NTRecover User's Guide Winternals Software LP 3101 Bee Caves Road, Suite 150 Austin, Texas 78746 (512) 330-9130 (512) 330-9131 Fax www.winternals.com Copyright © 2002 Winternals Software LP NTRecover Table of Contents 1 2 3 4 Introduction................................................................................... 1 Overview of Use............................................................................ 2 Establishing Communications Parameters................................ 3 Creating a Client Boot Floppy ..................................................... 4 4.1 4.2 Using a MS-DOS Boot Floppy........................................................4 Creating a Native NTRecover Boot Floppy.....................................5 5 6 Establishing a Communications Link......................................... 6 Using NT Recover: Host .............................................................. 7 6.1 6.2 The Connection Dialog...................................................................7 The Statistics Dialog ......................................................................8 7 Using NT Recover: Client .......................................................... 11 7.1 7.2 7.3 7.4 Starting the Client ........................................................................11 The Connection Screen ...............................................................12 The Statistics Screen ...................................................................14 Connecting to Another Client .......................................................15 8 Troubleshooting ......................................................................... 16 8.1 8.2 Frequently Asked Questions ........................................................16 Checklist for Common Problems..................................................18 9 Technical Support ...................................................................... 19 Winternals Software LP Page i NTRecover 1 Introduction NTRecover is an advanced Windows NT/2000© dead-system recovery utility. Windows NT/2000 machines that fail to boot because of data corruption, improperly installed software or hardware, or faulty configuration, can be accessed and recovered using standard administrative tools, such as CHKDSK, with NTRecover. NTRecover consists of host and client software, where the host software is run on a functioning Windows NT or Windows 2000 system, and the client software is executed on a target dead system. The host and client machines must be connected with a standard null-modem serial cable. The NTRecover host software creates virtual disk drives on the host machine that represent the drives present on the client computer. When native file systems, such as NTFS and FAT, access the drives, the NTRecover device driver manages communications over the serial cable to the client software to transfer disk data back and forth between the two machines. As far as Windows NT/2000 on the host machine is concerned, the drives created by NTRecover are indistinguishable from the local drives present on the host, and so they can be manipulated with Windows NT/2000 disk utilities, including high-level tools like the Windows NT Explorer, and low-level tools such as CHKDSK. When used in conjunction with Locksmith, NTRecover allows you to bypass the security system and replace lost or forgotten administrative passwords. Winternals Software LP Page 1 NTRecover 2 Overview of Use The following steps are required for NTRecover operation. Each is described in detail in subsequent chapters of this guide: = Connect the host and client machines with a null-modem serial cable = Identify the serial ports that are connected = Run the NTRecover host software, NTRecover, on the host computer = Create a client boot floppy = Boot the client machine from the boot floppy and execute the client software = Enter the communications parameters into the host and the client software = Press the mount button on the host = Pull down the drives menu in the host software to see which host drives correspond to client drives = Access the drives as you would standard drives = Dismount the client drives Winternals Software LP Page 2 NTRecover 3 Establishing Communications Parameters The first step in using NTRecover is determining which serial ports on the host and client machines are to be connected via the null-modem serial cable. This involves picking a free serial port connection on each computer, and ascertaining whether it is serial port 1, 2, 3, or 4. Refer to your computer's hardware reference manual for help in this determination. Once the serial ports have been chosen and connected, you must decide on the serial communications speed that NTRecover will use over the cable. Most recent computers and serial cables can sustain rates of 115200 baud, which is the maximum supported rate for NTRecover. If the rate you choose is too high, the NTRecover client will indicate a high number of retry operations, or not register any communications activity from the host. In these cases dismount the drives and reconnect at a lower rate. After the communications parameters have been established and the two computers in question have been connected with the cable, you are ready to run NTRECOVER.EXE, the host front-end. Its connection window must be filled in with the chosen communications settings, and, if desired, a drive letter preference which NTRecover will try to use as the first drive letter in its mapping of client drives on the host. Winternals Software LP Page 3 NTRecover 4 Creating a Client Boot Floppy NTRecover client operation requires that you make a client boot disk for the client computer. This is accomplished through the NTRecover connection dialog [figure 4-1], which is the first window presented whenever NTRecover is executed on the host machine. Figure 4-1 4.1 Using a MS-DOS Boot Floppy MS-DOS-based boot disks are required when the client machine's disks are not accessible via standard or extended interrupt 13 BIOS service, such as when the drives are non-IDE compatible SCSI. Such drives require special MS-DOS-based drivers, which must be added to a MS-DOS boot floppy that will also contain the NTRecover client program. For these systems, you must first create a MS-DOS system boot floppy from stand-alone MS-DOS (any version), Windows 3.1, or Windows 95. (MS-DOS boot floppies cannot be created from Windows NT.) To format a system MSDOS boot floppy, use the command "format /s". The boot floppy should then be populated with the required disk drivers. NTRecover can be directed to copy the client onto the floppy via the "Create Boot Floppy" dialog. [Figure 42]. Winternals Software LP Page 4 NTRecover To execute the client from this setup, you must boot the client computer from the MS-DOS disk, ensuring that the drivers are appropriately installed (via entries in the disk's CONFIG.SYS or AUTOEXEC.BAT files), and then invoke the client with the command, "client". Note that in some cases the client computer's BIOS may have floppy-boot capability disabled, so you may have to configure the client's BIOS to allow for booting from the floppy drive. Figure 4-2 4.2 Creating a Native NTRecover Boot Floppy Native NTRecover boot floppies should be created in cases where no special DOS drivers are needed to access client drives. Choosing the selection that directs NTRecover to create a native boot floppy has it copy boot code and the client software onto a floppy disk. The floppy must be pre-formatted, but any data on it will be lost. When a client machine is booted off of a native NTRecover floppy, the client is automatically executed. Winternals Software LP Page 5 NTRecover 5 Establishing a Communications Link A communications link can be established between the host and the client after the following: = Serial ports through which the connection will be made on the host and client have been selected and identified = A communications baud rate has been chosen = The host and client have been connected with a null-modem serial cable = The communications parameters have been entered into the connection dialog on the host, and the client software on the client machine A connection is initiated via the mount button on the host connection dialog. The host will notify you when a link has been made and both the host and the client will begin displaying communications statistics. Drive letters that have been mapped on the host for the client drives are identified in the statistics window on the host, and selecting one will display communications statistics for the particular drive. After a successful connection, you will be able to access the mapped client drives as you would local or network drives on the host, through the Explorer, from the command line prompt, and from other applications. Further, you can run low-level disk utilities, namely CHKDSK, on the drives. Winternals Software LP Page 6 NTRecover 6 Using NT Recover: Host 6.1 The Connection Dialog The connection dialog [Figure 6-1] is the first window presented when the host software, NTRecover, is executed. This dialog is used to create the client boot disk, specify host communications parameters, and establish a connection. Figure 6-1 6.1.1 Drive Letter This is an optional entry that is used to indicate which drive letter NTRecover should begin with when it assigns drive letters to client drives it maps onto the host. Drive letters are selected by starting with the one specified and scanning for available letters. If there are not enough unused letters following the starting letter to map all client drives, unmapped client drives will not be accessible from the host. 6.1.2 The Comm Port logical serial communications port NTRecover will use for communications on the host is selected with this pull-down menu. It is extremely important to note that the port chosen represents a Windows NT/2000 logical port, rather than a physical port. Logical ports are mapped onto physical ports using the serial port Setup applet in the control panel. Winternals Software LP Page 7 NTRecover Refer to your computer's hardware manual for the correspondence between I/O port numbers that are used by the applet, and serial connections on the back of the computer. 6.1.3 Baud Rate Specify the communications rate that is to be used between the host and the client. Most computers can support the maximum serial rate of 115200 baud, but this is dependent on variables such as the quality of the serial cable, the speed of the host computer, and the type of serial controllers present on the two computers. If the client software displays a high number of retry operations (several dozen over a few seconds), or if no communications is established when a connection is attempted, you will need to lower the baud rate the next time you connect. 6.1.4 Read-Only This check box is present in the write-capable version of NTRecover. Checking it results in a read-only mount of client drives, which is useful if you want to ensure that the client drives are not changed in any way during an NTRecover session. 6.1.5 Mount After communications parameters have been entered, use the mount button to make a connection between the host and the client. It is recommended that you start the client before you direct NTRecover to attempt a mount, but it is not necessary. If an error is reported, see the troubleshooting section. 6.2 The Statistics Dialog Once a connection has been established, NTRecover will present a statistics window [Figure 6-2] that allows you to monitor NTRecover communications activity with cumulative statistics on all mapped client drives, or on a Winternals Software LP Page 8 NTRecover particular client drive. Use the drives pull-down list to choose which drive to watch, with `*' representing all the drives. The menu can also be used to see which of the host drive letters map client drives. Figure 6-2 The statistics presented include the total number of reads and writes, as well as the number of bytes read or written. For your reference, the serial port and baud rate of the connection are also displayed. Additional NTRecover boot floppies can be created from this dialog as well. 6.2.1 Activity Light The light above the buttons functions like a standard hard disk activity light, becoming lit when the client drive is being accessed. If the client drives are mounted for read/write access, the drive light will be green during disk accesses. If the drives are mounted for read-only access, the light will be yellow. The activity light is present so that you can monitor client disk traffic. Exiting the statistics dialog causes it to become inactive, but it can be recalled at any time by clicking on the NTRecover icon in the task bar. If you are using NT 3.5, click on the icon title to reactivate the window. Winternals Software LP Page 9 NTRecover 6.2.2 Unmount The only button uni ...