ToC Gaming News Blog : All The Latest PC Gaming News

NEWS HEADLINES

How to restore a PC from a WHS backup

Thursday, February 07, 2008 5:05:06 PM (GMT Standard Time, UTC+00:00)

I caught a nasty Trojan last night. Not sure where it came from, but it got in to the system all the same. It was the Trojan.vundo.DSQ virus. Started making little files all over the hard drives..

Moreover, 2 new icons appeared on the desktop :
- Help and Support Center
- Windows Update

also received the following message :
During a scan of files at system startup, potentital errors in the system registry were found p-07-0100 irql: 1f SYSVER 0xff00024
NT_Kernel error 1256
KMODE_EXCEPTION_NOT HANDLED

Its a nasty one for sure, the removal method is a bitch if I do say so myself, it requires you to gain a list of suspect files from several methods and then doing a windows repair on your system, dropping to the recovery console and deleting the suspect files manually, you can see a full how to here : http://forum.bitdefender.com/index.php?showtopic=1054

WHS backs up your system using clusters, so when you restore its like a byte for byte cluster level mirror. Rather than go down the long winded manual removal method from the above link, I decided to put WHS to the acid test. It was obvious to me that if I could roll back the system to a couple of days ago before the infection, everything would be fine. Windows System Restore was an obvious route to go down here, but I've come across to many Trojans and Viruses that completely bork the whole system restore process rendering it useless. So it was time for WHS to earn its keep. I booted from the WHS restore CD, and followed the restore wizard. My network controller and HD's were automatically identified by the WHS restore CD (Nforce4), however there are options to load the correct device drives if your devices are not automatically listed. See the more detailed description below. It was simply a case of selecting the backup from a couple of days ago, and then selecting the HD partition that I wanted to restore the backup to. 16 minutes later WHS told me the restore had completed successfully and to click Finish to reboot the computer. Its that simple and its worked flawlessly. I clicked finish and the PC rebooted and loaded WinXP Pro, once at desktop I had an uninfected PC and everything worked perfectly.

At this point I would like to declare my love for Microsoft Windows Home Server. It did exactly what it said on the tin and saved me going the much longer and more complicated route of manually fixing the problem. WHS is a total catch net for any MALWARE, TROJENS or any kind of VIRUS. It saved my bacon in 16 minutes flat.

See the full process below. This includes the additional steps if you are restoring to a new HD. If you are restoring to an existing partition, simply skip these steps.

How to restore a PC from a WHS backup after a hard drive fails

Have you ever had a hard drive fail in your computer? Most of the time, we’re stuck rebuilding the PC from scratch. Not only does this take hours and hours of our valuable time, the computer never “looks” like it did before. All of our Desktop icons, IE Favorites and other settings are lost forever.

With a good backup of our PC via Windows Home Server, we can now easily restore our PC back the way it was originally.

The first step is to remove the old hard drive and replace it with a new one. If you are not comfortable doing this yourself then be sure to ask for help. Most retail chain stores will install it for you (for a price). Just have them skip reinstalling the operating system; you can do that yourself.

After the new hard drive has been installed, you’re ready to go!

Note: if you want to restore from a backup on your current drive (after a virus outbreak, for example), then be sure to adjust the boot order so that the computer boots off of the CD-ROM instead of the hard drive. If you don’t change the boot order, the computer will continue to boot to the hard drive and you will not be prompted to boot from the Restore CD. You do not need to adjust the BIOS if you are installing a new hard drive.

Important: Restoring a PC from scratch requires hard drive and network drivers. These can be easily found on the Windows Home Server. Follow article “How to restore PC drivers”

Adjust BIOS

Find the Restore CD that came with your Windows Home Server and insert it into the CD-ROM drive. Start your computer.

Note: If you can’t find the original Restore CD, don’t panic. Microsoft provided an easy way to recreate it. Put a blank CD into your CD burner drive. Navigate to your Windows Home Server from the network (\\server1\Software\Home PC Restore CD) . Double-click on the restorecd.iso file a burn a new disk.

After you turn on your PC, you should be prompted to “press any key to Boot from CD or DVD”. You will soon be presented with a dialog box giving you a status of the boot process.

Wait for the setup routine to find all of your hardware

Choose your language and keyboard layout, then click “Continue” when prompted.

The WHS Restore CD will try to find your hard drive(s) and a network connection.

If there is a “zero” next to “Network devices”, or “Storage devices”, you must add the appropriate drivers. Because the backup is stored on the WHS server, you must have network connectivity.

Click “Show Details” to see what the Restore CD was able to find.

Click “Install Drivers”

Insert the USB (or floppy) drive that contains the drivers for your PC. If you don’t have these handy, follow article “How to restore PC drivers”.

If you have the correct drivers, then you will be notified. This is an important step that cannot be skipped.

Notice that the Restore Client has found and installed the network drivers for the AMD PCNet Adapter device. It is now safe to click “Continue”.

Once you have drivers for the network and the local hard drives, you are ready to continue with the restoration processes. Click Next to continue:

Enter in the WHS password. This is the password that you use to connect to the WHS Console (remember, this password is very powerful and should only be given out to members of your family that you trust to manage your Windows Home Server)

If you have more than one computer that is backed up to the Windows Home Server, then be sure to choose the correct computer that you want to restore.

When choosing a backup to restore, be sure to either choose the most recent, or the one that was taken before the issue (ie: before the virus outbreak).

If you are restoring to a brand new hard drive, then you will have a few extra steps. You will know this if you are presented with the following message:

Don’t panic; setting up the new drive is very easy.

Click on the OK button in the a “Restore Wizard” dialog box above.

Then click on “Run Disk Manager (Advanced)…”

The Initialize Disk box will come up. In most cases you can leave the defaults. Click OK.

Right click on the new disk (many times this will be “Disk 0”). The new disk will be labeled as “Unallocated”. Choose “New Simple Volume.

The Wizard will step you through creating a new partition.

Important: This action will delete everything on this disk. If this is a new disk from the store, then that is OK. But be sure you are looking at the correct disk.

Choose a size for the new disk. In most cases it is OK to choose the default and use the entire disk.

Most computers boot from the C drive. If you are not sure, leave the defaults.

Today’s hard drives are rather large. To speed up the format time, be sure to click “Performa a quick format”.

The computer will take a few seconds (or minutes if you choose not to perform a quick format) to format the disk. When it is complete you should see the drive change from “Unallocated” to “Healthy (Primary Partition).

You can now close the Disk Management window by click on the X in the upper right-hand corner.

That’s it! The drive is now ready for you to restore your backup. Click “Next”

Notice that the Restore Wizard is warning you that you are about to overwrite all of the data on your hard drive. If this is a new drive, then this is what you want. If you are restoring over an existing hard drive, note that restoring from a backup will destroy all of the data on the drive.

The backup functionality of Windows Home Server is extremely powerful. Not only does it backup the files on our computer, it provides an easy way to restore a complete PC.