Daily Cup of Tech

If you remember the Muppets and Rick Astley, this will either have you laughing on the floor or completely horrified!

Trackback link - http://www.dailycupoftech.com/2008/05/11/muppets-do-rick-astley/trackback/

Every few months, I like to completely blow away my Windows system and reinstall it. This is primarily because I install so much junk on the system that it just starts to clog everything up. A freshly installed copy of Windows always runs so much quicker and has that “new OS smell”!

I firmly believe that more people would do the same if it wasn’t such a pain to do! Most people figure that you simply need to set aside a full day to do the job right.

So, I’ve put together a two part checklist of things that you should do before and after you completely reformat your system to start over.

Before You Reformat

1. Move all of your data off the computer and put it on a different system or drive. The most important folder to backup is the user profile (%USERPROFILE%) folder. This will usually back up 95% of what you want including your My Documents, music, pictures, favorites (for Internet Explorer), e-mail, etc.
2. Backup all of the device drivers that are being used on the system and store them somewhere else. I use a freeware program called DriverMax but I am sure that there are several other good ones out there.
3. Make sure you have a copy of all the software installed on your computer along with all of the license keys. A quick way to get a list of all installed software is to use something like Belarc Advisor. If you do not have the license keys, a program like Magical Jelly Bean Keyfinder might be of help. This includes operating system and software that you bought by download. I usually start making this list a few weeks before I decide to rebuild my system.
4. Download AutoPatcher and prepare a Windows/Office update CD/DVD.
5. Create an image of the system just in case you missed/forgot something. There are a number of free imaging programs available. This way, even if there is something that you forgot to backup, you will still be able to get it back from the image.
6. Perform a thorough check of your hard drive. If your drive has errors or problems (r you just want a bigger hard drive), now would be a really good time to replace the drive. Some tools include:
• Seagate SeaTools
• Hitachi Drive Fitness Test
• Western Digital Data Lifeguard Diagnostic
7. Make sure that you have all of your account information for your Internet provider, including e-mail. Have their phone number handy in case you run into trouble.
8. If you do not have all of your online accounts information memorized, now is a good time to write record them so that you do not destroy the information when you reformat your drive.
9. Make sure that you have your wireless network information recorded and available.

If you have lost your passwords that are stored on your computer, here are some tools that may be able to help you out:

• MessenPass
• Mail PassView
• IE PassView
• Protected Storage PassView
• Dialupass
• Asterisk Logger
• AsterWin IE
• Network Password Recovery
• SniffPass Password Sniffer
• PstPassword
• WirelessKeyView
• Remote Desktop PassView
• PocketAsterisk
• RemotePocketAsterisk
• Unhide Passwords (Firefox)

After You Reformat

Well, you’ve reformatted your disk so there is no turning back. Here is a general overview of the process:

1. Make sure only the bare necessaries are plugged into the computer (monitor, keyboard, and mouse).
2. Boot from the Windows CD and install Windows.
3. Install all of the drivers that you backed up earlier.
4. Plug in all of your peripherals and ensure that they are all working correctly.
5. Install Office if you had it on your computer.
6. Install all of the updates from your AutoPatcher CD/DVD.
7. Run a disk clean and defragment on the drive.
8. Reconnect your systems to the Internet.
9. Install all of the applications that you want installed on the system.
10. Migrate all of your files to your newly built system.
11. Setup all of your accounts again.

I’m sure that there are a few things that I have forgotten but this is a really good start. Let me know what I’ve missed or if there is something that you do that I do not and I will add it to the list.

Trackback link - http://www.dailycupoftech.com/2008/05/10/windows-reinstall-simple-easy-and-quick/trackback/

UPS devices have become so cheap these days that everyone should have one on all of their computers. What surprises me is that nobody has designed a standard computer power supply with built-in UPS capabilities.

Some of the advantages of such a design include:

1. Continued running even when power goes out.
2. Can (carefully) move a computer to a different room or location without shutting it down.
3. Laptops do it, why not desktops?
4. Only the critical devices (i.e. the computer) are on the UPS and not other non-essentials like monitors and printers. This will allow for a longer running system without power.
5. The ability to gently shut down the system from a hardware (not OS) perspective.

If any of the readers out there are hardware developers and would like to pick up on this idea, feel free. Just drop me a line to let me know how the idea pans out!

Trackback link - http://www.dailycupoftech.com/2008/05/08/gadget-idea-standard-computer-power-supply-with-built-in-ups/trackback/

It is only a matter of time before most IT professionals find themselves having to do some sort of a forensic analysis on a computer. The problem that most people come are then faced with is their lack of experience in performing these tasks.

And all of the pressure does not help either because there are often some pretty high staked involved.

This is where Helix comes in. Helix is a live CD that is designed to find out exactly what is on that computer and what individuals have done with it. From their website:

Helix is a customized distribution of the Knoppix Live Linux CD. Helix is more than just a bootable live CD. You can still boot into a customized Linux environment that includes customized linux kernels, excellent hardware detection and many applications dedicated to Incident Response and Forensics.

Helix has been modified very carefully to NOT touch the host computer in any way and it is forensically sound. Helix wil not auto mount swap space, or auto mount any attached devices. Helix also has a special Windows autorun side for Incident Response and Forensics.

Helix focuses on Incident Response & Forensics tools. It is meant to be used by individuals who have a sound understanding of Incident Response and Forensic techniques. That said Helix is used by the following organizations for Incident Response/Forensics Training:

• e-fense: Helix Incident Response & Computer Forensics
• NW3C: Linux Forensics
• SANS Track 508: System Forensics, Investigation and Response
• InfoSec Institute: Computer Forensics Training
• SEARCH: Basic Investigators Training

Trackback link - http://www.dailycupoftech.com/2008/05/07/catch-the-hackers-with-helix/trackback/

Many of you are familiar with the concept of computer imaging. Essentially, you take a system, configure it the way that you would like, and then duplicate the hard drive to all of the other systems, saving yourself all of the same steps that you did on the first system.

Now, there are a lot of great commercial software programs out there that can do this for you. Acronis and Ghost come to mind. But, not everyone can afford these options. For those of you find yourself in this situation, I present you with a list of options that are available for free or are open source. (All descriptions are copied from their respective websites.)

Partimage is a Linux utility which saves partitions having a supported filesystem to an image file. Most Linux and Windows filesystems are supported. The image file can be compressed with the gzip / bzip2 programs to save disk space, and they can be splitted into multiple files to be copied on CDs / DVDs, … Partitions can also be saved across the network since version 0.6.0 using the partimage network support, or using Samba / NFS. If you don’t want to install Partimage, you can download and burn SystemRescueCd. It’s a livecd that allows to use Partimage immediately even if your computer has no operating system installed (useful to restore an image), and it allows to save an image on a DVD on the fly.

PING (Partimage Is Not Ghost)

PING is a live Linux ISO, based on the excellent Linux From Scratch (LFS) documentation. It can be burnt on a CD and booted, or integrated into a PXE / RIS environment. Several tools have been added and written, so to make this ISO the perfect choice to backup and restore whole partitions, an easy way. It sounds like Symantec Ghost(tm), but has even better features, and is totally free.

Clonezilla

Clonezilla, based on DRBL, Partition Image, ntfsclone, and udpcast, allows you to do bare metal backup and recovery. Two types of Clonezilla are available, Clonezilla live and Clonezilla server edition. Clonezilla live is suitable for single machine backup and restore. While Clonezilla server edition is for massive deployment, it can clone many (40 plus!) computers simultaneously. Clonezilla saves and restores only used blocks in the harddisk. This increases the clone efficiency. At the NCHC’s Classroom C, Clonezilla server edition was used to clone 41 computers simultaneously. It took only about 10 minutes to clone a 5.6 GBytes system image to all 41 computers via multicasting!

IRestorer

Drive Snapshot (IRestorer) creates an exact drive image of your system into a file, including the operating system, installed programs, your data and all security attributes, while windows is running and you continue to work. If disaster strikes (a virus, worm, trojan, or hard disk crash), a complete and exact restoration of your system will be possible in only few minutes. The image file can be mounted as a virtual drive, so you can easily restore (or use) single files or directories, using the Windows Explorer, or other programs. Restart to DOS is only necessary, if you must restore your system partition. Otherwise there is no need to reboot, not even during installation. Drive Snapshot saves only the used disk space, compresses the data and is extremely fast, a P4 - 3.0 GHz will save approx. 2.5 GB/Min on a modern hard disk!

Linbox Rescue Server

The Linbox Rescue Server is an asset management software including 5 modules :

• system backup for emergency crash recovery, hard disk cloning or deployment using a
  PXE network boot. This module was fully developped by Linbox FAS.
• file backup, based on the famous BackupPC, to which we have added a configuration interface,
• inventory, based on ocs-inventory agents, and on an agent which runs during the PXE network boot,
• Software deployment module which works with Linux, MacOS X and MS Windows clients, or any Un*x system running OpenSSH,
• remote control, based on TightVNC.

HDClone

Copies smaller drives onto larger ones for migrating or backing up complete installations as well as for data rescue. The download package contains a program to easily create a bootable floppy disk or CD/DVD under Windows with only few clicks. A floppy image, ISO image, and manual as PDF are also enclosed.

DiscWizard

If you are setting up your new drive, you can use the install instructions to assist in mounting the drive, then use the tools built into your operating system to prepare the drive.

G4L

G4L is a hard disk and partition imaging and cloning tool. The created images are optionally compressed and transferred to an FTP server instead of cloning locally.

MaxBlast 5

If you are setting up your new drive, you can use the install instructions to assist in mounting the drive, then use the tools built into your operating system to prepare the drive.

DriveImage XML Backup Software

DriveImage XML is an easy to use and reliable program for imaging and backing up partitions and logical drives.

The program allows you to:

Backup logical drives and partitions to image files

Browse these images, view and extract files

Restore these images to the same or a different drive

Copy directly from drive to drive

Schedule automatic backups with your Task Scheduler

Image creation uses Microsoft’s Volume Shadow Services (VSS), allowing you to create safe “hot images” even from drives currently in use.Images are stored in XML files, allowing you to process them with 3rd party tools. Never again be stuck with a useless backup!

Restore images to drives without having to reboot.

DriveImage XML runs under Windows XP, Windows Server 2003 and Windows Vista only. The program will backup, image and restore drives formatted with FAT 12, 16, 32 and NTFS.

DuBaron DiskImage

DiskImage is the ultimate tool to backup and restore partitions, entire harddisks, usb keys, floppy drives and (read-only) optical media. DiskImage features built-in zip compression, it’s own compression method for data
> 2Gb, MD5 and SHA1 checksumming, a hex editor, and various tools like drive speed and seek testing.

Dumping and restoring partitions, usb sticks, floppies, optical media, diskimage is the swiss army knife.

WinDD - Disk Dump for Windows

WinDD - Disk Dump for Windows! Windows XP version of Unix ‘dd’ command. Safe, effort-free backup for FAT, FAT32, NTFS, ext2, ext3 partitions.

Partition Saving

Partition Saving is a DOS and Windows program that is used to save, restore and copy hard-drive, partitions, floppy disk and DOS or Windows devices.

With this program you could save all data on a partition to a file (such as you could save this file on a CD for example). Then if something goes wrong, you can completely restore the partition from the backup file. You no longer have to reinstall every piece of software from scratch. All you have to do is restore the partition from the backup file and then update any software that was modified since the backup was created.

NFGDump

nfgdump (Ntfs-Fat-Generic-dump) is a Win32/Linux tool that dumps/restores NTFS (including 3.1=XP), COMPRESSED NTFS, FAT16, FAT32 and arbitrary (generic) partitions. Dump files support compression, encryption, splits, page file content removal, etc.

Forensic Acquisition Utilities

This is a collection of utilities and libraries intended for forensic or forensic-related investigative use in a modern Microsoft Windows environment. The components in this collection are intended to permit the investigator to sterilize media for forensic duplication, discover where logical volume information is located and to collect the evidence from a running computer system while at the same time ensuring data integrity (e.g. with a cryptographic checksums) and while minimizing distortive alterations to the subject system. The components of this package are not intended to preclude changes to the subject system while the evidence collection process is under way. A third party hardware or software write blocker should be employed in those circumstances where it is deemed necessary to guarantee that no changes occur to the subject volume prior to and after the imaging process.

Self Image

SelfImage is the little hard drive utility with big aspirations.SelfImage is capable of making an image file of a hard disk or hard disk partition, and can restore an image back to any drive or partition that doesn’t have open files. Useful for making backups. Unlike dd for Windows (or cygwin), SelfImage is capable of creating an image of a partition that is currently in use.

SelfImage can even create images of partitions that Windows doesn’t recognize (partitions that Windows doesn’t have mounted on a drive letter). This is perfect for the dual-boot system, you can create an image backup of a Linux partition directly from Windows.

PC inspector clone maxx

PC INSPECTOR™ clone maxx is the new professional hard drive copying program from CONVAR. Using the new direct DMA support, data can be copied from hard drives in high speed mode with speeds up to 3.3 GB per minute.This high speed is achieved by PC INSPECTOR™ clone maxx through intelligent inspection of the PC motherboard and the hard drive controller. The software independently determines the fastest data transmission rate and achieves these exceptional speeds through optimal utilization of the DMA chipset on the motherboard of your PC.

PC INSPECTOR™ clone maxx can be started directly from a boot diskette. The copying process is always based on the physical drive and is independent of the file system (e.g. FAT12, FAT16, FAT32, HPFS, NTFS, Ext2, Reiser, etc.) or the number of partitions.

g4u - Harddisk Image Cloning for PCs

g4u (”ghosting for unix”) is a NetBSD-based bootfloppy/CD-ROM that allows easy cloning of PC harddisks to deploy a common setup on a number of PCs using FTP. The floppy/CD offers two functions. The first is to upload the compressed image of a local harddisk to a FTP server, the other is to restore that image via FTP, uncompress it and write it back to disk. Network configuration is fetched via DHCP. As the harddisk is processed as an image, any filesystem and operating system can be deployed using g4u. Easy cloning of local disks as well as partitions is also supported.

FOG :: A Ghost-like Computer Cloning Solution

Fog is a Linux-based, free and open source computer imaging solution for Windows XP and Vista that ties together a few open-source tools with a php-based web interface. Fog doesn’t use any boot disks, or CDs; everything is done via TFTP and PXE. Also with fog many drivers are built into the kernel, so you don’t really need to worry about drivers (unless there isn’t a linux kernel module for it). Fog also supports putting an image that came from a computer with a 80GB partition onto a machine with a 40GB hard drive as long as the data is
less than 40GB.

Fog also includes a graphical Windows service that is used to change the hostname of the PC, restart the computer if a task is created for it, and auto import hosts into the FOG database. The service also installs printers, and does simple snap-ins.

Each has its own pros and cons but all have a purpose. I am personally really liking FOG and am finding a lot of different places to put it to work.

Trackback link - http://www.dailycupoftech.com/2008/05/06/free-or-open-source-imaging-solutions/trackback/