B
Bob Gezelter
We have encountered a problem using the restore procedure using NTBACKUP.
Following the install of Windows 2000 from the original disk, booting the
system in SAFE mode, and then doing a restore of a NTBACKUP backup file onto
the C: partitiion, the IP stack is non-functional (NDISWAN.SYS fails with
Error 10; and it is not possible to properly configure the PCMCIA XIRCOM
10/100 Ethernet card).
The PCMCIA card works correctly BEFORE the restore of the backup image. The
original Windows 2000 restore has been tried with/without the XIRCOM card
inserted.
A Windows 2000 Professional mobile suffered what appears to be damage to the
secondary bootstrap during a SCANDISK operation to check for bad sectors. As
a precaution, the drive was forensically imaged (using EnCase(r) software)
without problems. Fortunately, most (but not all) of the user data was on
partitions other than C: and apparently unaffected.
To preserve the original drive for examination, a replacement 140 GB drive
was purchased, and the forensic backup restored to the drive. The C: drive
was not bootable. Using the original CDROM, the system was booted, and
Windows 2000 was installed from scratch on the C: partition. The system was
then rebooted, and BACKUP was used to refresh the C: partition from a backup
that was taken about six months ago (there are only a few newer files on the
system partition, and they can be recovered from the forensic image).
When the system is rebooted following the restore operation, all settings
appear to have been recovered, except that the network stack is unusable.
We have done this type of recovery in the past without any problems. We have
seen problems like this when restoring images to machines other than the
machine that the backup was taken on, but never on the very same system when
switching drives.
This is not a forward looking situation, so comments along the lines of "use
GHOST, ACRONIS, etc." are not particularly productive.
Thanks you for taking the time to review this posting.
- Bob Gezelter, http://www.rlgsc.com
Following the install of Windows 2000 from the original disk, booting the
system in SAFE mode, and then doing a restore of a NTBACKUP backup file onto
the C: partitiion, the IP stack is non-functional (NDISWAN.SYS fails with
Error 10; and it is not possible to properly configure the PCMCIA XIRCOM
10/100 Ethernet card).
The PCMCIA card works correctly BEFORE the restore of the backup image. The
original Windows 2000 restore has been tried with/without the XIRCOM card
inserted.
A Windows 2000 Professional mobile suffered what appears to be damage to the
secondary bootstrap during a SCANDISK operation to check for bad sectors. As
a precaution, the drive was forensically imaged (using EnCase(r) software)
without problems. Fortunately, most (but not all) of the user data was on
partitions other than C: and apparently unaffected.
To preserve the original drive for examination, a replacement 140 GB drive
was purchased, and the forensic backup restored to the drive. The C: drive
was not bootable. Using the original CDROM, the system was booted, and
Windows 2000 was installed from scratch on the C: partition. The system was
then rebooted, and BACKUP was used to refresh the C: partition from a backup
that was taken about six months ago (there are only a few newer files on the
system partition, and they can be recovered from the forensic image).
When the system is rebooted following the restore operation, all settings
appear to have been recovered, except that the network stack is unusable.
We have done this type of recovery in the past without any problems. We have
seen problems like this when restoring images to machines other than the
machine that the backup was taken on, but never on the very same system when
switching drives.
This is not a forward looking situation, so comments along the lines of "use
GHOST, ACRONIS, etc." are not particularly productive.
Thanks you for taking the time to review this posting.
- Bob Gezelter, http://www.rlgsc.com