete or partial loss of important information. In this case, the usual remedy is to restore the data from the last available backup. Although hardware faults are a real concern, they may not be the most common cause of data corruption. Virtually every computer user whether a novice or a system administrator commits human errors that can result in data loss. At any given moment its far more likely that a user will accidentally overwrite a document or make changes that will later need to be undone than it is for a hard disk failure to occur. The end result of human error is much the same as hardware failure data is lost or changed in an undesirable way. Again, the most common solution is to restore the data from an available backup.

Password Loss

Most organizations rely on passwords to control system access. Since this method requires users and system administrators to memorize information, a number of potential problems exist. For example, users may record passwords in operating system les or on paper, thereby compromising system security. Lost and disabled administrator passwords also have the potential to impact an organizations productivity. Though IT staffers commonly forget passwords altogether, passwords are also lost due to malice (for example, when a disgruntled employee leaves a company), by accident (say, when an individual repeatedly supplies an incorrect password until an account is locked out), or by lack of planning (when, for example, a previously used system is acquired or transferred without adequate documentation of passwords in place). In such cases critical systems may become inaccessible, and the result is just as serious as hardware failure or data corruption.

Hardware Failures

Anyone who has spent even a little time working with and managing computer resources understands the mortality of the hardware that most of us depend on to get our jobs done. The failure of a disk drive, a hard disk controller, memory modules, or other system components can cause an operating system to crash or to function in an unexpected way. In these situations the faulty hardware must be repaired or replaced in order to resume normal operations. Table 3 provides an example of Mean Time Between Failures (MTBF) values. The purpose of providing this information is to illustrate the real possibility of failures. Although failure of any one system may be unlikely, environments that support numerous machines can be expected to suffer frequent hardware problems.

Component

Backup Devices

MTBF Value* (Hours)

100,000 500,000

Data Risk

Can result in unexpected corrupt backups if verication operations are not frequently carried out Can result in server crashes and intermittent server lockups Can make the entire disk subsystem inaccessible Failures can range from problems on portions of a disk to complete mechanical failure Can cause data corruption or loss of access, regardless of RAID implementation Can make the entire disk subsystem inaccessible Failures can range from problems on portions of a disk to complete mechanical failure Will almost always result in server downtime and, in some cases, intermittent problems or hardware damage; critical servers should have redundant power supplies

CPU Fan

20,000 40,000
Hard Disk Controller (IDE) Hard Disk (IDE)

300,000 300,000

SCSI/RAID Controller

300,000 1,000,000

Hard Disk Controller (SCSI) Hard Disk (SCSI)

300,000 500,000

Server Power Supply

100,000 400,000

Table 3. Example Mean Time Between Failures (MTBF) in hours for common computer components
* The values provided in this table are approximations based on specifications for various types of hardware. Always consult your hardware product documentation for specific data.
In addition to failed hardware, IT managers must consider that hardware conicts can lead to operating system problems. For example, installation of even the simplest-looking USB devices can cause serious operating systems problems. In the worst cases, poorly written drivers can cause interactions with other devices that will prevent the computer from booting or functioning correctly.
Weve taken a look at the types of failures that can occur in a computing environment. For most of us, this represents the bad news. Lets move on to a more positive discussion of the ways in which repair and recovery tools can reduce these risks. In this section, well take a brief look at some of the ways that these tools can improve IT operations.
Reduced Downtime and Rapid Recovery
As people in every size and type of environment rely more and more on their computing resources, downtime becomes ever more costly. One of the main purposes of data recovery tools is to quickly and efciently resolve problems that might prevent systems from operating properly. When well-designed software tools are used to diagnose and repair problems, losses due to downtime can be dramatically reduced.

With this in mind, lets look at two very important concepts related to the costs of data protection and data recovery.
Low Total Cost of Ownership (TCO)
Total Cost of Ownership (TCO) refers to a method for calculating a realistic cost of using hardware, software, or any other purchase. Studies have found that the initial purchase price of a piece of software is often only a very small fraction of the overall costs. The purpose of calculating TCO is to determine an accurate, overall picture of how much time, money, and resources are required to support a specic tool or technology. Some of the factors that should be included in TCO calculations for software are:
Initial purchase cost: Although it may not be the largest component in the total cost, the initial purchase cost for a software application is the easiest to calculate. Implementation cost: In addition to purchase costs, the time required to implement a piece of hardware or software should be factored in. For example, the cost to install a new accounting system, transition and move data, and train personnel to effectively use the system may be many times higher than the cost of the software. Maintenance costs: Some software applications require a maintenance contract from the application vendor. In return for paying a recurring fee, customers typically receive free updates for the software. In other cases, customers may be required to purchase new versions of applications (often, at a discount). In any case, software upgrade costs must be factored into the overall cost of an application. Support costs: Complex applications will require support from experts that fully understand the software. In some cases, an IT organization will support its own end users by providing help and training when needed. In turn, the IT organization may need to escalate some of the more difcult issues to the software manufacturer or an authorized vendor.
The TCO of well-designed recovery tools tends to be very low compared to the costs of downtime and data loss. Because such tools can be deployed only as needed and require little implementation effort beyond initial training of personnel, it can be argued that most businesses will nd it far more expensive not to purchase recovery tools.
Quick Return on Investment (ROI)
Return on investment (ROI) is generally stated as a measurement of time required for a purchase to pay for itself through cost savings. ROI can also be calculated based on the ratio of the total cost of an investment to the amount of cost savings or other benets realized. For example, an ROI of 200% indicates that the benet from an investment is twice the cost of the investment itself. Apart from being an important consideration for those who track costs, ROI calculations can help organizations determine which purchases have the greatest urgency. Although an organizations need for recovery utilities may not be easily predicted for the near term, such products have the potential to dramatically shorten many occurrences of system downtime. Table 4 expands on the example system downtime costs presented in Table 2 to show how recovery tools can result in substantial cost savings with each use.

Using a Working PC to Repair an Unbootable System
Administrators often face limited choices when repairing unbootable systems. If a system wont boot, an effective but time-consuming approach might be to remove the failed drive from the system, locate an available PC with the requisite le system, disk conguration, and repair utilities installed, and congure the problem disk so that it can be installed and repaired on the working system. Although this approach may salvage data and even repair the unbootable disk, it can consume as much time as re-imaging the failed PC. Fortunately, Remote Recover (Figure 3) is designed to mount damaged, unbootable, or virus-infected disks to working systems remotely via a TCP/IP network. Remote Recover uses a CD, oppy disk, or PXE downloaded boot client to connect the drives of the unbootable system to a local machine. All applications that are already installed on the working system including disk management, data recovery, and repartitioning tools can be transparently run on the remote system drives. And because the remote drives are mounted but not booted, anti-virus tools that are already installed on the working PC can be used to safely detect and clean viruses and worms on the failed system without the opportunity to induce further damage or spread harmful code.
Figure 3. Remote Recover allows the disk drives of unbootable systems to be accessed remotely via a TCP/IP network.
Remote Recover can dramatically reduce the amount of time that it takes to restore an unbootable machine to productive use, thereby saving downtime costs, effort, and frustration.

Restoring Lost Passwords

Lost and locked-out passwords can lead to signicant user frustration, lost productivity, and unnecessary reinstallation or rebuilding of computer environments. Fortunately theres a safe and simple way to restore lost system passwords: the Winternals Locksmith application. Locksmith is an easy, Wizard-based tool (Figure 4) that allows systems administrators to regain access to locked-out systems without resorting to more risky and time-consuming operations. The Locksmith facility is integrated in the ERD Commander 2005 and Remote Recover tools.
Figure 4. The Locksmith Wizard resets lost system passwords.

Analyzing System Crashes

Diagnosing a Windows system crash, even using the freely available Windows debugging tools for Windows, can be a complicated and confusing experience, and may result in a diagnosis that doesnt help repair the problem. With Winternals Crash Analyzer Wizard (Figure 5) , users can quickly and easily diagnose the cause of a Windows crash. This tool analyzes the crash dump and pinpoints the driver most likely responsible for the crash. Crash Analyzer Wizard returns output in both simplied and in depth diagnoses, and links to Microsofts support knowledgebase where more information can be found about the drivers at fault for a crash, with details about how to best resolve the issue. Using the results of this analysis an administrator can take corrective action such as updating or removing the problem service or device causing the crash. Crash Analyzer Wizard utilizes a copy of the Microsoft Debugging Tools for Windows and can also be run from within the ERD Commander 2005 environment.

Figure 5. Crash Analyzer Wizard pinpoints the cause of system crashes.
Finding Lost Data Efciently
Despite the frustration and lost productivity it causes, most lost data isnt really lost. Whether its recycled, deleted, or just disappears, most data remains on the hard drive but cant be found or recovered without proper tools. FileRestore (Figure 6) quickly nds and recovers such les. It scans the disk and prompts you to name a storage location for the lost le, whether the le was emptied from the Recycle Bin, deleted by application programs and remote processes, lost with removed directories, or deleted using a command prompt. FileRestore supports all Windows le systems and also recovers les deleted from Jaz, Zip, diskette drives, CompactFlash photo cards, and USB ash drives.
Figure 6. FileRestore can retrieve data that would otherwise be lost for good.
Repairing and Retrieving Corrupt Data
Modern le systems have been designed with performance, reliability, and security in mind. Even so, data loss and corruption still occur. For example, errors in a hard disks master le table might result in the inability to access les. Or, a novice user may attempt to change the size of a disk partition or accidentally format the wrong volume, resulting in what looks like total data loss. In such cases the data still exists, its just inaccessible. Typically it is only through use of specialized data recovery utilities that the disk can be restored or the data recovered. Tools such as ERD Commander 2005s Disk Commander utility (Figure 7) can be used to repair corrupted disks or to retrieve data from portions of a le system. Users and system administrators alike will nd that recovering the data can save signicant time and effort compared to the frustrating job of recreating it. The Disk Commander tool is integrated into ERD Commander 2005 within Administrators Pak.
Figure 7. Disk Commander, a utility within ERD Commander 2005, provides flexible, wizard-based options to repair numerous software-related hard disk problems.

Monitoring LDAP Trafc

LDAP communication problems between Active Directory and AD-aware applications such as Microsoft Exchange can be extremely complicated to diagnose. Most AD monitoring tools show general data about AD congurations, but little actionable information that can be used for rapid problem resolution. The administrator still faces an intense troubleshooting procedure before the repairs can even begin. By providing real-time monitoring and read/write editing capabilities, Winternals Softwares Insight for Active Directory (Figure 8) and AD Explorer allow an administrator to monitor Windows Active Directory communications (LDAP) trafc in real-time and modify or diagnose attributes which may be causing system interruption or failure. With this information, IT administrators can avoid an extended troubleshooting process, and quickly x the AD conguration errors that led to application and OS failures.

Figure 8. Insight for Active Directory is a real-time AD diagnostic solution.
Diagnosing Network Issues
The more complex networks become, the more difcult it is to troubleshoot network-related crashes and performance issues. TCP Tools TCPView Professional and TCPVStat are designed to make monitoring and analysis of network and application activity quick and easy. TCPView Professional (Figure 9) displays all active TCP and UDP endpoints on your system, indicating the process associated with each local and remote IP address. TCPView Professional presents network activity in two sub-windows. The top sub-window displays a static view, a snapshot of existing TCP/IP endpoints on the system. The bottom sub-window displays a dynamic real-time view of TCP/IP activity. Numerous display options are available, including one to allow you to capture only accesses performed by specic processes or that involve specic IP addresses.
Figure 9. TCPView Professional displays all active TCP and UDP endpoints and indicates the process associated with each IP address.
Monitoring System Changes
Simple changes are the root cause of many system problems. For example, an application or utility that makes a change to a registry key can cause a number of different problems. Or, a user might install an unapproved application that overwrites critical shared les, causing problems in other programs. Such problems can be particularly difcult to track down, isolate, and resolve. Through the use of Winternals Filemon and Regmon utilities (Figure 10), system administrators can track and record changes to the le system and/or the registry as they occur. This information can later be used for determining the cause of system issues and data access problems.
Figure 10. Filemon and Regmon track and record changes as they occur.
Preparing for Future Systems Management and Recovery Needs
With the goal of providing comprehensive offerings to address a wide range of Windows system management and recovery needs, Winternals offers additional advanced enterprise solutions:
Recovery Manager an enterprise solution that rapidly restores damaged and unbootable computers without data loss. Defrag Manager an enterprise disk defragmenter that can defrag every computer on the network automatically, from a single installation on one system.

Conclusion

The purpose of this White Paper is to present details of best practices for data recovery. We began by exploring the value of examining an organizations true data protection requirements. This initial step can often result in much better overall IT investment decisions. System administrators and IT managers should take into account the costs of downtime and data loss when they determine how to best protect data. Next, we looked at ways that an IT organization can plan for system recovery, including considerations about repairing systems versus reinstalling (or re-imaging) them. We also looked at how various types of system failures can occur. Based on this information, we explored the advantages that data recovery tools can provide to IT departments. It was shown that because data recovery tools can provide an unusually fast ROI and low TCO, an investment in them is easily justied for most environments. Finally, we looked at how to evaluate system and data recovery tools. We covered some basic information about the industry-leading tools from Winternals Software. The use of products such as Administrators Pak can provide clear and direct benets for IT staff and organizations as a whole. Based on all of this information, it can be argued that the costliest decision that many IT managers and systems administrators can make would be to fail to invest in advanced system repair and data recovery technologies.

Administrators Pak

QUICK START GUIDE
Starting Administrators Pak
To get started, insert the Administrators Pak CD into the CD-ROM drive of your computer. The Installation Wizard will guide you through the installation process and allow you to choose a typical or custom installation.*

Accessing the Tools

Once Administrators Pak is installed, you can access the components in two ways. A. The easy-to-use Administrators Pak Navigator is available from the Start menu. The Navigator lets you see at a glance the product that will help you meet your system challenge. B. If you know which tool youd like to use, you can select Remote Recover (or its client boot media wizards), Filemon , Regmon , the Crash Analyzer Wizard , FileRestore , Insight for Active Directory , AD Explorer , TCPView Professional * and TCPVStat * directly from the Start menu. From here you can also open the boot media wizards for NTFSDOS Professional and ERD Commander 2005.
* TCPView Professional and TCPVStat are not a default part of the typical installation. To install them, choose a custom installation.

Booting a System

You can boot a system to ERD Commander 2005, which includes Disk Commander , and the Crash Analyzer Wizard simply by inserting the Administrators Pak CD and restarting the system; this process is safe and does not modify the system. The boot process will continue until you see the ERD Commander 2005 environment, shown here.

TR OU BL E S H OO T ING

DATA R ECOV ERY

SYSTEM REPAIR

Using Administrators Pak
With Administrators Pak you can repair dead systems, recover data, and troubleshoot in numerous ways.
Select a Tool with Administrators Pak Navigator
1. Select the Start menu, then Programs, then Winternals Administrators Pak, then Administrators Pak Navigator. 2. To launch a specific tool, select its associated icon or description. 3. To create boot media for ERD Commander 2005 or Remote Recover 3.0, select the Create boot media icon or description.
Troubleshoot a System with the Crash Analyzer Wizard
1. Select the Start menu, then (All) Programs, then Winternals Administrators Pak, then Crash Analyzer Wizard. Click Next at the introductory screen. 2. Select the directory that contains the Microsoft Debugging Tools for Windows package; a link will be provided if you need to download it. Then click Next. 3. Select the directory containing symbol files; unless you have previously downloaded them you will need to use the Microsoft Symbol Server to download the symbols. Then click Next. 4. Specify the dump file you wish to analyze, then click Next. C:\Windows\ Minidump\ is the default directory for dump files to be placed. If none have occurred on your system, specify the location where you have copied dump files from another system. 5. The Wizard will display information indicating the driver that may have caused the crash you chose to analyze. You can adjust the driver using the Service and Driver Manager, then reboot the system.
Change the Administrator Password with ERD Commander 2005
1. Boot the system using the CD as outlined in Booting a System. 2. Select the Start menu, then Administrative Tools, then the Locksmith icon. 3. The Locksmith Wizard will provide information on Locksmiths capabilities and prompt you to select an account. 4. Once you have selected an account, simply type in a new password. 5. To test the new password, reboot the system to Windows (not ERD Commander 2005) and type in the new password for the account you selected.

CAUTION: Keep the Administrators Pak CD in a secure location and monitor its use. Keep a record of new passwords and notify account users.
Boot and Mount the Disks of a Disabled System with Remote Recover
1. Insert the boot media in the disabled system. (You can use the Remote Recover Client Boot CD Wizard to create a boot CD or the Client Floppy Wizard to create floppy media or network boot images.) 2. Following the boot procedure, the Remote Recover client program will be displayed. 3. On the host system, select the Start menu, then Programs, then Winternals Administrators Pak, then Remote Recover. Upon startup, Remote Recover broadcasts a query on the network. Booted systems receiving the query respond automatically. A list of clients responding will appear. 4. Highlight the IP address of the system you wish to access, then select Connect from the File menu. 5. Select the disk in the left window and then select Mount from the File menu. The disk will appear in the right window. Once mounted, client disks can be accessed from any Windows application.
NOTE: If you are connecting to a system located over a router, the broadcast may not be received by the host, so it may not be viewable automatically. In this case use the File Add IP menu item to specify the client to connect to.
Restore an Unbootable Windows XP System with System Restore Wizard
1. Boot the Windows XP system using the CD as outlined in Booting a System. 2. Select the Start menu, then System Tools, then the System Restore Wizard icon. 3. The Wizard will guide you through the steps of selecting a previously-created Restore Point. 4. Reboot the system to Windows (not ERD Commander 2005) and the system will be returned to the state it was in at the Restore Point selected.
Review Potential Malware with Autoruns
1. Boot the system using the CD as outlined in Booting a System. 2. Select the Start menu, then Administrative Tools, then the Autoruns icon. 3. A list of user accounts will be displayed. Select an account to see which programs are configured to startup automatically when the system boots and when the selected user account logs in. 4. Highlight an item and right mouse click to delete, explore, or retrieve additional information on it by selecting the appropriate action from the context menu.
Recover Deleted Files with FileRestore
1. Boot the system using the CD as outlined in Booting a System. 2. Select the Start menu, then System Tools, then the FileRestore icon. 3. Enter search parameters such as file name, date last modified, size, type, or location, then click Search Now. 4. Sort results by selecting the appropriate column heading. 5. Once you have located the deleted file(s) you wish to recover, highlight the files and select Copy To Folder from the Menu bar, select the corresponding tool bar button, or select Copy To Folder. from the context menu. You will then be prompted to select a folder as a location for the copied files.

Access NTFS Drives on a Disabled System with NTFSDOS Professional
1. Boot the system into DOS, remove the DOS diskette, and insert the NTFSDOS Professional diskette created using the Boot Disk Wizard. 2. Type NTFSPRO in the command line. 3. License and time zone information will be displayed. The hard drive partitions will be scanned for NTFS drives. Each drive will be mounted and assigned a DOS drive letter. NTFS Volumes may now be repaired or recovered using normal DOS commands.
Monitor File Activity with Filemon Enterprise Edition
1. Select Winternals Administrators Pak from the Start menu, then select Filemon. It will immediately display a list of real-time file activity on the local system. 2. Use menus, hot-keys, or tool bar buttons to search and filter output, save the data to a file, or clear the window. 3. Any remote system accessible via TCP/IP can be monitored. If the host system and the system you want to monitor both run Windows NT /2000 / XP /Server 2003 and are in the same Network Neighborhood, Filemon will automatically install client software on the client. Otherwise, you must manually install the client component.
Monitor Registry Activity with Regmon Enterprise Edition
1. Select Winternals Administrators Pak from the Start menu, then select Regmon. Regmon will immediately display a list of real-time registry activity on your local system.
2. Use menus, hot-keys, or tool bar buttons to search and filter output, save the data to a file, or clear the window. 3. Any remote system accessible via TCP/IP can be monitored. If the host system and the system you want to monitor run Windows NT/2000/XP/ Server 2003 and are in the same Network Neighborhood, Regmon will automatically install client software. Otherwise, you must manually install client software.
Monitor TCP/IP Activity with TCPView Professional
1. Select the Start menu, then Programs, then Winternals Administrators Pak, then TCPView Pro. It will immediately begin capturing and displaying TCP/IP network activity. 2. TCPView Pro presents network activity in two sub-windows. The top subwindow displays a static view showing a snapshot of existing TCP/IP endpoints on the system. The bottom sub-window displays a dynamic realtime view of TCP/IP activity. 3. By default, TCPView Pro refreshes the static view every second. The refresh rate can be changed or disabled. 4. By default, the dynamic view scrolls so that it always displays the most recent event. Auto scrolling can be disabled.

Monitor LDAP Traffic with Insight for Active Directory
1. Select the Start menu, then Programs, then Winternals Administrators Pak, then Insight for Active Directory. It will immediately begin capturing and displaying LDAP Traffic. 2. Insight for Active Directory presents activity in two sub-windows. The top sub-window displays a real-time view of LDAP activity on the local system. The bottom sub-window displays detailed information about any LDAP action selected in the top sub-window. 3. By default, the dynamic view scrolls so that it always displays the most recent event. Auto scrolling can be disabled.
Getting Help with Administrators Pak
To view the online help, press F1 or select Help from within the individual products in the Administrators Pak. Visit www.winternals.com/support to view the Winternals Software Support Knowledge Base.
For issues that are not covered in the online Help or Support Knowledge Base, please visit www.winternals.com/support/getsupport.asp or send an email to support@winternals.com. If you need telephone support or other product information during your evaluation period, please call your Winternals Account Executive at 800-408-8415.
Administrators Pak Quick Tips
The system on which you wish to boot to ERD Commander 2005 must recognize the CD-ROM drive as a boot device. If it does not, you will need to adjust the systems BIOS settings.
When using Remote Recover, or the remote monitoring functionality of Regmon or Filemon, you may need to configure your Windows systems firewall to allow connectivity to (Regmon and Filemon) and from (Remote Recover). Consult your firewall vendors documentation for specific instructions on how to perform this task. The ERD Commander 2005 networking services assume that a DHCP server is present on your network and will automatically obtain an IP address. If your network uses static IP addresses you can use the built-in TCP/IP Configuration utility after logging in to specify a static IP address.
2005 Winternals Software LP. All rights reserved. Winternals is a registered trademark of Winternals Software LP. Administrators Pak, ERD Commander, Disk Commander, Locksmith, Remote Recover, NTFSDOS Professional, Crash Analyzer Wizard, FileRestore, Filemon Enterprise Edition, Regmon Enterprise Edition, AD Explorer, Insight for Active Directory, TCP Tools, TCPView Professional, and TCPVStat are trademarks of Winternals Software LP. Windows 95, Windows 98, Windows Me, Windows NT, Windows 2000, Windows XP, Windows Server 2003, and Active Directory are registered trademarks of Microsoft Corporation in the US and/or other countries.

3101 Bee Caves Road Suite 150 Austin, TX 78746 www.winternals.com Ph 512.330.9130 Fax 512.330.9131