The advanced system-recover toolkit

[Tracey Capen]

TOP STORY The advanced system-recover toolkit By Susan Bradley You probably know and use various real-time antivirus tools, but there are also advanced security tools that work under the operating system. Many of these are based on Linux and help scan, fix, or even reset Windows passwords. The full text of this column is posted at WindowsSecrets.com/top-story/the-advanced-system-recover-toolkit/ (opens in a new window/tab). Columnists typically cannot reply to comments here, but do incorporate the best tips into future columns.

[sbaeder]

While it is always nice to remind the readers that there are these sorts of options, I feel you left out a very important segment - and that is the use of a Windows PE based Boot Disk. There is an entire site / tool devoted to this sort of thing at http://reboot.pro - specifically the WinBuilder tool. And while the whole BartPE environment is based on XP, and so a bit "long in the tooth", it can be valuable as well.

So, while I applaud this attempt to remind folks that they need to "be prepared" to boot their machines off external media (CD/DVD/Flash), this barely scratched the surface. More pointers to more things would be welcome.

[eikelein]

Re: MS Standalone System Sweeper:
What you download from the link in the article is only sort of a downloader/creator stub program, in both cases (32/64bit versions) just 576KB small.
The actual download of about 210MB is done when you run this stub program.
If you choose to create an .iso file it will be created as
C:\ProgramData\Microsoft\Microsoft Standalone System Sweeper Tool\MSSS_Media**.iso
where ** is 32 or 64 depending on which version you created.

Didn't seem very obvious to me...

[JMac001]

Two problems with the email newsletter received today: 1) The link for discussion of the Patch Watch column brings me to the last thread, the Office File Validation thread, instead of this one. 2) Now you have really, really confused me wrt KB 2552343 ... in the latest published chart, in today's email newsletter, it is listed twice: first as a "Wait" and then as "Install". I think I will just leave that one off my PC!

Jim

[acbeaton]

I followed the instructions and created a bootable USB drive containing Microsoft Standalone System Sweeper. After booting from the USB drive I got the following error message:

"Microsoft Standalone System Sweeper cannot be started. Please contact support.

Error Code: 0x8004cc05"

No thank you. Life is too short.

[bobprimak]

I followed the instructions and created a bootable USB drive containing Microsoft Standalone System Sweeper. After booting from the USB drive I got the following error message:

"Microsoft Standalone System Sweeper cannot be started. Please contact support.

Error Code: 0x8004cc05"

No thank you. Life is too short.

Re: MS Standalone System Sweeper:
What you download from the link in the article is only sort of a downloader/creator stub program, in both cases (32/64bit versions) just 576KB small.
The actual download of about 210MB is done when you run this stub program.
If you choose to create an .iso file it will be created as
C:\ProgramData\Microsoft\Microsoft Standalone System Sweeper Tool\MSSS_Media**.iso
where ** is 32 or 64 depending on which version you created.

Didn't seem very obvious to me...

There is a further complication with creating the System Sweeper stand-alone CD. You must create the disk on the same Windows Version (XP, Vista, Win7, Pro vs. Home vs. Business, and any Service Packs, including 32 bit vs. 64 bit) as the computer(s) where the System Sweeper CD is to be run. I found that out the hard way. Downloading the 32-bit ISO image onto my Toshiba Satellite (64-bit windows 7 Home Premium, Service Pack 0 at the time) and burning the CD resulted in a CD which could not scan nor connect to the Internet, nor use downloaded definitions updates from a USB Flash Drive on my WinBook laptop (32-bit Windows XP Professional, Service Pack 3). This is not mentioned in the Microsoft instructions for downloading System Sweeper and creating the CD. Since the actual CD creation process may take hours due to the massive (210 MB) download size (for the ISO version), this means a lot of wasted time, including an hour or two of tests to determine what went wrong. It wasn't until a senior member of one of the computer clubs which I attend pointed out what needs to be done, that I realized what had probably gone wrong. I haven't taken the time yet to re-do the System Sweeper ISO download on the WinBook and see what that process produces.

The Error Codes referenced by acbeaton are symptoms of the condition where the CD was burned on an incompatible Windows version, although other errors in the CD creation process can produce similar error codes.

Other System Rescue stand-alone CDs I have tried have not had this issue, except for BART PE and WIN PE. I don't know details of the System Sweeper boot environment, but if it is anything like WIN PE, the CD creation process involves picking up some system files from the computer which is creating the CD, and this is one reason for the long run times for creating the CD. Again, I do not know whether this scenario applies to System Sweeper.

[SusanBradley]

I didn't find that to be true. I built it on a 64bit win7 and scanned a 32bit Vista.

[acbeaton]

bobprimak says "The Error Codes referenced by acbeaton are symptoms of the condition where the CD was burned on an incompatible Windows version, although other errors in the CD creation process can produce similar error codes."

For the record my bootable USB drive was created on the same machine as I used to test it. (Win7 64-bit).

[wmccommis]

Hopefully this note will be posted in the correct place - this is my first attempt at this...

It is probably intuitively obvious to others on this forum, but I will ask anyway.

I attempted to build a Kaspersky Rescue Disk on a USB thumb drive as described at the Kaspersky website. All went well until I attempted the "Start Update" function after booting the thumb drive - I received a "502 - Bad Gateway" error. My internet connection is fine. Is there some type of configuration details that must be addressed that I've not done ? At a more basic level, must I purchase a Kaspersky package to be able to make use of the Kaspersky Rescue Disk ? Thanks for your help.

[Deadeye81]

Hello wmccommis, and welcome to the Lounge!

Take a look at this How To Geek tutorial on creating the Kaspersky Rescue Disk. Their tutorial shows the steps in burning a CD based Rescue Disk. I know you want the USB thumb drive setup, but try this to see if you get the same error message. And you do not have to purchase a Kaspersky package to make use of the Kaspersky Rescue Disk.

[Anabaptiston]

RE: Kaspersky rescue disk. I found the CD worthless. I followed the instructions to the letter to create the CD (twice, in fact), but it's still worthless.

When the scan reaches about 16% the screen goes black. A keystroke restores the screen but the scan has stopped. On odd occasions the utility asked if I wanted to resume, but usually I have to start over. Neither the OS, the hardware, nor the video driver (semi-wild assumption because of black screen) make a difference. To wit, the same thing happens on an older Gateway with Win7 Ultimate/ATI video, a Dell Optiplex with Vista Enterprise/nVidia video, a Dell Inspiron with Vista Home Premium/nVidia, and a Dell Inspiron with Win7 Home Prem/ATI (all 32-bit).

I'm not going to waste time trying it on a 64-bit Win7 laptop. As far as I'm concerned it's just another coaster.

[Deadeye81]

RE: Kaspersky rescue disk. I found the CD worthless. I followed the instructions to the letter to create the CD (twice, in fact), but it's still worthless.

Check post#10. I followed the How To Geek tutorial and had no problems with it working in Windows 7, Vista, or XP.

[bobprimak]

I didn't find that to be true. I built it on a 64bit win7 and scanned a 32bit Vista.

Then I can lay that rumor to rest. Always blame the user when it is in fact the computer which is not working properly. Well, in any event, my WinBook 32-bit Windows XP Pro SP3 could not run nor update the System Sweeper program off the CD burned on my Toshiba Satellite 64-bit Windows 7 Home Premium laptop. It was a burn from the 32-bit ISO download. Definitions were downloaded onto a USB flash drive, since networking could not be activated on the WinBook. Those defitinitons would not install when running the CD burned on the Satellite.

No other Rescue CD from any other vendor burned on my Satellite has ever failed to work properly on my WinBook. Except that no stand-alone CD program has yet succeeded in reaching the Internet without being able to boot into Windows XP on that laptop. These Rescue CDs simply do not have Networking drivers which work for my WinBook laptop.

This System Sweeper program seems based on my experiences, to be very much hit or miss. It does not run properly on all computers.

[bobprimak]

bobprimak says "The Error Codes referenced by acbeaton are symptoms of the condition where the CD was burned on an incompatible Windows version, although other errors in the CD creation process can produce similar error codes."

For the record my bootable USB drive was created on the same machine as I used to test it. (Win7 64-bit).

Susan's reply to my earlier post seems to back your side of the story. It is not true that the problems I encountered resulted from the issue which was (falsely) told to me by my trusted colleague at the computer club. He evidently did not know what he was talking about. That for him is a rarity.

[RONT38]

Reading about "The advanced system-recover toolkit" by Susan Bradley, it gives me some hope that someone may know what is required for a "forensic" data recovery system.
I have two HDD's from my desktop with data I cannot recover due to an self inflicted error by shutting down the system during a "safe mode" recovery. As mentioned before in a thread on this forum, the Vista OS never booted again. I tried the recovery via USB transfer cables to my laptop, to no avail. In the mean time I changed the drive letters to
"G" and "H" because my laptop didn't recognize anther "C" drive. Now my USB set- up ask me to reformat.
I found out that I did have a "Raid" setup in my desktop which required that both HDD's must be connected (in tandem) to my laptop for the data recovery for which I had no proper cabling to do so.
People tell me, it'll coat $1200-$1500 + to have my data recovered. Is there a way to purchase whatever needed to do this myself, but more economical ?

Thanks,

ront