30 August 2005

When it all comes together...

Every once in a while, one has a case that illustrates the value of changes in default practice that one's made over the years. Here's one...

A system came in because Eudora had "lost all the mail".

Indeed; the entire "My Documents" object had been punched out; not in Recycle Bin either. Score is Murphy 1, Chris 0 so far.

Fortunately, this data set was on FATxx not NTFS, so the trail did not end there - I could go in with UnErase and DiskEdit to attempt recovery. So now the score is Murphy 1, Chris 1.

Normally, deleted data would be safer from overwrite than you'd expect, because I relocate data off C: (thus avoiding incessant temp, TIF, swap writes). Murphy 1, Chris 2. Plus I disable SR on D:, given that there's no core code there anyway, so that should avoid that source of spontaneous writes to (what could be at any time) at-risk disk. Murphy 1, Chris 3.

But this system had re-duhfaulted to turning on SR (with maximum disk use, of course) for all volumes, probably as a side-effect of disabling and re-enabling SR as a means of clearing it. So when I went in with my tools, I found the data set not only deleted, but also overwritten. Murphy 2, Chris 3.

Fortunately, the user had left the PC running one night a week, which meant my overnight auto-backup Task ran once a week. So I could go F:\BACKUP and choose the latest of the last 5 of such backups, and thus recover all data, even though the user has never explicitly initiated a backup in years. If the PC was running every night, perhaps they'd lose 1 instead of 7 days work, but even so, it's quite a win; Murphy 2, Chris 4.

Plus they are using Eudora for email, which separates it into malware-safe messages in mailboxes, and malware-risky attachments that can be stored somewhere else. Eudora doesn't run scripts in messages, and can be prevented from using IE's code to interpret them, so the messages really are malware-safe. So any data backup on a system I set up will automatically include the email stores; Murphy 2, Chris 5.

However, to restore this data, I'd have to overwrite whatever deleted data hadn't been destroyed already - Murphy 3, Chris 5. The client wants the PC back RSN, so what do I do; take an extra day searching raw disk for loose data, or restore their backup and close that door forever?

Fortunately, I can have my cake and eat it, because the volume I store data on is a tiny FAT16, 2G in size. So I can simply peel off the entire volume as 4 CDR-sized slabs of raw sectors, paste that onto another HD somewhere, and carry on doing deep recovery while the PC's back in the field and working on the data I restored. Murphy 3, Chris 6.

Security is not the only thing that is "a process"; the same could be said for working around dumb-ass vendor duhzign and duhfaults - and Murphy wins whenever the vendor's code discards rather than respects your choice of settings!

2 comments:

Anonymous said...

One good resource for digital photo software and many more free software alternatives is Software4YourSuccess.com
Yes it is my site and I would love for you to drop by for a second. From there you will have free access to several of my products such as The Marketing Toolbar (which is goldmine of information on how to do things quickly and on the cheap, thus saving you time and money).
Also for webmasters I have created Webmaster Wizards, which will help you with almost every aspect of putting code on your site from things such as legal and privacy disclaimers to popunders. I have so much content and free software there I could fill up this whole blog, so check it out Thanks, Sincerely Rob Rudd

Chris Quirke said...

This looks like the first spambot of winter; generic feel-good comment about my site, followed by a bit of hooray-for-us tub-thumping.

OTOH, if "Rob Rudd" really is a human, my apologies - but I have to tell ya, you write like a spambot :-)

"Rob"'s site shows a fair sprinkling of the technologies I spend my time trying to counter, such as pop-unders and other intrusive commercial web shenanigans. I doubt if we are destined to become best friends, heh heh...