Restoring and Backing Up the Operating System, System State Data, and User Data

Windows XP provides enhanced backup tools that are designed to help protect data from accidental loss due to hardware failure or other disaster. In addition, Windows XP provides several tools that help you recover from computer failures that prevent you from starting Windows normally. This section looks at several of these tools, including the Last Known Good Configuration, Safe Mode, Recovery Console, and Automated System Recovery (ASR).

Recovering System State Data and User Data by Using Windows Backup

Objective:

Restore and back up the operating system, System State data, and user data.

• Recover System State data and user data by using Windows Backup.

The Windows XP Professional Backup utility functions in a similar manner to the corresponding utility found in Windows 2000 Professional, enabling you to back up all data on a disk or a portion thereof to a variety of media, including tapes, shared network drives, CD-ROM drives, and so on. New to Windows XP Professional is the concept of volume shadow copies, which create a shadow copy of the original volume at the instant the backup starts. This enables all files, including those an application might have open currently, to be backed up. Previous versions of Windows skipped any open files, thereby risking incomplete backups.

Backup Types

Windows XP Professional supports the same five standard backup types that have been supported by all versions of Windows NT/2000. These backup types are distinguished by how they handle the archive bit associated with each file. Table 9.8 describes these backup types.

Table 9.8. Five Standard Backup Types

Backup Type	Description
Normal or Full	Backs up all selected files and removes the archive bit, thereby indicating that the files have been backed up. Such a backup is the most complete backup and provides the fastest means of restoring data.
Differential	Backs up all files and folders that have changed since the last normal backup. It does not remove the archive bit; consequently this backup type accumulates all changes that have occurred since the last normal backup. Should you need to restore data, you need to restore the last normal backup plus the last differential backup.
Incremental	Backs up all files and folders that have changed since the last normal backup, and removes the archive bit. This backup type is the fastest one to perform but requires that you restore all incremental backups in sequence since the last normal backup.
Daily	Backs up all files and folders that have changed on the day the backup was made. It does not remove the archive bit.
Copy	Backs up all selected files, but does not remove the archive bit. This backup type is similar to the normal backup except for not removing the archive bit. It is useful for creating an extra backup for purposes such as offsite storage or producing a snapshot of a computer at a specified moment.

Exam Alert

Understand the differences between the backup types In particular, understand the difference between incremental and differential backups. You should realize that incremental backups back up only files that have changed since the last normal or incremental backup; consequently, you must restore the normal backup and then each incremental backup in turn. On the other hand, differential backups back up all files that have changed since the last normal backup (including any files that have changed prior to a more recent differential backup). Consequently, you need to restore only the last normal backup and the last differential backup to provide a complete restore.

Backup Permissions

Just as for other administrative tasks, you need the appropriate permissions to perform backups and restores. Windows XP provides the Backup files and directories and Restore files and directories user rights to govern the ability to back up and restore files and folders. The following summarizes the default permissions:

• Members of the Administrators and Backup Operators groups possess both of these user rights and are able to back up and restore all files and folders.

• All users can back up and restore their own files and folders.

• Users who possess the Read permission on a file or folder can back up that file or folder.

• Users who possess the Write permission on a file or folder can restore that file or folder.

Performing Backups and Restores

Windows XP Professional provides the Back Up or Restore Wizard to facilitate the process of backing up files and folders. This wizard enables you to select which files and folders to back up. You can also select a group of files known as the System State, which you can use to restore the system files of a dead computer to its previous condition. On a Windows XP Professional computer, the System State includes the following:

• The Registry

• The Component Services Class (COM+) registration database

• Boot files, including system startup files

• Files protected by Windows File Protection (WFP)

Additional components are included in server system state backups, including Active Directory folders for domain controllers and the Certificate Services database on certificate servers.

Follow Step by Step 9.9 to perform a backup.

Step by Step: 9.9 Backing Up Data in Windows XP

1.	Click Start, Run, type ntbackup, and then press Enter. You can also access Windows Backup from the All Programs, Accessories, System Tools menu or from the Performance and Maintenance category of Control Panel.
2.	Click Next to bypass the Welcome screen of the Backup or Restore Wizard.
3.	On the Backup or Restore screen, select Back Up Files and Settings, and then click Next.
4.	Make an appropriate selection from the options given in the What to Back Up screen (see Figure 9.14) and then click Next. Figure 9.14. The What to Back Up screen offers four options for backing up data.
5.	If you have chosen the Let Me Choose What to Back Up option, you receive the Items to Back Up screen shown in Figure 9.15. Expand the appropriate node to select the items to be backed up, and then click Next. Figure 9.15. The Items to Back Up screen enables you to select which files and folders are to be backed up.
6.	If you have a tape device attached to your computer, the Backup Type, Destination, and Name screen enables you to select the backup type. This option enables you to select File if you want to back up files and folders to a file, or select a tape device if you want to back up files and folders to a tape. Otherwise, this option is unavailable (see Figure 9.16), and you should click Browse to open a Save As dialog box and locate a suitable place for saving the backup files. Figure 9.16. The Backup Type, Destination, and Name screen enables you to choose a location for saving the backup.
7.	The wizard displays a completion screen. To start the backup now, click Finish. To configure additional backup options, click Advanced.
8.	If you click Advanced, the Type of Backup screen enables you to select from the five backup types already discussed. Make a selection and then click Next.
9.	The How to Back Up screen provides the options shown in Figure 9.17 for verification, hardware compression (if available), and volume shadow copy. Make any desired selections, and then click Next. Figure 9.17. The How to Back Up screen offers three additional backup options.
10.	From the Backup Options screen you can either append the backup to existing backups (which is the default) or replace the existing backups. Make a selection and then click Next.
11.	The When to Back Up screen enables you to specify scheduling options. Click Now to back up data now or Later to use the Task Scheduler to schedule the backup.
12.	If you have selected Later, provide a backup job name and click Set Schedule to access options similar to those discussed earlier in this chapter and displayed in Figure 9.10. If requested, provide a username and password of a user authorized to perform backups.
13.	When finished, click Next, and then click Finish to begin or confirm the schedule for the backup. When the backup starts, you can follow its progress on a Backup Progress dialog box.

Using Windows Backup to Recover Data

After you have performed a backup, the Backup or Restore Wizard makes it simple to restore data in the event of a hardware or software failure of some kind.

When you back up data, the Backup utility organizes its backups into backup sets, which are files that provide information that facilitates selecting information for later restore. The backup set is a collection of files and folders that were backed up by an individual backup job. The restore process uses these backup sets to oversee its actions.

Follow Step by Step 9.10 to restore data.

Step by Step: 9.10 Restoring Data in Windows XP

1.	Use one of the methods given in Step by Step 9.9 to start the Backup or Restore Wizard.
2.	Click Next.
3.	On the Backup or Restore screen, select Restore Files and Settings, and then click Next.
4.	On the What to Restore screen (see Figure 9.18), expand the media type that contains the data to be restored. Figure 9.18. The What to Restore screen enables you to select the data to be restored.
5.	Select the appropriate data, and then click Next.
6.	Review the current settings and click Finish to restore the data or Advanced to specify additional restore options.
7.	If you have clicked Advanced, you receive the Where to Restore screen, which provides you with the following destination options for the restored data: Original location Restores files to the location from which they were backed up. This is the default. Alternate location You can specify an alternate location on your computer to which files will be restored. Single folder Restores files to a single folder located in a destination that you can specify.
8.	After you have made a selection, click Next to display the How to Restore screen. This screen governs the behavior of the restore program should the restored files already exist. You can choose to leave the existing files (the default), replace existing files, or replace them if they are older than the backup files.
9.	Click Next to display the Advanced Restore Options screen. You can choose from the following options related to restoring permissions and mounted volume data, which are all selected by default: Restore security settings Restores the access control lists (ACLs) and ownership data on files backed up from an NTFS volume. Restore junction points, but not the folders and file data they reference Required for restoring data on mounted drives. Junction points are physical locations that point to the mount point located on another hard disk. If you do not select this check box, the junction points are restored as common folders, and data pointing to these points becomes inaccessible. Preserve existing volume mount points Restores empty NTFS folders to which you have mounted volumes.
10.	Click Next, and then click Finish to perform the restore.

Note

You cannot back up data directly to a CD-R, CD-RW, or DVD-R device Windows XP Backup does not directly support the use of these media. If you want to use these media, you should back up your data to a hard disk and then burn the backup file to the CD or DVD. However, you can use these media directly when restoring data.

Exam Alert

Make a habit of testing your backups and restores You should ensure that you are creating valid backups by performing test restores on a regular basis. Use the Alternate Location option referred to in Step by Step 9.10 to restore data to a different folder and verify that the restored data is present. Otherwise you may not realize something is wrong with your backups until it is too late.

Exam Alert

Windows XP restores data backed up from Windows 2000/XP/Server 2003 computers only If you have backed up data in compressed mode from an older machine such as a Windows 9x/Me computer, you cannot restore this data to a Windows XP computer. You need to ensure that the data has been backed up in non-compressed mode, and then you can restore the data to Windows XP Professional.

Returning to the Last Known Good Configuration

Every time a user logs on successfully, Windows XP makes a recording of the current Registry settings known as a control set. These settings are stored under HKEY_LOCAL_MACHINE\SYSTEM\ CurrentControlSet, and are made available so that they can be used if the computer is unable to boot because of configuration changes such as installation of new device drivers or inappropriate modification of settings. For example, if configuration changes result in a computer displaying the Blue Screen of Death (BSOD) or modified display settings render the screen unreadable, you can revert to the previous settings by using the Last Known Good Configuration. Follow Step by Step 9.11 to use this configuration.

Step by Step: 9.11 Using the Last Known Good Configuration

1.	Restart the computer (use the reset button if necessary).
2.	Press F8 as the boot sequence begins to display the Windows Advanced Options menu as shown in Figure 9.19. Figure 9.19. Windows XP provides several advanced startup options that you can use when unable to start normally.
3.	Use the arrow keys to select Last Known Good Configuration and then press Enter.
4.	On the Please Select the Operating System to Start screen, ensure that your installation of Windows XP Professional is selected, and then press Enter.
5.	When the logon screen appears, log on as usual.

Exam Alert

Know when you can and cannot use the Last Known Good Configuration Using the Last Known Good Configuration is the easiest way to correct changes when you are unable to log on as a result of various problems. If you have logged on successfully and then encounter a problem caused by a previous configuration change, you are unable to use the Last Known Good Configuration because this configuration is overwritten at the successful logon. Under these circumstances you must select a different startup option.

Troubleshooting System Restoration by Starting in Safe Mode

Objective:

Restore and back up the operating system, System State data, and user data.

• Troubleshoot system restoration by starting in Safe Mode.

Safe Mode starts your computer with a minimal set of drivers (mouse, VGA, and keyboard), so that you can start your computer when problems with drivers or other software are preventing normal startup. The following are several problems with which you can use Safe Mode for recovering your computer:

• The computer stops responding or runs very slowly You can start in Safe Mode and use various tools for diagnosing and correcting the problem. You can also uninstall software, roll back device drivers, or use System Restore to roll back the computer to an earlier point in time.

• The computer display is blank or distorted After starting in Safe Mode, you can use the Control Panel Display applet to select appropriate display settings.

• The computer fails to respond after new hardware or software is installed Use Safe Mode to uninstall software, disable hardware devices in Device Manager, roll back drivers, or restore the computer using System Restore.

To enter Safe Mode, follow the procedure outlined in Step by Step 9.11 and select Safe Mode from the options displayed previously in Figure 9.19. You can also select either of the following options:

• Safe Mode with Command Prompt Starts the computer to a command prompt. This can be useful if you cannot obtain a normal GUI.

• Safe Mode with Networking Starts network drivers as well as the other basic drivers. This is useful if you need to copy files from a network location.

Caution

Safe mode has its limitations Safe Mode does not repair problems caused by lost or corrupted system files or problems with basic drivers. In these cases, you may be able to use the Recovery Console.

Recovering System State Data and User Data by Using the Recovery Console

Objective:

Restore and back up the operating system, System State data, and user data.

• Recover System State data and user data by using the Recovery Console.

First introduced with Windows 2000, Recovery Console is an additional option for recovering a computer that is unable to boot normally. This option boots the computer to a command prompt, from which you can issue commands to perform tasks such as starting and stopping services, copying data to NTFS partitions, repairing the master boot record (MBR), and so on.

You can install the Recovery Console to make it available at startup time, or you can use the Windows XP Professional CD-ROM to start the Recovery Console if you have not installed it previously. Follow Step by Step 9.12 to install the Recovery Console.

Step by Step: 9.12 Installing the Recovery Console

1.	Insert the Windows XP Professional CD-ROM.
2.	Click Start, Run, and type d:\i386\winnt32 /cmdcons (where d: is the letter of your CD-ROM drive).
3.	You receive the message shown in Figure 9.20, which explains the use of the Recovery Console. Click Yes to proceed. Figure 9.20. You can install the Recovery Console from the Windows XP Professional CD-ROM.
4.	Dynamic Update connects to Microsoft and downloads any available updates. A Copying Installation Files dialog box then appears as Windows installs the Recovery Console.
5.	You are informed when the installation process is complete. Click OK.

After you have installed the Recovery Console, Windows makes it available from the boot loader menu. Follow Step by Step 9.13 to access the Recovery Console.

Step by Step: 9.13 Running the Recovery Console

1.

Restart your computer, using the reset button if necessary.

2.

When the boot loader menu appears, select Windows XP Recovery Console.

3.

When requested, type the number of the Windows installation. You must type a number or else the computer will reboot.

4.

Type the local Administrator password.

5.

A command prompt appears. Type the required commands from those available in Table 9.9. For a list of commands, type help.

Table 9.9. Recovery Console Commands

Command	Description
Attrib	Modifies file attributes.
Batch	Processes a list of commands from a text file.
Bootcfg	Scans the hard drives and modifies the Boot.ini file so that the computer can boot properly.
cd (chdir)	Changes to a new folder (directory) or displays the current folder name.
Chkdsk	Checks a disk and produces a status report.
Cls	Clears the display.
Copy	Copies a file to a different location. You cannot, however, copy the file to or from a floppy or Zip disk.
Del (delete)	Deletes one or more files.
Dir	Displays a list of files and subfolders in the current folder.
Disable	Disables a device driver or system service. Also displays the service's original startup type, so you can restore this startup type later.
Diskpart	Performs disk management functions such as adding or removing partitions.
Enable	Enables a device driver or system service, and allows you to specify the required startup type.
Exit	Exits the Recovery Console and restarts the computer.
Expand	Extracts compressed files, including cabinet files and Windows XP Setup files.
Fixboot	Writes a new partition boot sector to the system partition.
Fixmbr	Repairs the MBR of the partition boot sector. This is useful in case the MBR becomes infected with a virus.
Format	Formats a disk.
Listsvc	Lists available services and drivers, including their startup status.
Logon	Logs on to a Windows installation.
Map	Displays drive letter mappings.
Md (mkdir)	Creates a folder.
More/Type	Displays the specified text file on the monitor.
Net Use	Connects to a shared folder on a remote computer.
Ren (rename)	Renames a file or folder.
Rd (rmdir)	Deletes a folder.
Set	Sets or displays Recovery Console session environment variables.
Systemroot	Changes the current folder to the %systemroot% folder of the current Windows installation.
Type	Displays the contents of a text-based file on the screen.

6.

When you are finished, type exit to close the Recovery Console and reboot the computer.

If you have not installed the Recovery Console, you can still access it from the Windows XP Professional CD-ROM. Follow Step by Step 9.14 to access the Recovery Console from the CD-ROM.

Step by Step: 9.14 Running the Recovery Console from the Windows XP Professional CD-ROM

1.	Insert the Windows XP Professional CD-ROM and restart your computer. If necessary, access your computer's CMOS configuration program to configure the computer for booting from the CD-ROM.
2.	If required, press a key to boot from the CD-ROM.
3.	Wait until the Welcome to Setup screen appears. From this screen, press R to start the Recovery Console.
4.	Follow steps 3 to 6 of Step by Step 9.13.

Using Automated System Recovery (ASR)

ASR is a new Windows XP feature that replaces the Emergency Repair Disk found in Windows NT 4.0/2000. You can use ASR to repair problems related to a system disaster such as a hardware malfunction or the loss of a storage device. You should use ASR only when you have exhausted other recovery methods, including the Last Known Good Configuration, Safe Mode, or the Recovery Console.

ASR is an advanced component of the Windows Backup utility and creates a backup of the system root files, as well as a floppy disk that contains data vital for booting the computer and beginning the restore process. Follow Step by Step 9.15 to create an ASR backup.

Step by Step: 9.15 Creating an ASR Backup

1.	Use one of the methods given in Step by Step 9.9 to start the Backup or Restore Wizard.
2.	On the Welcome screen, select the Advanced Mode link to display the Backup Utility Advanced Mode screen.
3.	Select Automated System Recovery Wizard.
4.	On the Welcome to the Automated System Recovery Preparation Wizard screen, click Next.
5.	On the Backup Destination screen (see Figure 9.21), select a backup media location that is on an alternate hard drive or removable media, such as a tape drive, and then click Next. Figure 9.21. Specifying a backup file name while creating an ASR backup.
6.	Click Finish. The progress of creating the ASR backup is charted.
7.	When prompted, insert an empty, high-density 3.5-inch floppy disk.
8.	When the backup is completed, remove and label the floppy, and then store it in a secure location. The floppy contains the hard disk configuration information required to reconfigure the computer and locate the backup file should a restore be needed.

When performing an ASR backup, you should keep several things in mind. Most importantly, ASR is not a substitute for regular backups. This process backs up only the files required to restore the computer to operational condition. You should ensure that you have exhausted the other recovery options discussed in this section before using ASR. You should also take the following items into consideration:

• The ASR restore process formats the system drive partition. Consequently, applications or data files on this partition will be lost. ASR may also initialize operating system volumes containing user data. This may also cause data loss.

• You cannot use ASR to restore from a network share. You should use removable media such as tapes or DVD-R discs, or a second local hard drive to store the backup file created by ASR.

• ASR is not a substitute for System Restore. Whereas ASR backs up all files on the system partition, System Restore saves only incremental changes. You should always try System Restore firstbefore you attempt to use ASRif you can start your computer in normal mode or Safe Mode.

• You should create an ASR backup when the computer is running properly, so that it is available should a disaster occur. You should create a new ASR backup after installing new drivers or service packs.

Restoring Your Computer with ASR

The ASR restore process checks the hard disk for errors and verifies the system files. You need to use the Windows XP Professional CD-ROM, the most recent ASR backup media, and the ASR floppy disk. Follow Step by Step 9.16 to perform an ASR restore.

Step by Step: 9.16 Using ASR to Restore Your Computer

1.	Follow steps 1 and 2 of Step by Step 9.14 to restart your computer from the Windows XP Professional CD-ROM.
2.	When the ASR prompt appears, press F2 and insert the ASR floppy disk.
3.	When prompted, insert the ASR backup media.
4.	When prompted, specify the destination folder, such as C:\Windows.
5.	Allow the restore to proceed. When prompted, remove the ASR floppy disk and restart the computer.

Using System Restore to Restore Your Computer to an Earlier State

System Restore enables you to recover from system problems such as those caused by improper system settings, faulty drivers, and incompatible applications. It restores your computer to a previous condition without damaging any data files such as documents and email. It is useful in situations such as problems that persist after you have uninstalled incompatible software or device drivers, or after having downloaded problematic content from a Web site, or when you are having problems that you cannot diagnose, but that have started recently.

During normal operation, System Restore creates snapshots of the system at each startup and before major configuration changes are started. It stores these snapshots and manages them in a special location on your hard drive. It also copies monitored files to this location before any installation program or Windows itself overwrites these files during application or device installation.

You can run System Restore from the Performance and Maintenance category of Control Panel, or from the Help and Support Center. Step by Step 9.17 shows you how.

Step by Step: 9.17 Using System Restore to Restore Your Computer

1.	From the left pane of the Performance and Maintenance category window of Control Panel (or from Pick a Task in the Help and Support Center), select System Restore. This opens the System Restore dialog box, as shown in Figure 9.22. Figure 9.22. The System Restore dialog box enables you to perform a System Restore or create a restore point.
2.	To restore your computer's configuration to an earlier time, select Restore My Computer to an Earlier Time, and then click Next.
3.	In the Select a Restore Point dialog box that opens, click a bold date, select a restore point from the list, and then click Next.
4.	In the Confirm Restore Point Selection dialog box, note the warnings and then click Next to perform the restore. The computer performs the restore, and then shuts down and restarts.
5.	Log back on as an administrator. You receive a Restoration Complete dialog box. Click OK.

Note

System Restore also enables you to create restore points If you are planning to install or download applications or other material that could be problematic, you can manually create a restore point first. Simply select the Create a Restore Point option shown in Figure 9.22 and follow the instructions provided.

Note

You can use Safe Mode and System Restore together to correct problems If you are unable to start your computer properly but able to start in Safe Mode, you can perform a System Restore from Safe Mode to restore your computer to a functional state.