Vol. 19 number 1

The newsletter of the Ottawa PC Users Group

February 2002

CLUB NEWS

SOFTWARE REVIEW

OPCUG elections for 2002 by Claude G. Jarry
he list for candidates for those who wished to seek nominations to the Board of Directors of our group for the year 2002 was closed on December 31, 2001. At this date the following had indicated they would stand their candidacy: Jocelyn Doire Bob Gowan Brigitte Lord Tim Mahoney Vince Pizzamiglio Chris Taylor and Morris Turpin.
Defrag Commander Personal Edition by Chris Taylor
have done reviews in the past of Executive Softwares Diskeeper (see opcug.ca/public/reviews/diskeeper6oct01.html and opcug.ca/public/reviews/diskeep5.htm). While I was quite impressed with the programs ability to keep my disks defragmented, the program at about $75 is not what you would call inexpensive. As such, many people will forgo the program and use the defragmenters built into almost every version of Windows since Windows 95. But relying on the built-in defragmenters has its problems. The main problem is that some versions of Windows make it difficult to schedule the built-in defragmenter. If you have to remember to defragment your disks manually, there is a good chance the job simply does not get done, or at least not as frequently as might otherwise happen. If you wish you could easily defragment your hard disks more frequently but find that Diskeeper is too expensive, you might want to look at a more cost-effective alternative Defrag Commander Personal Edition from Winternals Software. At the bargain basement price of US$19, it just might be what you need to keep your disks in tip-top shape.

continued page 3

Since there were no other nominations, the above members are elected by acclamation. There are still two vacancies on the Board. It will therefore be the responsibility of the New Board of Directors of the OPCUG to appoint volunteers to these posts. Anyone who believes that he or she would have something to offer to help members help other members solve their problems with the fascinating world of computing contact anyone of the above. Youll be glad you did.

INSIDE

Club news Club life Calendar. 2 Computer Show & Sale. 2 Features Defrag Commander - Software review. 1 Ten immutable security laws. 2 Yahoos Group. 4 Connectix Virtual PC - Software review. 5 Virus warnings (real or hoax?). 7

Next meeting:

THURSDAY, February 20th, 2002

Computer Show & Sale

by Tim Mahoney

February meeting date

Please note that due to conflicts with scheduling at the museum, we are unable to meet on the regular second Wednesday of the month for February. The meeting will instead be on: Wednesday, February 20th, 2002
Lansdowne Park March 2 and 3 from 10:00 a.m. to 5:00 p.m.
Featuring: New, Used, Closeouts and Overstocks. 20-80% off a full selection of computer & tech products. Exhibitors include local, regional and national computer dealers, wholesalers, distributors and retailers. Services exhibitors will include IT consultants, training programs, placement services and more. A great destination for both the business and personal user. For more information check out the Summit Computer Shows web site at

http://summitcomputershows.com/

WINTIP

The ten immutable laws of security
by Scott Culp, Microsoft Security Response Center Law #1 If a bad guy can persuade you to run his program on your computer, its not your computer anymore. Law #2 If a bad guy can alter the operating system on your computer, its not your computer anymore. Law #3 If a bad guy has unrestricted physical access to your computer, its not your computer anymore. Law #4 If you allow a bad guy to upload programs to your web site, its not your web site any more. Law #5 Weak passwords trump strong security. Law #6 A machine is only as secure as the administrator is trustworthy. Law #7 Encrypted data is only as secure as the decryption key. Law #8 An out of date virus scanner is only marginally better than no virus scanner at all. Law #9 Absolute anonymity isnt practical, in real life or on the web. Law #10 Technology is not a panacea.
Are you free to volunteer for a shift at the OPCUG table? Contact Tim Mahoney or any Board member!
For details about each of these points, see
http://www.microsoft.com/technet/columns/security/10imlaws.asp

CALENDAR

Meetings
OPCUG General Meeting Internet SIG (I-SIG) Developers SIG Delphi User Group Ottawa Paradox Users Group
Wednesday, Feb. 20th Wednesday, Feb. 20th Wednesday, Feb. 20th TBA 3rd Thursday each month

Time and venue

7:30 p.m. Auditorium of the National Museum of Science and Technology, 1867 St. Laurent Blvd. Come and join our discussions! Immediately following the main OPCUG presentation, and occasionally at other locations in the region. 8:00 p.m. at Chapters Store in the Pinecrest Mall (at the Queensway) 6:00-8:00 p.m. Corel Bldg 1600 Carling Ave
Please note that unless otherwise noted, SIGs meet at 9:00 p.m. (immediately following the OPCUG General Meeting).

Ottawa PC User's Group

Defrag Commander

.continued from page 1

Defrag Commander PE runs on every version of Windows from Windows 95 through Windows XP. However, the program differs considerably between the Windows 9x kernel (Windows 95, 98, ME) and the NT kernel (Windows NT, 2000, XP). Under the 9x kernel versions of Windows, all Defrag Commander PE does is provide a scheduler to control the built-in defragmenter. This left me scratching my head a bit, because I found it quite easy to use the Windows Task Scheduler to schedule the job. More on this a bit later. Once you move to the versions of Windows that use the NT kernel (NT, 2K, XP), things become more interesting. First, NT did not include a built-in defragmenter. You could download a free version of Diskeeper 3.0 from Executive Software that could do the job, but you couldnt schedule it. Windows 2000 includes a defragmenter (written by the folks at Executive software and based on Diskeeper) but it cannot be scheduled and requires that you be logged in as an administrator. I am not sure about Windows XP, but I assume its limitations are the same as Windows 2000. Defrag Commander can be used to schedule the built-in defragmenters of Windows 2000 and Windows XP, but it also includes a much better defragmenter written by the folks at Winternals Software which runs on any NT kernel version of Windows (Windows NT, 2000, XP). The Defrag Commander defrag engine is quite nice. It is fast, defrags the disk in a single pass (unlike Diskeeper which can require several passes to complete its job), is effective when there is a low amount of free space (Diskeeper has severe problems operating effectively if there is less than about 25% free space on the volume), and is very effective at consolidating free space, which helps prevent future fragmentation. I have used Defrag Commander PE on my Pentium III/933 machine for over a month now. It hums away once a day ensuring my

Windows 2000 disks are kept nice and neat. The daily run takes less than 5 minutes. You can get Defrag Commander for less than half the price of Diskeeper, but is there anything lacking? Well, you dont get the ability to defrag the page file and it doesnt include the ability to defrag some of the system areas of NTFS volumes, most notably the Master File Table (MFT). For the page file, Winternals Software does have a free utility you can download from their web site that will handle this. As for the MFT, there is considerable debate on just how important it is to have a contiguous MFT. Even Executive Software (Diskeeper) staff have admitted that there is no performance impact by having a somewhat fragmented MFT. Oh, and you dont get a pretty display. While the built-in defraggers can display a nice map of the disk, showing where contiguous files, fragmented files, and free space are, Defrag Commander runs entirely in the background. It does provide a report after each run that details things like the number of files, average file size, number of fragmented files and average fragments per file. The numbers are reported for analysis before defragmentation as well as after. The total number of moves are also reported. I promised to come back to the discussion of Windows 95, 98, ME. While there is really no benefit to using Defrag Commander Personal Edition on such machines, Winternals also has the full Defrag Commander product that may be of interest to folks who administrate many machines. The full product allows you to schedule defragmentation across the network. Again, for Win9x machines, I really sort of question the value. It would be a fairly simple job to go to each machine once and set up a scheduled task using the built-in scheduler and defragger. But if you have lots of machines, remote machines, or machines that end up being in locked offices well, it might be worth the money. For Windows NT/2K/XP machines, Defrag Commander also allows you to deploy the Winternals defragging engine and schedule it all over the wire. In fact, the defragging engine is not even left on the remote machine. It is deployed as two 62K packets. When the defrag run is done, the defragging software simply disappears. Very slick! The full Defrag Commander costs US$169 and includes ten client licenses. You can download a 30-day eval version of either Defrag Commander or Defrag Commander Personal Edition from the Winternals web site at www.winternals.com. If you havent defragged your disks in the past month, and you use Windows NT, 2K, or XP, I highly recommend you try out Defrag Commander PE. If you use the 9x kernel, fire up the Windows Task Scheduler and set up a scheduled job to defrag your disks.

REVIEW

Yahoos Group

by Jocelyn Doire

ver wanted to organize a family reunion, a support group or any other kind of meeting involving lots of people spread all over the place? To do that you use the old method of using the mail or the phone, but both are slow and potentially expensive. Alternatively you could use the Internet and create a web site, but its not everyone who has the knowledge and the time to create an attractive web site. When my high school class decided to make their conventum, that is a reunion of all those who graduated 20 years ago, they used the group feature offered by Yahoo.

to repeat some of the steps (or all of them), just re-read the screens and follow the step until you are verified member, and then go to http://groups.yahoo.com/start. To create the group you need to tell Yahoo what kind of group you are, in my example I selected , then Education. I could have refined further the type but I thought it was enough and I clicked on Place my group in Education. On the second page you can type the name of the group, the description, the email address of the group and a few options like whether the group is moderated or not. On the third page you can select your profile and email address. Finally on the fourth page, you can enter the emails of the members of your group, the welcome message and how you want to subscribe the your members. If everything went OK, you will now have a group web page (for example http://groups.yahoo.com/group/OPCUG_Demo), and a group email (for example: OPCUG_Demo@yahoogroups.com). Now the fun part begins! With your group web page you can: Send invitations to anyone to register to the group (click on invite) Send messages to all the members of the group (click on post) Read the messages posted by the members (click on messages) Create polls (click on polls, create poll, enter the question and the choices) Create a photo album (click on photos, create album) Create a database, for example one with phone number (click on database) Create a calendar of the events (click on calendar) Chat with members that are online (click on chat) and more.
The first thing you need to do is to open an account for yourself if you dont already have one, for that go to http://groups.yahoo.com/ (or http://fr.groups.yahoo.com for the French version), select Click here to register and fill in the forms. Read carefully whats there, or you may end up with something you dont want, for example on the second page, I did not want to Yes, personalize my browser with Yahoo! Companion toolbar, so I removed the check mark there. If you have trouble with what you get from Yahoo, dont ask me, asks Yahoo! The second step is to create the group, for that, click on Start a new Group!, which should bring you to http://groups.yahoo.com/start. If you are a new user, you will get a message saying that you need to verify your Yahoo email address, follow the instructions; click on here, then Non-verified, then send verification. When you get the confirmation message, get the verification code and enter it with your password, click on verify, click on Continue using Yahoo!, re-enter your password once again and fill in the member detail form, and finally click on finished. If you are like me, you will probably have

Yahoo Group

.continued
The most difficult part for me was to register to Yahoo using the web interface, but you can make the whole process much easier to your members by sending invite messages, which will allow registering by simply replying to the invite. Obviously you have to be careful to not annoy your members, and depending on the level of trust or knowledge, you may need to become the moderator to filter the messages. This is a great service offered by Yahoo, and for the price of some ads, it can make the organization of your meetings so much easier, and help to keep all the members well informed in near real time. If you have the time, why dont you take a look at the group web page I created and try the little surveys I did at http://groups.yahoo.com/ group/OPCUG_Demo/polls? You can easily subscribe by sending an empty email to
OPCUG_Demo-subscribe@yahoogroups.com
Connectix Virtual PC for Windows by Morris Turpin
mulators have been around for some time now and Connectix has been at the forefront with its Virtual PC for the Macintosh. This program has allowed Macintosh users over the years to run Windows or DOS-based programs by emulating a Pentium system on the Mac. Connectix now produces Virtual PC for Windows, which allows Windows users to create one or more X86-based virtual machines on a Windows platform. If you use legacy hardware or software that forces you to use a dual-boot system then this could be the solution for you. Or, if you want to run multiple operating systems for software development or just to experiment with different operating systems, Virtual PC for Windows will let you do all this on a single computer without the need to reboot. Virtual PC for Windows enables a single PC to run multiple operating systems simultaneously. Unlike the Macintosh version, which must emulate the Pentium processor, the PC version runs most of its code natively. This results in faster code execution since code not directly accessing the hardware runs at the full speed of the host PC. Host operating systems can be Windows ME, Windows 2000 Professional, Windows NT 4.0 with SP 6, Windows XP Home or Windows XP Professional. Operating systems running in the virtual machine (the guest OS) can be any version of DOS, any version of Windows from 3.1 to XP Professional, including server versions, OS/2 version 4, and many distributions of Linux or BSD UNIX. Installation is about as easy as any program can be, just insert the CD and follow the installation wizards. The procedure is to first install

and by replying to it. Note that you will get all the messages that are posted on the groups site. To unsubscribe, send an empty email to
OPCUG_Demo-unsubscribe@yahoogroups.com.
REMINDER Ottawa PC Users Group has a new domain name! To access electronic services (Web, email, FTP, Listserve, etc), please use

opcug.ca, rather

than opcug.ottawa.com

continued page 6

Virtual PC
Virtual PC for Windows on the host computer, create one or more virtual PCs and then install the guest operating systems. Again, the wizards walk you step-by-step through the installation. Connectix provides two methods for installing a guest operating system. If you already have an OS youd like to use its as easy to install it to a virtual PC as it is to install it on any other hard drive partition. The virtual PC will accept a bootable floppy or a bootable CD for the installation. As an alternative, Connectix sells OS Packs, which work with either Virtual PC for the Macintosh or Virtual PC for Windows. These packs are pre-installed and pre-configured versions of Windows 2000, ME or 98. This makes installation of the guest OS as easy as dragging the disk image from the CD to a directory on your hard drive. To start a guest OS, first open Virtual PC, select the guest OS and click on the Start Up button. After booting, the OS is ready to use. At this point you can install your applications. If the guest OS is a Windows machine, its recommended that you install VPC Additions at this time as well. VPC Additions provides further integration between the guest and host PCs. These enhancements include pointer integration, allowing the pointer to move freely between
the guest and host PC, drag and drop of files and folders, copy and paste, sharing folders, sharing CDs, sharing volumes and clock synchronization. Virtual PC gives you the option to set the virtual hard disk to undoable. This provides the ability to make any changes you want to the OS or any applications running on it, then turn off the PC and lose any changes that you made. This mode is extremely valuable when youre experimenting and run the risk of doing damage to the application or the OS. When re-started, the virtual PC is in its original state. By default, the guest PC is networked with its host PC sharing the hosts TCP/IP address and, through Network Address Translation (NAT), with other computers on the hosts network. This provides the ability to access any of the hosts drives as well as any other resources that are available to the host on the physical network. Windows-based guest PCs can share folders with other computers on the network; this option assigns a local drive letter to the shared folder for easier access. Connectix provides a copy of PC DOS 2000 with Virtual PC. I also installed Windows 98 and Mandrake-Linux. The only trouble I experienced was with the Windows 98 guest. I was able to drag and drop a file from the guest PC to the host but was unable to do the same from host to guest. Connectix support department was responsive and was eventually able to duplicate the problem but so far no fix has been forthcoming. My primary reason for running Virtual PC was to gain access to my Xerox P12 laser printer; a fine printer but one without Windows 2000 drivers. Under Virtual PC, I was able to do exactly what I needed to do without having to reboot into a separate Windows 98 partition. Connectix specifies the minimum CPU speed at 266 MHz but recommends 500 MHz. Almost any Intel or AMD CPU meeting these speed requirements and having level 2 cache will do. The amount of memory varies with the host and guest operating systems used but it ranges from a minimum of 128 MB to run either DOS or Windows 3.1 as guest OSs with Windows ME as the host platform to 320 MB to run Windows 2000 Advanced Server as the guest OS on a Windows 2000 Professional host platform. Specific information can be obtained from the Connectix web site at http://www.connectix.com/products/vpc4w.html. My system has an AMD 1.33 GHz CPU with 512 MB DDR RAM. Running Windows 98 as the guest OS, a little slowdown was noticeable between running applications in the Virtual PC compared with running them under Windows 98 natively in its own partition. Accessing the physical network was noticeably slower than under native Windows 98 but any delays were certainly tolerable. Using the save PC state option when shutting down results in shutdowns and startups of less than 5 seconds. Virtual PC is not a product that everybody will have a need for but for those that do, it just could be the best solution available.

COMPUTER TIPS

Virus warnings (real or hoax?)

by Dave Burnside

ave you ever received an email warning about a new virus telling you to pass it on to everyone you know so they wont get infected? Or one that told you that you might be infected by a virus that cannot be detected by any virus detector and to check for a file or files on your computer and if you find them to delete them? Were they supposedly issued by Microsoft, Compaq, IBM, AOL, FBI, etc.? Did you wonder if it was a real warning and if you should follow the instructions about deleting the file(s) and forwarding it to all your friends? Or did you assume that they were true and do what the email asked? Unfortunately today most of these virus warnings are in fact hoaxes (i.e., fakes). They are meant to either get you to destroy vital files on your own computer to achieve the same end as a real virus or to get you to mass forward the email thus contributing to clogging up as many email systems as possible. My experience in the computer security field has taught me that when an email warning arrives, common sense should alert most people to the possibility of it being a hoax. Statements that would normally sound like they could be untrue probably are untrue. For example, one that says virus scanning software cannot detect the virus is most certainly false. Today the major virus scanner companies react to multiple new viruses daily. It is even possible to obtain daily virus update files for emergency cases. Heres a list of statements contained in various warnings that should indicate a possible hoax: Type in: SULFNBK.EXE. [Note:This file is actually a critical file required by Windows] Begin search Go to File and delete it Find the file and delete it from the Recycle bin Wait 48 hours after you receive the virus in order to clean it, otherwise it will erase your hard disk and BIOS It will destroy your memory, sound card and speakers, hard drive and it will infect your mouse or pointing device, as well as your keyboards making what you type not able to register on the screen This information was announced yesterday morning from IBM, FBI and Microsoft states that this is a very dangerous and malicious virus, much worse than the I Love You, virus and that there is NO remedy for at this time In order to fix this problem, we need you, the America Online User to click on `Reply and enter in your log-on password in order to have these problems fixed This information was announced yesterday morning from Microsoft Forward this to everyone you know and if it reaches 13,000 people, 1,300 of the people on the list will receive $5,000, and the rest will

receive a free trip for two to Disney World for one week during the summer of 1999 at our expense This mail contains a plain text virus called PII-Degrade No Virus software can detect it McAFEE and NORTON cannot detect it because it does not become a virus until June 1st In addition, most such messages include something in the line of the following to try and get you to participate in the propagation of the hoax: Please, send this message to the most people possible! Pass this on to anyone you have an e-mail address for Pass this on fast and farvirus warning Please send this away to all your friends in the world Please forward this email to everyone you know Please, transmit it to anybody that you know that has access to the Internet Send this e-mail to all yours friends Such messages should NEVER be forwarded unless YOU have personally checked to ensure the validity of the warning. If youre unsure, DONT forward the message. Also NEVER follow instructions in such a warning about deleting files or altering settings on your computer before validating the authenticity of the instructions first. To check out the validity of such e-mails, there are a number of sites that you can access on the internet. Heres a partial list of the most popular ones. Remember to also check the Hoaxes areas at these sites:

http://vil.mcafee.com/

(The McAfee Virus Information Library)
http://www.symantec.com/avcenter/index.html
(The Symantec Virus Library)

OTTAWA PC NEWS

Ottawa PC News is the newsletter of the Ottawa PC Users Group (OPCUG), and is published monthly except in July and August. The opinions expressed in this newsletter may not necessarily represent the views of the club or its members. Member participation is encouraged! If you would like to contribute an article to Ottawa PC News, please submit it to the newsletter editor (contact info below). Deadline for submissions is three Saturdays before the next General Meeting.

Virus Hoaxes.continued

http://www.datafellows.com/virus-info/
(The F-Secure Virus Information Library)
http://www.europe.datafellows.com/virus-info/
(The F-Secure European Virus Information Library) On a couple of occasions, the last reference above actually had information about quickly propagating viruses before North American sites because of the time difference. Of course, your best defense against real viruses is to have a virus scanner software on your computer and make sure the virus signature file is update regularly. Normally this means that it should be updated at least weekly.

Group Meetings

OPCUG meets on the second Wednesday in the month, except July and August, at the Canada Science and Technology Museum, 1867 St. Laurent Blvd, Ottawa. Meetings are 7:309:00 p.m. and Special Interest Groups go until 10 p.m.
OPCUG annual membership: $25 per year.

Mailing Address

3 Thatcher St., Nepean, Ontario, K2G 1S6

Web address

Http://opcug.ca/
Bulletin boardthe PUB II (BBS)
Up to 33.6 kbps V.34. 228-8951
Chairman and System Administrator
Chris Taylor Tim Mahoney ctaylor@nrcan.gc.ca. 727-5453 timothyr@cyberus.ca. 225-2630 vince@monisys.ca

CLUB LIFE

Meeting Coordinator Treasurer

Vince Pizzamiglio

Reduce, Reuse, Recycle
Bring your old computer books, software, hardware, and paraphenalia you want to GIVE AWAY to the General Meetings, and leave them at the table near the auditoriums entrance. Please limit magazines to publication dates of less than two years old. You may TAKE AWAY any items of use to you. Stuff left over at the end of the meeting will be sent to the recycle bin.

Webmaster

Brigitte Lord opcug@iname.com Jocelyn.Doire@opcug.ca

Secretary

(Mr.) Jocelyn Doire Mark Cayer

Membership Chairman

Mark.Cayer@StatCan.Ca. 823-0354

Newsletter

Bert Schopf (editor) bert@blackbirdpcd.com. 232-8427 (Mr.) Jocelyn Doire (distributor, electronic version): Jocelyn.Doire@opcug.ca

Public Relations

Morris Turpin morris.turpin@rogers.com. 729-6955 skywalk@iname.com. 489-2084 petried@onebox.com. 841-6119 ndafoe@sirius.ca laddsj@statcan.ca. 951-4581 isbrandt@trytel.com. 992-8141 / 729-7793 ha4326@rogers.com BobThomas@msn.com

Facilities

Bob Walker Duncan Petrie Norm Dafoe John Ladds Stan Isbrandt Henry Sims Bob Thomas
Beginners and Windows SIG coordinator Internet SIG coordinator Paradox SIG coordinator Delphi SIG coordinator Orphan SIG coordinator Developers SIG
OPCUG 2001. Reprint permission is granted* to non-profit organizations, provided credit is given to the author and The Ottawa PC News. OPCUG requests a copy of the newsletter in which reprints appear. *Permission is granted only for articles written by OPCUG members, and which are not copyrighted by the author.

Determining Data Recovery Requirements
The real purpose of performing backups is to allow for the possibility of data recovery should the need arise. As mentioned earlier, many IT departments focus on the backup aspect of the job, taking a well cross that bridge when we come to it approach to recovery operations. Well-managed IT environments should take the opposite approach, however, since recovery is the real goal of data protection and should be the basis for any backup plan. Table 1 provides an example of how an organizations data can be categorized. Based on these categories, acceptable data loss and recovery time estimates can be developed.

Type of Server

Customer Relationship Management Software Engineering Workstation

Type of Data

Customer contacts, sales leads, and support information Software development tools; source code

Acceptable Data Loss

4 hours
Acceptable Recovery Period

2 business hours

Sales staff relies on CRM information; downtime can lead to immediate revenue loss Loss of source code may cause significant rework and project delays Employees depend on HR data for benefits; data loss can cause significant work for HR staff Current web content should also be present on webmasters machines Users should back up data to file servers; impacts of data loss are serious, but may affect fewer users

3 business hours

Human Resources Application

Human Resources records

8 hours

Intranet Server

Company news and information; department home pages Marketing tools
Marketing Department Workstation

3 hours

1 business day
Table 1. Example data recovery requirements for various company resources
IT managers who have never analyzed their organizations data recovery requirements in this way may be surprised by the results. Operations that were once afterthoughts in the process may become critical to the success of the plan. By creating such a list and making it available to managers throughout the company, the IT department can ensure that it meets the needs of its customers. Ideally this also assures that when data loss or systems failures do occur there will be no surprises as to what can and cant be recovered.

Understanding Costs

When dealing with data protection and data recovery, its important to understand the true costs related to these mission-critical operations. Though IT managers may lump all of these costs together into a general IT operations budget, it can be helpful to understand where personnel time and backup technical resources are being consumed. In this section well take a closer look at some of these costs.

Test environments: For specic testing purposes, IT staff and other users might often want to reset their system congurations to a consistent baseline condition. For example, if testing an application installation routine for a software development company, it may be useful to restore the computer to a base conguration between test runs. In such cases, re-imaging can provide a quick and easy solution. Training rooms: The process of re-imaging can be very useful in training environments where instructors might require that all users begin a class with identical system congurations. Since the number of images will likely be small, this solution can be easy to setup and maintain.
Although re-imaging is a good solution for certain environments, it may be much less desirable in other situations. Lets take a look at why.
Problems with Re-imaging and Reinstallation
While rebuilding an entire system in the event of a major problem or even manually reinstalling the machines operating system and program les may provide a straightforward and repeatable method for repair, problems exist with this approach. These include:
Inability to perform diagnosis and root-cause analysis: When organizations rely on re-imaging systems instead of on basic troubleshooting, system administrators and Help Desk staffers are far less likely to nd the root causes of a problem. And while re-imaging may get a system working in a predictable time frame, it does very little to prevent a problem from reoccurring. Take, for example, cases where failures are caused by user error or by unsupported or poorly written applications. It is entirely possible that user training, conguration changes, or other relatively simple steps can address the root cause. But when the policy is to rely primarily on re-imaging, it may be quite difcult to determine the real source of a problem. User disruption: In a best-case scenario, a computer can be re-imaged in under an hour. However, the time required for this operation often belies the hours or days of disruption experienced by end-users once the re-imaging is complete. After systems are re-imaged, administrators must work with end-users to ensure that all of their required applications are installed and congured correctly. When application updates, user data, and other options are factored in, this process can easily consume many hours spread across several days. And, once the basic conguration is established, the end-user will still have to recreate various options and settings made to facilitate their job. Even seemingly simple issues like restoring current browser and le shortcuts can be disruptive. The bottom line is that re-imaging can result in decreased productivity and frustration for the end-user. Reluctance to call IT: Those organizations that rely too heavily on re-imaging increase the chances that user systems will be completely wiped out if Help Desk personnel cannot nd a quick and easy solution. This alone makes some users hesitant to call IT. The result is that more users may try the self-help approach to solve their own problems, adding to the potential for lost productivity and further system problems. And, since even experienced end-users may be unaware of IT standards and the importance of

In many cases, the step of re-imaging a machine can be overkill like curing a disease by killing the patient! As we have seen, there are many potential problems when IT organizations rely on re-imaging as a primary recovery technique. Later in this paper, well take a detailed look at some better alternatives for systems recovery.
Making the Decision Repair vs. Reinstall: In most situations, a good rule of thumb is to repair whenever you can and to reinstall only when you must.
Although computer systems were designed for reliability, there are numerous modes of hardware and software failure with the potential to cause disruption. Foremost on many IT staffers minds is the threat of hardware failure. Its a simple fact that physical devices can and do fail. In the best case, the failure will be in a non-critical system that can be easily repaired. In many cases, however, data loss, downtime, and other issues are likely to accompany the failure. Various technologies are used to mitigate the risks of hardware failure. For example, system administrators will often invest in redundant solutions for critical systems. Redundant Array of Independent Disks (RAID) technology is one such example. In this technique, multiple physical hard disks are combined together to provide for fault-tolerance (and, in some cases, improved performance). Various levels of RAID technology are available to reach a compromise between performance, disk space utilization, and data protection. Similarly, a critical server might include multiple cooling fans to protect against the failure of one of them, or important network segments may be congured with multiple routers. These are all methods that can be used to help protect against failures. Before we move into some best practices for handling system failures, lets take a look at some of the types of failures that can occur in a typical IT environment.
Operating System Failures
Users depend on software applications to get their jobs done. These applications, in turn, rely on the proper functioning of an operating system. Although modern operating systems include many features to improve reliability, operating system failures can and do occur. Such failures can include the following:
Software conguration issues: A goal of modern operating systems is to allow many different kinds of applications to run at the same time, while providing compatibility with as many programs as possible. In some cases newly installed applications, program updates, and operating system patches can cause decreased system performance, incompatibility with mission-critical applications, or failure of the operating system to boot. User interaction: Whenever a user installs a non-standard software application, upgrades a device driver or attaches a new hardware device, changes a system setting (such as a le or folder permission), or uses a system in an unconventional way (such as performing an abnormal shutdown), system performance can be reduced or the machine can become unbootable. Viruses and other malicious programs: Virtually all computers have the potential to execute malicious software. Even a poorly written virus can exploit operating system vulnerabilities or can prey upon a lack of end-user knowledge. The result can be total data loss or corruption. Many of these issues can require hours to x, if they can be xed at all. Partition table problems: Various events can result in the loss of very small amounts of information that are required to access entire volumes of data. For example, if a partition table is incorrectly modied or damaged, the end result could be an inability to access any of the data stored on a logical volume or hard disk.

Component

Backup Devices

MTBF Value* (Hours)

100,000 500,000

Data Risk

Can result in unexpected corrupt backups if verication operations are not frequently carried out Can result in server crashes and intermittent server lockups Can make the entire disk subsystem inaccessible Failures can range from problems on portions of a disk to complete mechanical failure Can cause data corruption or loss of access, regardless of RAID implementation Can make the entire disk subsystem inaccessible Failures can range from problems on portions of a disk to complete mechanical failure Will almost always result in server downtime and, in some cases, intermittent problems or hardware damage; critical servers should have redundant power supplies

CPU Fan

20,000 40,000
Hard Disk Controller (IDE) Hard Disk (IDE)

300,000 300,000

SCSI/RAID Controller

300,000 1,000,000

Hard Disk Controller (SCSI) Hard Disk (SCSI)

300,000 500,000

Server Power Supply

100,000 400,000

Table 3. Example Mean Time Between Failures (MTBF) in hours for common computer components
* The values provided in this table are approximations based on specifications for various types of hardware. Always consult your hardware product documentation for specific data.
In addition to failed hardware, IT managers must consider that hardware conicts can lead to operating system problems. For example, installation of even the simplest-looking USB devices can cause serious operating systems problems. In the worst cases, poorly written drivers can cause interactions with other devices that will prevent the computer from booting or functioning correctly.
Weve taken a look at the types of failures that can occur in a computing environment. For most of us, this represents the bad news. Lets move on to a more positive discussion of the ways in which repair and recovery tools can reduce these risks. In this section, well take a brief look at some of the ways that these tools can improve IT operations.
Reduced Downtime and Rapid Recovery
As people in every size and type of environment rely more and more on their computing resources, downtime becomes ever more costly. One of the main purposes of data recovery tools is to quickly and efciently resolve problems that might prevent systems from operating properly. When well-designed software tools are used to diagnose and repair problems, losses due to downtime can be dramatically reduced.

For example, repairing a corrupt portion of a hard disk can be a very efcient method to restore a system to normal operations. This is especially true when the most recent backups are difcult to access or out of date. By avoiding the time-consuming operations of backup and recovery, the right data recovery tools can get systems up and running with a minimal amount of time and effort.

Reliable Recovery

When problems occur, its important for recovery operations to be reliable and accurate. That is, they should be performed so as to minimize any new errors that may be introduced by the repair process. Suppose, for example, that an operating system is being reinstalled on a system with a corrupt partition table. Even if the person performing the repair has a full understanding of the purpose, function, and conguration of the machine, it will take considerable time to restore all of the required system settings. It is also likely that at least some of the many required settings will be overlooked. Conguration errors that arent detected immediately (for example, incorrect security settings) might go unsolved for a long time. In contrast, if repairs can be limited to the original problem that occurred on a system, the scope of any changes can be minimized. For example, if a recovery utility were used to repair the partition table, the resulting changes would impact just the information stored on that portion of the disk. Following such repairs, it will be possible to perform various tests (disk checking, for example) to ensure that the problem was resolved. By repairing the system with the minimum of changes, it can be restored to a working state without needlessly introducing new problems.

Cost Savings

Earlier in this paper we looked at factors that should be taken into account when determining the total costs of downtime. Data recovery tools can greatly reduce these costs in a number of ways:
Reduced IT personnel costs: Effective use of data recovery tools can greatly reduce the time required to restore failed systems. Whenever an IT department makes the choice to use a third-party utility to repair a corrupted disk, reset a lost password, or restore a faulty driver setting, theres potential to save hours of personnel time compared to reinstalling an operating system or re-imaging a disk. Repair utilities offer the potential for more of an organizations support staff to be engaged in productive work instead of slow and tedious reinstallations and the possibility for IT personnel to solve a greater range and volume of user problems. Controlled backup expenses: The demand for reliable recovery options tends to grow with the quantity and importance of hardware and software within each organization. While recovery tools cant replace the systems, media, network capacity, and staff time dedicated to backup operations, they can help to ease the requirement for ever-growing backup capacity by de-emphasizing the role of backups in the recovery process. Reduced reliance on documentation: System administrators often list documentation as among their least favorite tasks. Because this is a tedious, time-consuming, and never-ending job, many IT organizations lack sufcient documentation of critical systems. The burden of documentation can be lowered for IT personnel who utilize recovery tools that minimize the changes introduced during system repair. Reduced downtime: As discussed earlier in this paper, downtime costs can be signicant in virtually any computing environment. A reduction in downtime can result in signicant cost savings for both the IT department and the organization as a whole.

With this in mind, lets look at two very important concepts related to the costs of data protection and data recovery.
Low Total Cost of Ownership (TCO)
Total Cost of Ownership (TCO) refers to a method for calculating a realistic cost of using hardware, software, or any other purchase. Studies have found that the initial purchase price of a piece of software is often only a very small fraction of the overall costs. The purpose of calculating TCO is to determine an accurate, overall picture of how much time, money, and resources are required to support a specic tool or technology. Some of the factors that should be included in TCO calculations for software are:
Initial purchase cost: Although it may not be the largest component in the total cost, the initial purchase cost for a software application is the easiest to calculate. Implementation cost: In addition to purchase costs, the time required to implement a piece of hardware or software should be factored in. For example, the cost to install a new accounting system, transition and move data, and train personnel to effectively use the system may be many times higher than the cost of the software. Maintenance costs: Some software applications require a maintenance contract from the application vendor. In return for paying a recurring fee, customers typically receive free updates for the software. In other cases, customers may be required to purchase new versions of applications (often, at a discount). In any case, software upgrade costs must be factored into the overall cost of an application. Support costs: Complex applications will require support from experts that fully understand the software. In some cases, an IT organization will support its own end users by providing help and training when needed. In turn, the IT organization may need to escalate some of the more difcult issues to the software manufacturer or an authorized vendor.
The TCO of well-designed recovery tools tends to be very low compared to the costs of downtime and data loss. Because such tools can be deployed only as needed and require little implementation effort beyond initial training of personnel, it can be argued that most businesses will nd it far more expensive not to purchase recovery tools.
Quick Return on Investment (ROI)
Return on investment (ROI) is generally stated as a measurement of time required for a purchase to pay for itself through cost savings. ROI can also be calculated based on the ratio of the total cost of an investment to the amount of cost savings or other benets realized. For example, an ROI of 200% indicates that the benet from an investment is twice the cost of the investment itself. Apart from being an important consideration for those who track costs, ROI calculations can help organizations determine which purchases have the greatest urgency. Although an organizations need for recovery utilities may not be easily predicted for the near term, such products have the potential to dramatically shorten many occurrences of system downtime. Table 4 expands on the example system downtime costs presented in Table 2 to show how recovery tools can result in substantial cost savings with each use.

Recovery Technique

Re-image the system, reinstall applications, restore user data from backup, and restore user configuration Troubleshoot and repair a new or uncommon problem using recovery tools Repair a common or recurring problem using recovery tools

Service Time (Typical)

Does not account for ongoing losses of user productivity due to system changes and configuration issues Results in minimal changes to the system and fewer enduser disruptions Problems that can be quickly resolved with recovery tools include lost passwords, known driver and service faults, deleted files, corrupted disks, etc.
Cost Savings per Incident (vs. Re-imaging)
$100 (end-user workstation) $140,000 (file/print server)

< 1 Hour

$150 (end-user workstation) $160,000 (file/print server)
Table 4. System recovery alternatives
* Calculated by multiplying time savings by example downtime costs from Table 2.
Because recovery tools are generally priced at well under $1,000 per IT user, its easy to see how they can provide a signicant, positive ROI with as little as a single use. And while it may be difcult to predict how frequently these tools may be needed, even under the most conservative assumptions they can deliver a positive ROI considerably faster than other IT purchases.
The right recovery tools can provide a positive ROI with as little as one use. IT managers should therefore consider making such utilities available to all personnel who diagnose and repair system issues, and should ensure that their personnel know when and how to use the recovery tools that are available to them.
Its important to note that TCO and ROI go hand-in-hand. Without accurate information about the total cost of a particular investment, its difcult to determine how quickly that investment will pay-off. When evaluating software and data recovery tools, be sure to keep all of this in mind.
The availability of data and system recovery tools can provide many advantages to IT staff at all levels. Help Desk personnel can take advantage of products to x hard disk partition table problems or unbootable systems. System administrators can use recovery tools to quickly restore a failed system to operational status while minimizing the amount of manual effort required. IT managers can rely on the right recovery tools to ensure that they can recover failed systems or corrupted storage resources should the need arise. And, all members of an organization will value reduced downtime and quicker, more accurate resolution of common problems. The bottom line for IT staffers is that effective data recovery tools can save signicant time and reduce the headaches associated with troubleshooting common system failures. A happier IT staff and more satised users have the potential to increase an organizations productivity.
Now that weve looked at the various benets of repair and recovery tools, lets focus on how to pick those products that deliver the highest return. In this section well look at some of the features that IT staffers should consider when evaluating data recovery tools.

Ease of Use

Though ease of use is an important consideration for any software product, it can be absolutely critical when it comes to recovery tools. The fact that recovery products are used in critical situations (where valuable data or an organizations revenue are at stake) makes fast and intuitive operation key to successful use. The most valuable recovery tools have accessible and easy to understand features, and so make system recovery as fast as possible.
Documentation and Support
Recovery tools tend to perform very complex operations behind the scenes. Well-designed products abstract this complexity by making options easy to nd. However, in many cases youll need good documentation to make the most of a tool and to take advantage of all of its features. The best recovery tools include a thorough description of the various operations that you can perform, along with enough background information for you to understand the process. Look for recovery tool vendors that make their support technicians available to you as part of a product maintenance program. The purpose of these support programs should be to ensure that you are able to recover data as quickly, completely, and efciently as possible. In many cases, contacting a recovery expert can dramatically reduce downtime while ensuring that you have taken all of the necessary steps to restore your systems.
So far weve looked at different aspects of planning and implementing recovery practices. Weve also looked at how data and system recovery tools can be used to make the recovery process more efcient. In this section, well take a look at Administrators Pak from Winternals Software, which provides tools to solve a wide range of system errors and failures.
Figure 1. The user selects the required function in the Navigator screen and is led to the appropriate tool included in the Administrators Pak.
An Overview of Winternals Solutions
Administrators Pak provides a comprehensive suite of powerful tools to repair damaged or unbootable systems, restore lost data, and diagnose problems associated with Windows operating and le systems. Table 5 offers a brief description of these tools. For complete information about Winternals offerings, see http://www.winternals.com.
Winternals Administrators Pak 5.0 Tools to Access, Troubleshoot, and Repair
ERD Commander 2005* A familiar Windows-like environment for repairing damaged systems. Includes Locksmith to change lost or locked-out passwords and Disk Commander to repair partition table, MBR, and boot sector errors. Recover systems remotely via a network connection. Run DOS-based applications (such as virus scanners) on damaged or unbootable Windows systems, formatted with the Windows NTFS file system. Analyze a Windows crash dump and diagnose the most likely cause of the problem. Quickly find and recover lost or deleted files. Find causes of undesired system behavior, monitor file system and registry activity.

Using a Working PC to Repair an Unbootable System
Administrators often face limited choices when repairing unbootable systems. If a system wont boot, an effective but time-consuming approach might be to remove the failed drive from the system, locate an available PC with the requisite le system, disk conguration, and repair utilities installed, and congure the problem disk so that it can be installed and repaired on the working system. Although this approach may salvage data and even repair the unbootable disk, it can consume as much time as re-imaging the failed PC. Fortunately, Remote Recover (Figure 3) is designed to mount damaged, unbootable, or virus-infected disks to working systems remotely via a TCP/IP network. Remote Recover uses a CD, oppy disk, or PXE downloaded boot client to connect the drives of the unbootable system to a local machine. All applications that are already installed on the working system including disk management, data recovery, and repartitioning tools can be transparently run on the remote system drives. And because the remote drives are mounted but not booted, anti-virus tools that are already installed on the working PC can be used to safely detect and clean viruses and worms on the failed system without the opportunity to induce further damage or spread harmful code.
Figure 3. Remote Recover allows the disk drives of unbootable systems to be accessed remotely via a TCP/IP network.
Remote Recover can dramatically reduce the amount of time that it takes to restore an unbootable machine to productive use, thereby saving downtime costs, effort, and frustration.

Restoring Lost Passwords

Lost and locked-out passwords can lead to signicant user frustration, lost productivity, and unnecessary reinstallation or rebuilding of computer environments. Fortunately theres a safe and simple way to restore lost system passwords: the Winternals Locksmith application. Locksmith is an easy, Wizard-based tool (Figure 4) that allows systems administrators to regain access to locked-out systems without resorting to more risky and time-consuming operations. The Locksmith facility is integrated in the ERD Commander 2005 and Remote Recover tools.
Figure 4. The Locksmith Wizard resets lost system passwords.

Analyzing System Crashes

Diagnosing a Windows system crash, even using the freely available Windows debugging tools for Windows, can be a complicated and confusing experience, and may result in a diagnosis that doesnt help repair the problem. With Winternals Crash Analyzer Wizard (Figure 5) , users can quickly and easily diagnose the cause of a Windows crash. This tool analyzes the crash dump and pinpoints the driver most likely responsible for the crash. Crash Analyzer Wizard returns output in both simplied and in depth diagnoses, and links to Microsofts support knowledgebase where more information can be found about the drivers at fault for a crash, with details about how to best resolve the issue. Using the results of this analysis an administrator can take corrective action such as updating or removing the problem service or device causing the crash. Crash Analyzer Wizard utilizes a copy of the Microsoft Debugging Tools for Windows and can also be run from within the ERD Commander 2005 environment.

Figure 5. Crash Analyzer Wizard pinpoints the cause of system crashes.
Finding Lost Data Efciently
Despite the frustration and lost productivity it causes, most lost data isnt really lost. Whether its recycled, deleted, or just disappears, most data remains on the hard drive but cant be found or recovered without proper tools. FileRestore (Figure 6) quickly nds and recovers such les. It scans the disk and prompts you to name a storage location for the lost le, whether the le was emptied from the Recycle Bin, deleted by application programs and remote processes, lost with removed directories, or deleted using a command prompt. FileRestore supports all Windows le systems and also recovers les deleted from Jaz, Zip, diskette drives, CompactFlash photo cards, and USB ash drives.
Figure 6. FileRestore can retrieve data that would otherwise be lost for good.
Repairing and Retrieving Corrupt Data
Modern le systems have been designed with performance, reliability, and security in mind. Even so, data loss and corruption still occur. For example, errors in a hard disks master le table might result in the inability to access les. Or, a novice user may attempt to change the size of a disk partition or accidentally format the wrong volume, resulting in what looks like total data loss. In such cases the data still exists, its just inaccessible. Typically it is only through use of specialized data recovery utilities that the disk can be restored or the data recovered. Tools such as ERD Commander 2005s Disk Commander utility (Figure 7) can be used to repair corrupted disks or to retrieve data from portions of a le system. Users and system administrators alike will nd that recovering the data can save signicant time and effort compared to the frustrating job of recreating it. The Disk Commander tool is integrated into ERD Commander 2005 within Administrators Pak.
Figure 7. Disk Commander, a utility within ERD Commander 2005, provides flexible, wizard-based options to repair numerous software-related hard disk problems.

Monitoring LDAP Trafc

LDAP communication problems between Active Directory and AD-aware applications such as Microsoft Exchange can be extremely complicated to diagnose. Most AD monitoring tools show general data about AD congurations, but little actionable information that can be used for rapid problem resolution. The administrator still faces an intense troubleshooting procedure before the repairs can even begin. By providing real-time monitoring and read/write editing capabilities, Winternals Softwares Insight for Active Directory (Figure 8) and AD Explorer allow an administrator to monitor Windows Active Directory communications (LDAP) trafc in real-time and modify or diagnose attributes which may be causing system interruption or failure. With this information, IT administrators can avoid an extended troubleshooting process, and quickly x the AD conguration errors that led to application and OS failures.

Figure 8. Insight for Active Directory is a real-time AD diagnostic solution.
Diagnosing Network Issues
The more complex networks become, the more difcult it is to troubleshoot network-related crashes and performance issues. TCP Tools TCPView Professional and TCPVStat are designed to make monitoring and analysis of network and application activity quick and easy. TCPView Professional (Figure 9) displays all active TCP and UDP endpoints on your system, indicating the process associated with each local and remote IP address. TCPView Professional presents network activity in two sub-windows. The top sub-window displays a static view, a snapshot of existing TCP/IP endpoints on the system. The bottom sub-window displays a dynamic real-time view of TCP/IP activity. Numerous display options are available, including one to allow you to capture only accesses performed by specic processes or that involve specic IP addresses.
Figure 9. TCPView Professional displays all active TCP and UDP endpoints and indicates the process associated with each IP address.
Monitoring System Changes
Simple changes are the root cause of many system problems. For example, an application or utility that makes a change to a registry key can cause a number of different problems. Or, a user might install an unapproved application that overwrites critical shared les, causing problems in other programs. Such problems can be particularly difcult to track down, isolate, and resolve. Through the use of Winternals Filemon and Regmon utilities (Figure 10), system administrators can track and record changes to the le system and/or the registry as they occur. This information can later be used for determining the cause of system issues and data access problems.
Figure 10. Filemon and Regmon track and record changes as they occur.
Preparing for Future Systems Management and Recovery Needs
With the goal of providing comprehensive offerings to address a wide range of Windows system management and recovery needs, Winternals offers additional advanced enterprise solutions:
Recovery Manager an enterprise solution that rapidly restores damaged and unbootable computers without data loss. Defrag Manager an enterprise disk defragmenter that can defrag every computer on the network automatically, from a single installation on one system.

Conclusion

The purpose of this White Paper is to present details of best practices for data recovery. We began by exploring the value of examining an organizations true data protection requirements. This initial step can often result in much better overall IT investment decisions. System administrators and IT managers should take into account the costs of downtime and data loss when they determine how to best protect data. Next, we looked at ways that an IT organization can plan for system recovery, including considerations about repairing systems versus reinstalling (or re-imaging) them. We also looked at how various types of system failures can occur. Based on this information, we explored the advantages that data recovery tools can provide to IT departments. It was shown that because data recovery tools can provide an unusually fast ROI and low TCO, an investment in them is easily justied for most environments. Finally, we looked at how to evaluate system and data recovery tools. We covered some basic information about the industry-leading tools from Winternals Software. The use of products such as Administrators Pak can provide clear and direct benets for IT staff and organizations as a whole. Based on all of this information, it can be argued that the costliest decision that many IT managers and systems administrators can make would be to fail to invest in advanced system repair and data recovery technologies.

About the Author

Anil Desai, MCSE, MCSD, MCDBA is an independent consultant in Austin, Texas. He specializes in developing and managing solutions based on Microsoft Windows and SQL Server platforms. Desai is the author of several technical books, including:
SQL Server 2000 Backup and Recovery (Osborne / McGraw-Hill) Windows 2000 Directory Services Administration Exam Guide (Sybex) Windows NT Network Management: Reducing Total Cost of Ownership (New Riders Press)
Desai has made dozens of conference presentations at national events and is also a contributor to national magazines. For more information, contact him at anil@austin.rr.com.
For More Information: Winternals Software is based in Austin, Texas. For more information about their complete line of enterprise management and recovery solutions, visit the Winternals website, http://www.winternals.com, or contact sales@winternals.com.