Disk Management

Regardless of what file system or storage types you have in place on your hard drives , all routine disk maintenance and configuration is done from one place: the Disk Management console, shown in Figure 5.12.

Figure 5.12. The Disk Management console.

You must be logged on as a Computer Administrator to use this tool. You can open the Disk Management console in several different ways, the two easiest being as follows :

• From within the Computer Management console, click Start, Programs, Administrative Tools, Computer Management (or right-click on My Computer and choose Manage). Then, from within the Computer Management console, expand the Storage node and then select Disk Management.

• From the command line, type diskmgmt.msc .

The following are just some of the tasks that can be performed using the Disk Management console:

• Create new partitions and logical drives.

• Create new volumes .

• Determine disk size , file system, disk health, and other pertinent information. This can easily be done by looking at each volume in the Disk Management console as shown in Figure 5.12.

• Format volumes and partitions.

• Assign drive letters or paths to hard drives and removable storage drives. This can be done by right-clicking on the volume of concern and selecting Change Drive Letter and Paths.

• Mount and unmount drives.

• Upgrade basic storage to dynamic storage.

• Extend the size of dynamic volumes.

Some of the more complex of these tasks are discussed in more detail in the following sections, but most can be explained in brief.

For more information about the disk formats and their options and functions, see "Disks, Partitions, and Volumes," p. 446.

Creating New Partitions and Logical Drives

To create a new partition or logical drive from the Disk Management console, follow these steps:

1.	Open the Disk Management console as discussed previously.
2.	To create a new partition, right-click an unallocated region of a basic disk, and select New Partition. To create a logical drive, right-click in an extended partition, and select New Logical Drive.
3.	Follow the onscreen prompts in the New Partition Wizard to enter the desired partition size and so on.

Note

The diskpart command-line utility can also manage disk partitions. For more information, search the Windows Help and Support Center for diskpart . There are two "Overview" articles named DiskPart; one is the diskpart program in the Recovery Console, and the other is for the full version. You want to read the article that starts "DiskPart.exe is a text-mode command interpreter..."

Creating New Simple Volumes

To create a new simple volume from the Disk Management console, follow these steps:

1.	Open the Disk Management console as discussed previously.
2.	Right-click the unallocated space on the dynamic disk on which you want to create the simple volume, and then click New Volume.
3.	In the New Volume Wizard, click Next and then click Simple. Follow the onscreen prompts to complete the process.

You can create other types of volumes on dynamic disks in much the same fashion. Dynamic disk volumes, however, can't be read by Windows 9x or MS-DOS, so you may not want to use them if you dual-boot your computer.

Formatting Disks and Volumes

Formatting storage media is a fairly common task you can easily accomplish using the Disk Management console. Windows XP supports formatting numerous kinds of media, partly due to its excellent multimedia support. You can format hard drives, removable storage media (such as ZIP drives), and DVD-RAM disks to name a few of your options.

Note

Although you can format removable media from within the Disk Management console, you most likely won't. Instead it's more likely that you will use Windows Explorer, simply because it's easier to get to an Explorer window and because many of the advanced Disk Management console tools for fixed drives don't apply to removable storage.

Windows XP is fairly intelligent and self-protective, and will not allow you to format the system or boot partitions from within the Disk Management console. Those options will be grayed out. To begin the process of formatting a hard drive or removable media device, right-click the volume (or unallocated space) of interest from within the Disk Management console and select Format, which opens the window shown in Figure 5.13. Depending on how large the volume to be formatted is, you will have the choice to format it as FAT16, FAT32, or NTFS. For hard disks, you probably want to use NTFS formatting, unless you have to be able to read and write the disk volume from MS-DOS, Windows 9x, or Linux. To share the volume with MS-DOS, use FAT16; to share with Windows 9x or Linux, choose FAT32.

Figure 5.13. Formatting a new drive or partition.

Note

We haven't mentioned standard floppy disks. Does anyone use them anymore? I have a huge pile of them sitting around gathering dust. The only way to format standard floppy disks is using Windows Explorer. Standard floppy disks are formatted using a special file system called FAT12, incidentally.

Formatting removable media such as DVD-RAM, Flash, or ZIP disks follows the same process, except that you will not have the choice of file systems; all removable media (other than floppies) are formatted with the FAT (which is really to say FAT16) file system.

Remember that in order to convert a basic disk to dynamic later on, be sure to select 512 bytes as the sector size. In most cases, this is the smallest size available (due to the physical construction of the hard drive itself) and will be selected by Windows XP automatically if the Allocation Unit Size setting is left as Default, as shown in Figure 25.6.

The other options available to you during a format operation are fairly simple, but still deserve some mention.

• The volume label can be a descriptive name that you use to readily identify the volume. You should keep the label as short as possible and avoid using the following reserved characters: < > : " / \ * ? + and . because they will cause problems when accessing volumes over the network. Note that Windows XP will not stop you from using the characters for a volume nameyou have to do that for yourself. If a disk is formatted with the FAT file system, the label can contain up to 11 characters. If the disk is formatted with the NTFS file system, the limit is 32 characters .

• The file system will be a choice of FAT16, FAT32, or NTFS as previously mentioned.

• Selecting to perform a quick format removes files from the disk but does not scan the disk for bad sectors. You should only use this option if the disk has been previously formatted and is known to not have any damage to it.

• Selecting the last option, Enable File and Folder Compression, will configure the newly formatted volume for file and folder compression. Remember that this will prevent you from later using EFS encryption unless compression is removed.

Of course, should you need to format drives from the command prompt, you still can. The format command has the following syntax:

 format volume [/fs:filesystem] [/v:label] [/q] [/a:unitsize] [/c] 

The parameters for the format command are outlined in Table 5.6.

Table 5.6. Parameters for the format Command

Parameter	Description
Volume	Specifies the mount point, volume name, or drive letter of the drive you want to format.
/fs: filesystem	Specifies the file system to use: FAT, FAT32, or NTFS. Floppy disks can use only the FAT file system.
/v: label	Specifies the volume label. If you omit the /v command-line option or use it without specifying a volume label, format prompts you for the volume label after the formatting is completed.
/q	Performs a quick format. Deletes the file table and the root directory of a previously formatted volume but does not perform a sector-by-sector scan for bad areas.
/a: unitsize	Specifies the cluster size, also known as allocation unit size, to use on FAT, FAT32, or NTFS volumes. If unitsize is not specified, it will be chosen based on volume size.
/c	NTFS only. Files created on the new volume will be compressed by default.

Creating Mounted Drives

Windows 2000 and XP let you join two separate drives or volumes into one larger, virtual volume. It's called mounting , and it works by making the entire contents of one volume appear in the place of a specified folder on another volume. For example, if I created a new empty folder named c:\mounted , I could format a new hard disk, and mount it to c:\mounted . The root folder of the new volume will appear as the contents of c:\mounted , and subdirectories in the new volume will appear as subdirectories of c:\mounted ...it's all very UNIX-like. One reason you might want to do this is if you needed to add space to an existing file system but don't want to change the directory structure. As long as you don't mind that the added space is only available in a specific set of folders, mounting a new drive is a nifty way to do it.

To create a mounted drive from the Disk Management console, follow these steps:

1.	Open the Disk Management console as discussed previously.
2.	Right-click the partition or volume you want to mount, and then click Change Drive Letter and Paths.
3.	To mount a volume, click Add. Click Mount in the following empty NTFS folder and enter or browse to the empty folder. To unmount a volume, click it and then click Remove.

Converting Basic Disks to Dynamic Disks

Dynamic disks have a slightly different partition structure than the basic disks that we inherited from MS-DOS. Dynamic disks have some advantages; they can have their partition sizes changed, for one thing. They can't be read by older operating systems, so if you dual-boot your computer you probably don't want to use them, but if you're running straight XP and use NTFS-formatted disks already, you might consider it. To convert a basic disk to dynamic from the Disk Management console, follow these steps:

1.	Open the Disk Management console as discussed previously.
2.	Right-click the basic disk you want to convert and select Convert to Dynamic disk. Follow the onscreen prompts to complete the process. Looking at Figure 5.10, the area to click in is that area on the left side of each disk in the bottom frame.

Extending Dynamic Volumes

To extend a dynamic volume from the Disk Management console, follow these steps:

1.	Open the Disk Management console as discussed previously.
2.	Right-click the simple or spanned volume you want to extend and click Extend Volume. Follow the onscreen prompts to complete the process.

A few things to keep in mind when attempting to extend volumes:

• You cannot extend a system volume or a boot volume.

• You cannot extend striped volumes.

• You cannot extend a dynamic volume that was upgraded from a basic volume to a dynamic volume in Windows 2000 if you've subsequently upgraded to Windows XP.

• You cannot extend a simple volume onto additional dynamic disks to create a spanned volume. Spanned volumes cannot be mirrored or striped.

• If you extend a spanned volume, you cannot delete any portion of it without deleting the entire spanned volume.

Resizing Basic Disks

If you are using basic storage on your disk drive and you decide that you need to adjust your partition layout after it has been initially created, you have three possible means to this end: You can use the diskpart utility, you can delete and re-create partitions, or you can use a third-party utility such as Partition Magic.

Using the extend command within the diskpart utility, you can add more space to existing primary partitions and logical drives as long as you meet the following requirements:

• The basic volume must be formatted with NTFS.

• You can extend a basic volume using space from the same physical hard disk only (unlike dynamic volumes). The basic volume must be followed by contiguous unallocated space.

• You can extend a logical drive only within the contiguous free space that exists in the partition that contains the logical drive.

If you meet all the aforementioned requirements, you can extend a basic disk as follows:

1.	Open a command window by clicking Start, Run and entering cmd into the Run box. Press Enter.
2.	Type diskpart .
3.	Type list volume . Write down what volume you want to extend.
4.	Type select volume n , where n is the volume you identified in the previous step.
5.	Type extend [size=n] , where n is the extended size of the volume in MB.

If working from the command line is not your thing, and you are not ready to perform mass deletions (as required by the third method), you may want to consider using a third-party disk utility, such as Partition Magic from Symantec. Partition Magic allows you to redesign your partition table graphically within the Windows XP GUI and then on the subsequent restart performs the required actions to carry out your wishes.

If you choose not to use either of the other methods presented, you can still resize your basic disks, with no out-of-pocket cost. It is more laborious, however. You'll need to back up all pertinent data on the partition(s) in question, delete the partitions, and then re-create them sized to your liking. After formatting the new partitions, you can then restore your data onto them. Yuck.

If you are running with dynamic storage volumes, resizing your volumes is an easy process. You simply right-click on the volume that you want to extend and select Extend Volume. This will open the Extend Volume Wizard, which will allow you to enter the size you want to extend the volume to. After the wizard has finished, which is a relatively quick process, you will have a volume that is now larger...all without a restart of the computer or the time- intensive process of copying and recopying all the files in that volume. It's quite a time saver.

Converting FAT16/FAT32 File Systems to NTFS

Should you make the decision to upgrade your hard disk's file system from FAT16 or FAT32 to NTFS, you will need to perform the upgrade from the command line by using the convert command. The convert command has the following syntax:

 convert [  volume  ] /fs:ntfs [/v] [/cvtarea:  FileName  ] [/nosecurity] [/x] 

The parameters for the convert command are outlined in Table 5.7.

Table 5.7. Parameters for the convert Command

Parameter	Description
Volume	Specifies the drive letter (followed by a colon ), mount point, or volume name to convert to NTFS.
/fs:ntfs	Required. Converts the volume to NTFS.
/v	Specifies verbose mode; that is, all messages will be displayed during conversion.
/cvtarea: FileName	Specifies that the Master File Table (MFT) and other NTFS metadata files be written to an existing, contiguous placeholder file. This file must be in the root directory of the file system to be converted. Use of the /cvtarea parameter can result in a less fragmented file system after conversion. For best results, the size of this file should be 1KB multiplied by the number of files and directories in the file system; however, the convert utility accepts files of any size. You must create the placeholder file using the fsutil file createnew command prior to running convert , which does not create this file for you. convert overwrites this file with NTFS metadata. After conversion, any unused space in this file is freed.
/nosecurity	Specifies that the converted files and directory security settings are accessible by everyone.
/x	Dismounts the volume, if necessary, before it is converted. Any open handles to the volume will no longer be valid.

To convert your C: drive and apply standard security restrictions, for example, the command is

 convert c: /fs:ntfs 

Only hard disks can be updated; NTFS isn't used on removable media like floppies, flash disks and CD-RWs. You can format a USB or Firewire-attached hard drive with NTFS, however.

Caution

Converting your existing FAT or FAT32 volume to the NTFS file system will preclude you from uninstalling Windows XP at a later date. This is no big loss of freedom if you are upgrading from Windows 2000 or NT because those upgrades are not reversible anyway. But if you hoped to return to Windows 98 or Me, for example, because they don't read NTFS, it's obvious why uninstallation would be problematic . This sort of limitation is one reason why people who deal with multiboot scenarios stick with FAT-based disks.

Note

Unknown to most people, the convert command has quietly received an upgrade from the Windows 2000 version. Using the convert command in Windows 2000 would produce a volume that did not have the default NTFS permissions settings that you would get after installing Windows itself. The version of convert that comes with Windows XP fixes this problem by automatically applying the correct default permissions to all folders. When used with the /cvtarea switch to create an unfragmented MFT, there is virtually no difference anymore between a volume converted to NTFS during setup of Windows or by using the convert command.

Converting the NTFS File System to FAT16/FAT32

Reversion from NTFS to FAT16 or FAT32 is not supported by Windows XP; however using a third-party disk utility such as Partition Magic will allow you to perform this task.

Hard Drive Cleaning

It may seem that after getting your hard drives set up and configured to your liking all of your work is done. Nothing could be further from the truth, unfortunately . Over time, as I'm sure you know, Windows systems do accumulate hundreds and possibly thousands of unnecessary files and folders on your hard drives. Not only do these files and folders waste valuable space, they can slowly degrade system performance. In this section, I am going to blow the top off of some of Windows's secrets and show you how to keep your hard drives slim and trim.

Temporary FilesTo Be Eliminated at Any Cost

Windows XP likes to store its temporary files in three places, more often than not. That is not to say that some rogue program will not deposit some temporary files in another location; just that in most cases you can look in three places to find the dead wood you've been collecting on your system. These three places are

• %USERPROFILE%\Local Settings\Temp Here you will typically find temporary files that were not properly cleaned up by the application that created them.

• %USERPROFILE%\Local Settings\Temporary Internet Files Here you find the cache used by applications such as Outlook and Internet Explorer. The files are usually hidden, but they are there in droves.

• %SYSTEMROOT%\Temp Another dumping ground that some applications like to use for their temporary files.

There are two methods for cleaning up temporary files: the GUI-based Disk Cleanup utility and a command-linebased script you can use.

Using the Disk Cleanup Utility

The easiest way to help clean the dead wood from your hard drives is to use the Disk Cleanup utility on a regular basis. The Disk Cleanup utility is launched by clicking Start, All Programs, Accessories, System Tools, Disk Cleanup. You can also launch it by right-clicking on a drive icon in any Explorer window and choosing Properties, Disk Cleanup.

There are two useful tricks to getting more out of Disk Cleanup. The first thing is to make use of two undocumented switches for the Disk Cleanup utility that can be accessed from the command line. The second is to schedule the Disk Cleanup utility to run automatically, using advanced settings of your choice, thus purging your hard disk of specific types of unwanted types of files on a regular basis.

You can use the command line to gain additional categories of files to delete, as shown in Figure 5.14.

Figure 5.14. Additional, more-or-less hidden configuration settings for Disk Cleanup.

To use them, follow these steps:

1.	Start the Disk Cleanup utility from the command line by opening a Command Prompt window and typing cleanmgr /d x /sageset: n , where x represents the drive letter you want to clean, and n is any number between 1 and 65535. The /sageset: n value provides a means for you to create multiple preconfigured Disk Cleanup instances, each with the specific drives and options selected that you desire . Which value you choose for the /sageset: n value doesn't matter; it is only used to store your settings in the Registry to allow you to run Disk Cleanup with those options again in the future.
2.	After you press Enter, the hard disk will grind a bit. Then up will pop the Disk Cleanup Settings dialog. The actual categories offered may be different on your computer. Select the categories of files you want to delete and click OK to save these settings into the Registry. You can click on each option to read a description of it. Note that choosing to compress files that are not often used could take a while, during which time the compression occurs.
3.	Create a shortcut to cleanmgr /sagerun: n , where n is the number you chose previously in step 1.
4.	Using the Scheduled Task Wizard (Start, Settings, Control Panel, Scheduled Tasks), create and configure a scheduled task to run daily or weekly using the shortcut you created in step 3.

You will probably want to create a Disk Cleanup setting and shortcut for each drive on your system.

Defragmenting for Greater Speed

Computers store information on their hard disks in a disorganized fashion, using whatever bits and pieces of free space they find, and as files are added and deleted, the unused space gets more and more spread out in tiny little bits. Imagine if you had to place 50 pieces of paper flat on your desk, without overlapping. You would line them up nicely , one next to the other, in order, although it might nearly cover your desk. Now take 20 pages away at random, and put a 20 page essay down in their place. They can't all get put down side by side now, so you'll have to put each page wherever you can, in any empty space you can find. Fine, but now try to pick them up, in order. Oops! They're all scattered all over the place, and to find page 1, then page 2, then page 3...you're going to be at this for a while.

That's fragmentation. And on your hard drive, there aren't just 50 places for pages to be scattered, but tens of millions. Over time, the slowdown from increasing fragmentation becomes significant. Cleaning it up by collecting the scattered pieces of each of your files and moving them into consecutive spaces on the disk is called defragmentation , and Windows comes with a tool to do a fair-to-middlin' job of it. To use the tool:

• From within the Computer Management console, choose Start, All Programs, Administrative Tools, Computer Management. From within the Computer Management console, expand the Storage node and then select the Disk Defragmenter tool.

  Or

• From the command line: type dfrg.msc .

No matter which way you launch the GUI version of the disk defragmenter; your options are the same.

To see whether defragmentation is severe (or more precisely, to see whether the Windows defragmenting tool is going to do anything about it) you can run an analysis on a volume by clicking the Analyze button. When the analysis is complete, you will receive a report similar to the one shown in Figure 5.15.

Figure 5.15. The defragmentation analysis results window.

Should you decide to perform the defragmentation, click the Defragment button and watch the progress as shown in Figure 5.16.

Figure 5.16. Defragmenting a volume.

Defragmenting a volume is an extremely CPU- and hard drive-intensive operation, and it is severely hampered if you continue to work with the computer while it's going on. In particular, saving documents or otherwise writing files to the disk can make the defragmenter have to start over from scratch. As with the Disk Cleanup utility, the true power of the Disk Defragmenter comes if you use the Windows Task Scheduler to create a scheduled event for it and allow it run weekly during a low-usage time, such as early in the morning every Sunday.

Tip

The defragmentation tool provided with Windows is a "lite" version of a commercial product called Diskeeper. You can also buy disk defragmenters that do a more thorough job, and which, for example, can defragment the Windows page file. Check out PerfectDisk at www.raxco.com and Diskeeper at www.diskeeper.com (with one k) for two such products.

Although you can perform disk deframentation with the GUI, you can also do it from the command line, which is helpful if you want to create a cleanup batch file or script. You can defragment a volume with the defrag command, which has the following syntax:

 defrag  volume  [/a] [/v] [/f] 

The parameters for the defrag command are outlined in Table 5.8.

Table 5.8. Parameters for the defrag Command

Parameter	Description
volume	The drive letter or a mount point of the volume to be defragmented.
/a	Analyzes the volume and displays a summary of the analysis report.
/v	Displays the complete analysis and defragmentation reports .
/f	Forces defragmentation of the volume regardless of whether it needs to be defragmented.

Without options /a or /f , defrag makes its own decision whether to defragment or not.

A few points should be kept in mind when attempting to perform disk defragmentation:

• A volume must have at least 15% free space to be defragmented. Defrag uses this space as a sorting area for file fragments . If a volume has less than 15% free space, defrag will only partially defragment it.

• You cannot defragment volumes that the file system has marked as "dirty." A volume that is marked as dirty may be in an inconsistent status, which will require the CHKDSK utility to be run to verify the consistency of the volume. A volume could be marked as dirty if it is online and has outstanding changes that must be made at the next successful startup or if the volume is corrupt. To solve this, restart Windows.

• You cannot run the defrag command and GUI Disk Defragmenter utility simultaneously . And, you cannot defragment more than one volume at a time.

Backing Up Your Disk

I'm sure I don't need to warn you of the importance of backing up your hard drive. Computers are so much more reliable today than they were even a decade ago, but they do still fail, and you can be sure that one day when you turn on your computer you'll see nothing on the screen but "Hard Drive Failure." All those photographs, emails, songs, all that work...all gone. It's a sickening feeling. And it could happen tomorrow. So: You have to back up.

The good news is that it's not expensive, and it's not difficult. You can get a high-capacity tape drive, but these days, I find it's just as easy to use a 200 or 250GB Firewire or USB-2 portable hard drive. These currently cost less than $200less if you find a sale or rebate promotion, and the security they give you is well worth the cost (if it makes you feel better, when the first hard drive came out in 1956, that much disk space would have cost $13.6 billion in today's dollars). My own backups are about 40GB in size, so I can do one a week and easily fit four on a single portable drive.

Windows XP (as well as Windows 2000) comes with a backup program that you can use to perform system backups. It's not very sophisticated; you can buy better, but this one is free, and it's provided with every copy of Windows. If you have a larger network, you should seriously think about acquiring an enterprise backup solution, such as Backup Exec or NetBackup.

Note

NTBackup is provided with Windows XP Home Edition, but it's not installed when you set up Windows. To install it, insert your Windows XP setup CD-ROM, and use Windows Explorer to browse to \VALUEADD\MSFT\NTBACKUP . Double-click ntbackup.msi to install the program. If you're not a Computer Administrator, right-click ntbackup.msi , select Run As, and use an Administrator account.

The backup utility in Windows XP has undergone some changes from its predecessor in Windows 2000. The two major changes are support for XP's Volume Shadow Copy feature, and the replacement of the Emergency System Recovery disk with the Automated System Recovery feature on XP Professional.

Volume Shadow Copy

When Windows 2000 performed a backup, files that were in use while the backup was performed were often omitted from the backup set, including important user Registry files. Files that were actively being updated that did get backed up could be saved in an inconsistent state, with different parts of the file saved before, during, and after changes were made.

Windows XP's Volume Shadow Copy feature solves both problems by letting Windows present the backup program with a view of the entire file system frozen at a moment in time. Internally, Windows keeps a copy of the original versions of any individual disk data blocks that are modified after the moment that the Shadow copy is created. The backup program can then be fed this original data, while every other application sees ongoing, changing data from moment to moment. When the backup has completed, Windows releases the frozen copies of the changed data, so overall there is no cost to the file system.

Automated System Recovery

Automated System Recovery (ASR) is an advanced restoration option of the Backup utility available only on Windows XP Professional, not on Home Edition. ASR can be used to restore your system if other disaster recovery methods fail or are not available for use. Using ASR, you can restore the operating system back to a previous state, which will allow you to start Window XP Professional in the event that other methods do not work. You should always consider ASR your last resort for recovery, after Safe mode, the Recovery Console, and Last Known Good Configuration, which are detailed in Chapter 12, "Windows Troubleshooting." You should make a point to keep your ASR media up to date as you make configuration changes to your computer in order to minimize the amount of recovery required should you ever need to use ASR. To use the ASR Wizard to create a set of ASR media, you only need to click on the Automated System Recovery Wizard button on the main page of the Backup tool, as shown in Figure 5.17.

Figure 5.17. Start the Automated System Recovery Disk Wizard from the main page of the Backup utility.

Using Windows Backup

Using the Backup utility consists of three distinct processes: creating one or more backup configurations, scheduling backups to occur automatically, and performing restorations.

There are five types of backups you can perform:

• Normal backup Copies all selected files and marks each file as having been backed up (the archive bitthe "changed since last backup" file attributeis cleared). Only the most recent backup set is required to perform restoration.

• Incremental backup Copies only those files created or changed since the last normal or incremental backup; the archive attribute is then cleared. Using normal and incremental backups, you will require the last normal backup and all intervening incremental backups in order to perform restoration.

• Differential backup Copies files created or changed since the last normal backup; the archive bit is left alone. Differential backup set will get larger over time, as more and more files are changed since the last normal backup. Eventually a new normal backup has to be performed. The benefit is that only two backup sets are needed to restore all files: the last normal backup, and the most recent differential backup.

• Copy backup Copies all selected files but does not mark each file as having been backed up (the archive attribute is not cleared). Copy backups have no effect on any other type of backup operation.

• Daily backup Copies all selected files that have been modified the day the daily backup is performed; the archive attribute is not cleared in this case. This is a risky procedure as files modified right around midnight could be left behind, and missing a day leaves files unprotected .

In addition to your system's drives, you will see that NTBackup has a choice to back up something called System State. This is a collection of Registry data, device drivers, and system programs. When you back up your entire hard drive, this stuff is included, so you don't need to specify it in that case. It's mainly an option you can use to back up Windows itself before installing a new driver or application. The new System Restore feature does just as good a job of this, so System State is less necessary now than in the past. System Restore is discussed later in this chapter.

Creating the Backup Configurations

The Windows Backup utility makes it extremely simple to create a backup configuration. The basic steps to create the configuration are outlined here, although your options and decisions will vary depending on how your system and backup media devices are configured.

1.	Log on as a Computer Administrator user. Start the Backup Wizard by clicking Start, All Programs, Accessories, System Tools, Backup; or, at the command prompt, type ntbackup .
2.	Start the Backup Wizard by clicking the Backup Wizard (Advanced) button.
3.	Click Next to dismiss the opening page of the Wizard. From the What to Back Up page, select the scope of the backup: everything, selected files, or System State, which includes the Registry and Windows' protected files. Click Next. If you chose to back up selected files and folders, proceed to step 4, otherwise skip to step 5.
4.	From the Items to Back Up page, choose the files and folders to back up, as shown in Figure 5.18, and then click Next. If you have mapped network drives to drive letters, you can also back up these folders even though they are stored on other computers. Figure 5.18. Selecting files to back up. In this example, both the C: and D: drives will be backed up.
5.	From the Backup type... page, choose the backup filename and location and click Next. In the case of a removable hard drive, enter the drive letter for the drive, followed by a filename that identifies your backup. You can also store the backup on another computer, using a network drive. For the filename, you might want to use names that incorporate the name of the computer and the date and type of the backup. For example, I might name a full backup of my computer named JAVA on July 4 as java_full_0704.bkf.
6.	To configure advanced options, including scheduling and disabling volume shadow copy, click Advanced and proceed to step 7. If you want to perform this backup immediately, click Finish.
7.	From the Type of Backup page, select the type of backup you want (the default is Normal) and click Next. I personally perform Normal backups monthly, and Differential backups weekly or more often, but you can use a different schedule; certainly do it no less often than I do!
8.	From the How to Back Up page, select your preferences as they relate to verification and volume shadow copy and select Next. It's generally not necessary to verify backups written to a disk. If you're backing up to tape, you may want to verify.
9.	From the Backup Options page, select whether to append or overwrite existing data and select Next. For backups to a disk, select overwrite rather than append.
10.	From the When to Back Up page, select when you want to perform this backup and click Next. If you selected Now, click Finish to start the backup.
11.	If you selected Later, you will be able to configure scheduling options. When you have completed setting all scheduling options, click Next. Enter the username and password information of a Computer Administrator account when requested (to ensure that this user has permissions to perform backups). Click Finish to complete the procedure.

Additionally, you can choose to create a backup configuration manually, however you will still make all of the same decisions as when using the Backup Wizard.

Excluding Files from Backups

If you watch the backup procedure in action, you may see it copying large files that you know aren't valuable, and which you would just as soon not have backed up at all. Although you could manually locate and uncheck these files in the list of files to back up, you can also make settings in NTBackup to exclude them automatically.

NTBackup ignores all files listed under Registry key HKEY_LOCAL_MACHINE\system\CurrentControlSet\Control\BackupRestore\FilesNotToBackUp (exclusions for all users), and under HKEY_CURRENT_USER\system\CurrentControlSet\Control\BackupRestore\FilesNotToBackUp (exclusions for the user running NTBackup).

The FilesNotToBackUp list is also excluded by the System Restore feature, discussed in Chapter 12. Many file types are excluded by default. The default list of files types designated for exclusion are listed in Table 5.9.

Table 5.9. Default FilesNotToBackUp Categories

File Categories

Automated System Recovery Error File

Automated System Recover Log File

Background Transfer (Automatic Updates) metadata

Catalog Database

Client Side Cache (offline files)

Digital Rights Management

Internet Explorer cache index

Memory Page File

Microsoft Writer (Bootable State)

MS Distributed Transaction Coordinator database

Netlogon

Files manually listed for exclusion in NTBackup

Hibernation file

Registry Writer data

SUS (Software Update) Client

System Restore index data

Task Scheduler log

Temporary files (TEMP environment variable)

Winlogon debugging information

You can add exclude additional files by following these steps:

1.	Start NTBackup, and select the link for Advanced mode.
2.	Select Tools, Options, and view the Exclude Files tab.
3.	Click one of the Add New buttons , under All Users or under your user account name.
4.	Select a listed file extension (file type), such as .xyz to eliminate all .xyz files, or enter a file matching pattern such as DATA*.Z*, to match files based on name as well as extension, as shown in Figure 5.19. Figure 5.19. Listing files or file types for exclusion.
5.	Select or type a path , and check or uncheck Applies to All Subfolders.
6.	Click OK, and either add more entries, or click OK again to save the updated list.

Scheduling Your Backups

Managing a backup schedule is very easy in Windows XP. Simply switch to the Schedule Jobs tab from the Backup utility advanced view (see Figure 5.20). Each day on the calendar will show what type of backup is scheduled for that day. Holding the cursor over a backup will display the backup name. You can edit the backup properties, including rescheduling the backup, by clicking it. You can also create new backup configurations by clicking the Add Job button. Figure 5.20 shows the schedule of Normal backups I have in place on one of my Windows XP Professional computers.

Figure 5.20. Scheduling backup jobs.

After a Disaster: Performing the Restoration

Should the day actually come that you need to put your backup system to the test, the actual process of performing the restoration is a relatively easy task in Windows XP Professionalas long as you are ready for the task. The basic steps to perform a restoration are outlined here, although your options and decisions will vary depending on how your system and backup media devices are configured.

1.	You will need a working copy of Windows XP. If your original installation of Windows is working, and you just need to recover a few files, this isn't a concern. But if you lost your entire hard drive, you'll need to install a fresh copy of Windows XP. You'll be replacing this installation with the version saved on your backup, so don't spend any time configuring it, just get it to the point of being able to run ntbackup and read the saved backup files.
2.	Log on as a Computer Administrator user. Start the Backup Wizard by clicking Start, Programs, Accessories, System Tools, Backup, or click Start, Run and enter ntbackup .
3.	Start the Backup Wizard by clicking the Restore Wizard (Advanced) button from the main page of the Backup utility.
4.	Click Next to dismiss the opening page of the wizard.
5.	From the What to Restore page, select the backup set and the files you want to restore (all, or just some). If your desired backup set is not listed, click the Browse button to locate it. You will need to browse to the disk files that you stored on the removable disk or on a network folder. After making your selections, click Next.
6.	To configure advanced options, such as changing the restoration location, click Advanced and proceed to step 7. Otherwise, click Finish to start the restoration.
7.	From the Where to Restore page, select the restoration location for the files and click Next. Generally you will want to restore files to their original location, unless you want to be able to compare the files you have on your disk now with the files in the backup set; in that case, you must restore them to a different folder.
8.	From the How to Restore page, select your option in regards to overwriting existing files and click Next. In most cases, you will want to replace all files in all circumstances; this will get you back to the original version you had in the backup set. If you are just recovering files you accidentally deleted, you do not want the restore operation to overwrite newer files.
9.	From the Advanced Restore Options page, select the options you want, and click Next.
10.	Click Finish to start the restoration.

Note

Before performing a restore that includes the Registry, NTBackup examines Registry value HKEY_LOCAL_MACHINE\system\CurrentControlSet\Control\BackupRestore\KeysNotToRestore . Keys listed here are not restored. If a key name ends with \ , the key's subkeys are also not restored. If a key name ends with \* , the subkeys are merged based on Start values. This helps when restoring Windows onto a computer with a different hardware setup. For more information see support.microsoft.com/default.aspx?kbid=249694.

The following list provides some additional help when deciding which advanced restore options to choose.

• Restore Security Restores security settings for each file and folder. You usually want this enabled.

• Restore Junction Points, and Restore File and Folder Data Under Junction Points to the Original Location Restores junction points on your hard disk as well as the data that the junction points point to. If you are restoring a mounted drive, and you want to restore the data that is on the mounted drive, you must select this check box. If you do not select this check box, you will only restore the folder containing the mounted drive. This applies to very few users, so if you don't know what a Junction Point is, you don't need to worry about it.

• Preserve Existing Volume Mount Points Prevents the restore operation from writing over any volume mount points you have created on the partition or volume you are restoring data to. Again, if you haven't created mount points, leave the default setting alone.

• Restore Removable Storage Database Restores the Removable Storage database and deletes the existing Removable Storage database. If you are not using the Removable Storage manager to manage storage media (tapes, for instance), you do not need to select this option.

Note

After restoring a full system, restart Windows. You may find that some of your hardware doesn't work when Windows comes back up. To fix this, open the Device Manager, right-click each of the non-functioning devices in turn, and select Uninstall. Restart Windows again. Log back on as a Computer Administrator, and the Found New Hardware wizard should pop up. Let it locate device drivers automatically. This ought to get everything working again.

If you really do need to restore the Registry and Windows itself, however, you might be better off using the System Restore feature that's built into Windows. It does require that your hard disk is intact, but it's a more sophisticated system that's better for recovering from serious configuration goof-ups.