World of Education

home *** CD-ROM | disk | FTP | other *** search

/ World of Education / World of Education.iso / world_d / drfinfo.zip / DRFPAPER.ASC < prev next >

Wrap

Text File | 1993-04-28 | 84KB | 1,848 lines

THE DISASTER RECOVERY DISKETTE MAKING THE MAGIC FLOPPY Copyright (c) March 1993 All Rights Reserved By Mike Lambert Before Disaster Strikes 1153 Dublin Place, Herndon, VA 22070 Voice 703-834-3707 Fax 703-471-6214 THE DISASTER RECOVERY DISKETTE -- MAKING THE MAGIC FLOPPY ABSTRACT There are a number of things that can happen that will deny you the full access to your computer or data. These range from errant programming, to malicious code, and operator accidents. Under- standing that this is an inevitable problem if you use a computer long enough, the prudent individual plans ahead. The first line of defense is the Disaster Recovery Diskette(s). This paper provides guidelines on minimums that should be on Disaster Recov- ery Disks, what the programs and data are used for, an example constructing the disks, and examples of their use. Copyright 1993 (c) Mike Lambert All Rights Reserved THE DISASTER RECOVERY DISKETTE -- MAKING THE MAGIC FLOPPY 1. INTRODUCTION Have you ever heard of someone that couldn't boot their hard disk? Someone who had an MBR virus infection, or perhaps someone whose CMOS battery died? Well, if you use a computer long enough, something, sometime, will occur that will require some "outside intervention" on your part. This is where the Disaster Recovery Disk comes in, its the "magic floppy" that gets you up and using your computer again. If you have a virus, these disks are necessary to get rid of it. If you lose your CMOS settings, they can be restored. Software to restore from backup copies is easily accessible when on the Disaster Recovery Disk. And for the more advanced, all the soft- ware necessary to start from scratch is included on the Disaster Recovery Disks. This paper is an example of a "basic toolkit". Each computer installation and the way in which the computer is used, will dictate what is in the toolkit. From these basics the computer user is encouraged to expand it until it is of the best use for them. 1.1 Tone and Audience The audience for this discussion is the computer user that can use basic DOS commands, wants to learn more, and is interested in protecting their computing environment. Common terms such as FAT, are not defined. Terms that are introduced in this document or are outside of the scope of the normal computer user are defined. All of the information necessary for the novice user to use this paper to construct Disaster Recovery Disks is contained in their DOS User's Guide that comes with their computer. If you have not read the chapters that provide the basic computing background, file concepts, and common DOS commands; it is in your best inter- est to do so. The tone is conversational rather than technical. A rigid struc- ture is not enforced so that concept and implementation can be brought together in a more cohesive manner. The background provided is intentionally general and not meant to be technically accurate to the point of technical criticism. Copyright 1993 (c) Mike Lambert All Rights Reserved Page 1 of 28 THE DISASTER RECOVERY DISKETTE -- MAKING THE MAGIC FLOPPY 2. DEFINITIONS BIOS Basic Input/Output System -------------------------------- Commonly used to refer to the low level services including those that initialize and configure the computer at startup. These routines are normally stored in Read Only Memory (ROM) and are often referred to as ROM. CMOS Complementary Metal-Oxide Semiconductor ---------------------------------------------- Commonly used to refer to that battery powered memory that is used to store a computer's configuration information for use by the BIOS at startup. DISASTER RECOVERY FLOPPY DISK (DRF) ----------------------------------- A floppy disk or set of disks prepared to provide the necessary tools and data to recover from the vast majority of hard disk problems a computer user is likely to encounter. DISASTER RECOVERY PLAN (DRP) ---------------------------- A plan by which all possible computer related losses can be recovered from in the timeframe established based on the accepted risk. LOW LEVEL FORMAT (LLF) ---------------------- The process of preparing a disk to hold data. All data on a disk is stored in sectors. Low Level Formatting constructs the sector that will hold the data. This is NOT what the DOS FORMAT command does on hard disks. Low Level Format software is normally in the disk controller ROM, in the BIOS ROM, provided by the manufacturer, or procured from a third party specializing in software of this type. This process is normally only required when sectors can no longer be read by the drive for some reason. NONBOOTABLE vs UNBOOTABLE ------------------------- A NONbootable disk is a disk that has not been made bootable by installing system files on it (SYS or FORMAT /S). An UNbootable disk is a disk that was once made bootable and is no longer so. 3. THE PROBLEMS YOU CAN ENCOUNTER The problems you can encounter revolve around the modification or loss of the important system data and structures that are neces- Copyright 1993 (c) Mike Lambert All Rights Reserved Page 2 of 28 THE DISASTER RECOVERY DISKETTE -- MAKING THE MAGIC FLOPPY sary to "bring up" your computer system when you turn it on. Some of these important data are outside of the normal concepts of "backing up your data". Many might backup some or all of this important data unknowingly, such as with MIRROR, but in many cases it is backed up on the hard disk that you can't boot! In some cases the data is backed up but cannot be restored. 3.1 CMOS Data One of the things that has to be done when constructing a comput- er system is to define the configuration. This is taken care of by the system integrator that assembled your system. Configura- tion items are hard disk type, memory size, video type, floppy drive configuration, and with the newer 386 and 486 computers, a myriad of additional setting ranging from wait states to shadow memory options. In the days of the PC and XT, this configuration was very simple and was accomplished by setting switches on one or two switch blocks located on the motherboard. With the 286 and above computers, the configuration settings are stored in "CMOS memory". In simple terms, this is special memory that holds the settings and is powered all the time by a small battery normally mounted on the motherboard. How important is this configuration information? Well, without it you certainly won't be able to use the computer. While your system can operate with only the default settings in some cases, if your hard disk definition is not present, you won't be able to use the hard drive. If you "lose" some of the advanced options, you may only notice that your system is not performing as well. Your hard disk definition is certainly the most important of the settings saved in CMOS. If it is "lost", you will have to provide it before you will be able to use the hard disk. A while back things were a little simpler in that you only had to write down or remember the disk type. When this is provided, the BIOS looks up the type in a table and provides the necessary configuration data. But, who knows what their disk type is? Only those who have looked. Now that many systems are using the new IDE disks, we find that the none of the normal disk types fit and you will have to enter each of the configuration parameters. Lots of numbers there to remember! At a minimum, I suggest you look at your disk parameters and write them inside the cover of your disk drive or motherboard manual. The information is on the "Standard CMOS Setup" page of the BIOS configuration utility. You get to the CMOS Setup by running your SETUP program or pressing the proper key(s) during system startup when the BIOS prompts you. Here is the information on my IDE hard disk: Type Cyln Head WPcom LZone Sect Size -------------- ---- ---- ----- ----- ---- ----- Hard disk C: 47 = User Type 960 7 0 960 35 115Mb Hard disk D: none Copyright 1993 (c) Mike Lambert All Rights Reserved Page 3 of 28 THE DISASTER RECOVERY DISKETTE -- MAKING THE MAGIC FLOPPY Type 47 is a "blank type", you will have to provide the other parameters (except Size). There is an easy way to "remember" all this CMOS information that will not require you to be an authori- ty on configuration, or even know how to make the settings "by hand" using the BIOS Setup program. The answer is to use a pro- gram to read the CMOS settings and save them to a file. A compan- ion program can be used to put the settings back in CMOS. All of this can even happen automatically! How can these settings be lost? You or another can "tinker" with the BIOS program that sets the settings, a program could modify "this setting" instead of "that setting" because of a bug in the program, a virus could modify them, or the battery could just plain die! In some cases, it may be necessary to reset the CMOS settings to the default settings; but the default settings do not include your disk parameters. You will have to provide them. 3.2 Master Boot Record The single most important sector on your hard disk is the Master Boot Record. It occupies the first sector on the hard disk and without it, at best, you could not use the hard disk, at worst, if corrupted, you would not be able to boot the computer in any manner until the hard disk is removed. This sector is constructed when the hard disk is partitioned by the system integrator that assembled your computer system. It is normally totally forgotten from that time forward. The MBR is not protected in any way and can be easily modified or destroyed. It is normally not backed up, and if it is backed up, its on the hard disk that would require it, or when its really needed, it can't be restored! The MBR is a favorite target of viruses. Some virus names you'll be familiar with are Michelange- lo, Stoned, and Joshi. All of these viruses modify the MBR and the way to "disinfect" your computer is to replace the virus with the real MBR. If you have a backup copy, you merely restore it; no more wondering if the "disinfection" program really works... 3.3 Extended Partition Boot Records (EPBR) If you have an Extended Partition on your hard disk, the Extended Partition Boot Record is the sector that is necessary for DOS to find the logical drives in the Extended Partition. Without it/them, no logical drives. The EPBR(s) is(are) not protected in any way and normally not backed up. If it is lost or corrupted all logical drives it controls are lost. For instance, if you have C: and two logical drives in the Extended Partition (D: and E:), if the EPBR for E: is lost, you lose logical drive E:. If the EPBR for D: is lost, you lose both D: and E:. Copyright 1993 (c) Mike Lambert All Rights Reserved Page 4 of 28 THE DISASTER RECOVERY DISKETTE -- MAKING THE MAGIC FLOPPY 3.4 Your Data and Programs For some reason, any reason, you could lose all or part of your data and programs. In fact, the entire file structure of a parti- tion could be lost. In this case, your hard disk could be no longer bootable. You will need all of the basic tools to estab- lish another file system and recover your data from your backups. (Accidentally deleting a file and recovering it with UNDELETE is not what is addressed here.) Some people attempt to solve this by backing up the FAT and directory structures. This sort of backup would have to be writ- ten to a different volume or floppy disk. The serviceable life span of such a backup is extremely short for a system with any kind of disk activity. The expertise to recover using the backups without causing more damage is considerable and the job is more time consuming the older the backup is. I do not recommend this method, rather current backups and a reasonable Disaster Recovery Plan. Disaster Recovery Planning is not covered in this document. It is relatively complex and based on the user requirements. To get an idea, consider you use your computer at home for a part time business. You and your mate return home after an evening out and find that the room your computer is in has been destroyed by water from the upstairs apartment, a fire, or some other problem. Or, what about your hard disk not working the next time you turn the computer on. The information on the computer is very impor- tant and is no longer available. What do you do now? How long can you afford to not have access to your important information? Do you even have a backup copy? Can you put the backed up data and programs back on the computer? Just imagine....now construct a plan so that whether you live in San Francisco, or Homestead, Fla, or work in the World Trade Center, or Smalltown, USA on the Tornado paths; you'll be able to get your computer back up and running with the data you need without having to redo the last six months of work. The Disaster Recovery Disk(s) provide the tools, you must decide how the backup copies are provided and how you will go about getting "back to normal". 3.5 Your Hard Disk and Low Level Format (LLF) This is not something that needs to be done very often, but if you need to, this kind of recovery will exercise almost all of your Disaster Recovery Disks. I have heard that this is touted to be the "cure" for the MBR virus. Really!?! We will see that the cure for the MBR virus is in section 5.1.2 below. It will take us a couple of minutes to recover! But here is what we're told: Some will tell you that how to recover from an MBR virus is to Low Level Format, create new partitions with FDISK, FORMAT the Copyright 1993 (c) Mike Lambert All Rights Reserved Page 5 of 28 THE DISASTER RECOVERY DISKETTE -- MAKING THE MAGIC FLOPPY new partitions, then recover from backup copies. Even if we have everything at hand and current, this could take hours! Seems to me that the cure is worse than the disease! This approach is akin to demolishing your house and rebuilding it because your faucet leaks. Let's stick with our MBR restore procedure in section 5.1.2 below instead. Of all the threats to your hard disk's LLF, the biggest one is "The User following Bad Advice". There is a lot of Bad Advice out there, know exactly why you are ever doing anything before you do it. The paragraph above illustrates the most common type of Bad Advice you are likely to get. If you need advice, get good advice from an expert, not hearsay from the grapevine. What is the Real Reason to Low Level Format your disk? Simply speaking, if the low level format of the hard disk has faded or the heads do not line up over the track to be read, you may experience read errors. These are the most common reasons for reformatting a hard disk. Of course other things like a head crash (when the head comes in contact with the disk, partially destroying the head of the disk platter) can happen, but refor- matting is seldom the answer to problems like this. The sector format on a disk is made up of bits just as the data is. The data is written or rewritten much more frequently than the one time that the sector format is written. The actual bad blocks on the media are already logged by the manufacturer and you should not be using them anyway. How often does it happen? Frankly, not too often. But if you are having read errors on your hard disk, you are headed for serious trouble. Again, chances are, if you use a computer long enough then you will have to address the issue yourself or pay someone to do it for you. IDE hard drives that provide defect management *may* require the ability to reinitialize that area. The manufacturer would provide this software if it is available. See Appendix B for information on defect management. One other reason to have to LLF your hard disk is if some mali- cious code has damaged your LLF. This is unlikely but who knows what the future will bring? I still haven't, and don't know anyone who has, gotten a straight answer on what would happen to an IDE disk if a virus actually attempts to LLF your IDE drive. PLEASE NOTE: No matter what kind of hard disk you have (but especially IDE drives), you should consult your drive manufactur- er, get the information and/or utilities you need, and the FOLLOW the manufacturer's instructions. See Appendix A for an example of getting this information from the manufacturer. Copyright 1993 (c) Mike Lambert All Rights Reserved Page 6 of 28 THE DISASTER RECOVERY DISKETTE -- MAKING THE MAGIC FLOPPY 4. DISASTER RECOVERY FLOPPY CONSTRUCTION The very first thing you need is something to boot the computer with if it won't boot (normal hard drive boot). Its called a Disaster Recovery Disk because its exactly what you need if you have a disaster! You can't easily make it after a disaster, so we'll plan it and construct it here. I suggest low density disks, 360k for the 5 1/4 and 720k for the 3 1/2 inch disks when possi- ble. Of course, you can use high density disks. The number of disks you will require will vary with your disk type, how many tools you have, etc. The disks below are for illustration pur- poses. This example will require four 360k floppy disks for a 286 with a single 360k floppy disk drive and two 84Mb SCSI hard disks. The backup method is tape, critical new work is backed up to floppy as required during the interval between tape backups. The disk maintenance software was acquired with the hard disk. 4.1 DRF DISK 1 The first disk to be made is a clean copy of DOS with the basic DOS tools on it. Once this disk is made, it will be write pro- tected and the write protect will NEVER be removed. This disk can be easily created if you have an original copy of a full DOS distribution made when the DOS was first installed. I always make a set just after the new operating system is in- stalled and I am still booted from the distribution floppy. To do this, I boot the installation disk, install DOS, and after the installation on the hard disk, I FORMAT, SYS, and COPY all of the files to a set of floppies before I boot the new system on the hard disk (run any of the programs on the hard disk). This way I can always boot one of these original copy floppies and DISKCOPY whatever I need in the way of new, clean DOS disks. If you don't have a clean DOS disk to DISKCOPY, try this. Be careful not to run any program from the hard disk during this procedure except those you extract from the DOS distribution disk. 1. Boot your original DOS disk, EXPAND or COPY the necessary files (see disk directory below) to a new directory on the hard disk. 2. Execute DISKCOPY and copy the original bootable DOS disk to a new floppy. 3. Delete unnecessary files from the new floppy and copy those that you extracted and copied to the hard disk onto the new bootable floppy. Copyright 1993 (c) Mike Lambert All Rights Reserved Page 7 of 28 THE DISASTER RECOVERY DISKETTE -- MAKING THE MAGIC FLOPPY Here is a directory of the disk to make. Volume in drive A is DRF_DISK_1 Volume Serial Number is 054B-1DF2 Directory of A:\ COMMAND COM 47845 04-09-91 5:00a ATTRIB EXE 15796 04-09-91 5:00a CHKDSK EXE 16200 11-11-91 5:00a DEBUG EXE 20634 04-09-91 5:00a DISKCOPY COM 11793 04-09-91 5:00a FDISK EXE 57224 04-09-91 5:00a FORMAT COM 32911 04-09-91 5:00a MEM EXE 39818 04-09-91 5:00a MORE COM 2618 04-09-91 5:00a SYS COM 13440 04-09-91 5:00a UNDELETE EXE 13924 11-11-91 5:00a LABEL EXE 9390 04-09-91 5:00a 12 file(s) 281593 bytes 3072 bytes free Why these programs? 1. The disk is bootable and a clean, original for those virus disinfection tasks. 2. This disk can now be DISKCOPYed again, deleting the unneces- sary files to make new clean bootable DOS disks we'll need for later. LABEL will let us make new labels on the new disks. Remem- ber when making new disks, cold boot the floppy disk, do not run any program on you hard disks, and then DISKCOPY a new disk. 3. ATTRIB might be necessary to change other file attributes. 4. FDISK and FORMAT will allow us to create a new hard disk if we ever have to start from scratch, or formatting new floppy disks. 5. SYS allows us to copy the Boot Sector and system files to the hard disk if they are ever damaged. 6. CHKDSK allows us to repair a damaged file structure if neces- sary. 7. MEM, MORE, DEBUG, and UNDELETE are always handy and since they are on a write protected disk, they would never be damaged if executed on a virus infected system. Put an external disk label on the disk and write on it the disk label name, density (360k), DOS Bootable version X, and any other information you desire. This disk in not computer specific. Copyright 1993 (c) Mike Lambert All Rights Reserved Page 8 of 28 THE DISASTER RECOVERY DISKETTE -- MAKING THE MAGIC FLOPPY 4.2 DRF DISK 2 The second disk will be used to backup critical system data and will contain some of the basic tools we may need in dealing with a problem. Keep in mind that this disk will contain THIS computer specific data, it must be identified as such and not used to restore system data to another computer. Now, DISKCOPY the DRF_DISK_1 disk. Use LABEL to label the disk DRF_DISK_2. Delete all the files except COMMAND.COM on the new copy. This disk is bootable and if we don't infect it with a virus infected tool, it will remain clean. Its always a good idea to have multiple bootable disks in the DRF set. Copy your clean tools to the disk. Save the CMOS and MBR and then write protect the disk. Never run the programs to backup CMOS and the MBR to this disk unless you have booted one of your clean DRF disks. If the tools are virus free and you observe this warning, you will not accidentally infect this disk while it is write enabled. Make sure you write protect the disk after the CMOS and MBR are saved. Here is the directory of DRF_DISK_2. Volume in drive A is DRF_DISK_2 Volume Serial Number is 120B-08D9 Directory of A:\ COMMAND COM 47845 04-09-91 5:00a CMOSCHK COM 856 07-25-92 1:40a CMOSREST COM 785 07-25-92 1:40a CMOSSAVE COM 705 07-25-92 1:40a CMOS 286 128 04-07-93 10:58p GETMBR COM 4362 04-06-93 11:53p PUTMBR COM 3909 04-06-93 10:50p MBREPBR REC 1536 04-07-93 10:58p DISKEDIT EXE 135017 06-06-91 6:00a DM COM 36272 03-03-93 5:09p VDE COM 39502 10-25-89 10:40p COMPARE COM 2454 06-14-88 12:00a D COM 4618 02-23-86 5:46a GETCHAR COM 19 04-07-93 11:27p AUTOEXEC BAT 580 04-07-93 12:05a 15 file(s) 278588 bytes 5120 bytes free What are these programs? All the files beginning with CMOS are for saving, restoring, and comparing CMOS. CMOS.286 is the CMOS data. These files came from the CMOS11.xxx archive, a set of free programs by Roedy Green, Copyright 1993 (c) Mike Lambert All Rights Reserved Page 9 of 28 THE DISASTER RECOVERY DISKETTE -- MAKING THE MAGIC FLOPPY Canadian Mind Products. The files were copied to the floppy, and CMOSSAVE was used to create CMOS.286. You can use any CMOS save and restore program you desire, these programs were selected because they are free, small, and work well in a batch file (see below). GETMBR and PUTMBR are the programs to save and restore the MBR and EPBRs to/from MBREPBR.REC. The files came from the MBRSAVE2.xxx archive, a set of free programs I wrote because I needed them. The files were copied to the floppy and GETMBR was used to create MBREPBR.REC. You can use any MBR/EPBR save and restore program you desire, these were selected because they are free, small, and work well in a batch file (see below). Five useful tools are also included. DISKEDIT is Norton v6 disk editor for any hard disk surgery that may be needed. Include such a sector editor even if you do not know how to use it; if someone needs to do surgery on your hard disk, the tool is immediately available. VDE is an ASCII editor for working on CONFIG.SYS, AUTOEXEC.BAT, and any other configuration files that may need some work. (Have you ever modified CONFIG.SYS and the system won't boot?) Include an ASCII editor that you are familiar with. DM is a file manipulation utility that copies, deletes, moves, makes attribute changes, etc. It makes my life easier getting around on the disk. Include your favorite file management tool. I suggest that such a tool be small and be able to display and work with Hidden, System, and Read Only files. COMPARE is a file compare program that comes in handy when look- ing for file differences. and D is a small directory program that produces nice 4 column, filename and size, paged directory lists. Its named D because I didn't want to type much for a directory. AUTOEXEC.BAT is just for this disk, it runs the CMOS and MBR compare programs and if any changes are made, you are allowed to restore the data from backup copies. Please note that it is always a good idea to reboot the floppy after restoring the CMOS *and* the MBR/EPBRs. That means a reboot after each change you make. For instance, if you are restoring your CMOS because you lost your hard disk parameters, you must reboot before you could restore your MBR/EPBRs. When you reboot the same floppy, you work through the restoring in a logical order. Here is the AUTOEXEC.BAT: Copyright 1993 (c) Mike Lambert All Rights Reserved Page 10 of 28 THE DISASTER RECOVERY DISKETTE -- MAKING THE MAGIC FLOPPY ECHO OFF REM See if the CMOS has changed CMOSCHK CMOS.286 IF ERRORLEVEL 1 GOTO REST_CMOS GOTO CHECK_MBR :REST_CMOS REM CMOS is does not match stored copy. Ask if it should be restored ECHO The CMOS does not match the stored copy for the 286, do you want ECHO to restore the CMOS settings from backup? (Yes / any other key) GETCHAR IF ERRORLEVEL 121 GOTO CHECK_HIGH REM GETCHAR returns lowercase letter hit. 121 is y GOTO CHECK_MBR :CHECK_HIGH REM Check for z IF ERRORLEVEL 122 GOTO CHECK_MBR CMOSREST CMOS.286 ECHO Now hit the RESET button to reboot this disk. :WAIT4RESET GOTO WAIT4RESET :CHECK_MBR REM Now check the MBR and EPBRs PUTMBR This makes the disk very easy to use. Just boot the disk and it will immediately check those areas and give you an opportunity to restore them from backup copies if they are modified. Always reboot the computer after restoring CMOS or partition data. The DOS resident when you restore some of these areas may not consid- er your hard disk as a DOS volume for instance. GETCHAR is used to get the user response if CMOS is different from the backup copy. Below is a debug script to make GETCHAR.COM: Cut out the file below and feed it to DEBUG, command line is: DEBUG < filename.typ -------------------------cut-here----------------------- N GETCHAR.COM E 0100 B8 08 0C CD 21 3C 41 72 06 3C 61 73 02 0C 20 B4 E 0110 4C CD 21 RCX 0013 W Q -------------------------cut-here----------------------- Put an external disk label on the disk and write on it the disk label name, density (360k), DOS version, and any other informa- Copyright 1993 (c) Mike Lambert All Rights Reserved Page 11 of 28 THE DISASTER RECOVERY DISKETTE -- MAKING THE MAGIC FLOPPY tion you desire. Especially note that this disk is used for this particular computer. This disk contains THIS system specific data. Do NOT use this disk on another computer to recover the CMOS or MBR unless you know EXACTLY what you are doing. 4.3 DRF DISK 3 The third disk will have our backup recovery software, additional tools, and is bootable as well. This is the disk that will be used to boot the system and recover programs and data from backup copies. Once created, the disk should be write protected and need not be modified until there is a change in backup and recovery tools. Obviously before you know what programs and possible drivers should be on the disk, you must know how you will be making system backups, and how they will be recovered. This is called a Disaster Recovery Plan. If you don't know where to start, get dome guidance or start small and build a procedure. This is the contents of DRF_DISK_3: Volume in drive A is DRF_DISK_3 Volume Serial Number is 243B-0EE7 Directory of A:\ COMMAND COM 47845 04-09-91 5:00a TAPE EXE 64344 03-13-92 1:32p MSD EXE 64475 10-04-90 12:00a PKUNZIP EXE 23528 03-15-90 1:10a 4 file(s) 200192 bytes 90112 bytes free In this example the 168Mb of disk space is backed up to tape. This is a portable tape drive using the parallel printer port so no special drivers are needed. Portable tape drivers are very convenient, the tape drive and this disk can service any number of systems (DOS 5 is the operating system on the floppy disk). If you divide the number of systems serviced by the cost of the single drive, add the cost of the tapes for each system, subtract the time required to save and restore multiple diskettes, you might be surprised how quickly it becomes cost effective. I have also included Microsoft Diagnostics v1.0 since there was extra space available on the disk. This would be the place we would include any other utilities we may need. Put an external disk label on the disk and write on it the disk label name, density (360k), DOS version, and any other informa- tion you desire. Also note the backup/restore software on the disk for easy reference. Copyright 1993 (c) Mike Lambert All Rights Reserved Page 12 of 28 THE DISASTER RECOVERY DISKETTE -- MAKING THE MAGIC FLOPPY 4.4 DRF DISK 4 The fourth disk will contain software necessary to low level format the hard disk or diagnose hard disk problems. This will take a little effort to ascertain the type of disk and where the low level format or diagnostics you need are. This effort is best expended now before you need it. I don't want to say that this disk is required by every user, the general computer user may wish to depart here satisfied to pay someone to do this kind of work if necessary. This is fine, stay in your comfort level. My point here is NOT to tell you EXACTLY what you need and HOW to do it, the point is to get you to find out this information from your hard disk manufacturer. The varie- ty of manufacturers, drives, and procedures make it impossible to provide a simple list of steps to satisfy all formatting require- ments. It is important that you have your disk drive documentation and all of the information on the format parameters for your hard disk. Consult your hard disk manufacturer and acquire all docu- mentation and information you will need in the event you must low level format your hard disk. See Appendix A where I do just this. If you have the older MFM or RLL drives and the low level format routine is in the hard disk controller ROM (almost all cases), you won't need to make this disk. You'll use DEBUG on disk 1 and you will have to know your hard disk's format parameters. Follow the directions of your disk drive manufacturer and documentation. If you have SCSI drives, can probably use DEBUG and the format routine in the ROM BIOS. You may have something along the line I have on disk 4. SCSI drives come with the necessary low level format and diagnostic software in most cases. Follow the direc- tions of your disk drive manufacturer and documentation. In my case it is Ontrack's Disk Manager. See Appendix C for general information of Disk Manager's capabilities. If you have EDSI drives, check with your disk and controller manufacturer. Chances are that you will be using DEBUG on disk 1 and formatting as the MFM users do with DEBUG if the controller ROM is disabled. You'll still need your hard disk's format param- eters. Follow the directions of your disk drive manufacturer and documentation. If you have IDE drives, you probably do not have any software to format or diagnose your drives. I encourage you to contact your hard disk manufacturer and obtain ALL information on the hard disk and any utilities that may be available. **The manufacturer is the best source for software and instructions to format your IDE drive.** In some cases the diagnostic programs available will take care of most low level problems you are likely to encounter. This may take some time to acquire. By doing it now, Copyright 1993 (c) Mike Lambert All Rights Reserved Page 13 of 28 THE DISASTER RECOVERY DISKETTE -- MAKING THE MAGIC FLOPPY you save yourself the trouble when you are pressed for time trying to get your disk up and running again. Follow the direc- tions of your disk drive manufacturer and documentation. For those that cannot acquire adequate software from your disk manufacturers (myself included), consider using Ontrack Systems' product, Disk Manager v5.21 (current Mar 93). This software is "aware" of most problems you would encounter and can fix them. More than one drive manufacturer has told me that IF you HAVE to LLF your hard disk, Disk Manager is the preferred utility. **Always follow the guidance and instructions given by your drive manufacturer.** You may still get some information from your drive manufacturer. This information is drive specific, you will need this to override some of the defaults Disk Manager uses if necessary. See Appendix B for more information on IDE drives and Appendix C for Ontrack's Disk Manager information, it can do more than just LLF format your disk. If you are in a situation that normal Data Recovery Specialists cannot recover your system, Ontrack also provides advanced data recovery services. Here is my DRF_DISK_4 with the Disk Manager software to service my SCSI drives. Volume in drive A is DRF_DISK_4 Volume Serial Number is 2E50-0EE2 Directory of A:\ INSTALLR EXE 32766 10-20-88 11:06a README 1ST 15319 10-20-88 3:48p CONFIG SYS 35 10-28-88 12:00p DM EXE 76608 10-28-88 12:00p DMDRVR BIN 7772 10-28-88 12:00p DM REF 73078 10-28-88 12:00p DIAG EXE 47552 10-28-88 12:00p DIAG REF 12135 10-28-88 12:00p DISKPARK COM 2867 10-28-88 12:00p DISKPARK REF 2214 10-28-88 12:00p HARDWARE REF 20041 10-28-88 12:00p DMCFIG EXE 8512 10-28-88 12:00p DMCFIG REF 5604 10-28-88 12:00p ONLINE HLP 28513 10-28-88 12:00p README 14927 10-28-88 12:00p 15 file(s) 347943 bytes 8192 bytes free 5. USING THE DISASTER RECOVERY DISK Now that we've created these four disks, let's take a look at some of the risks we faced and how these disks will help us solve our problem. Copyright 1993 (c) Mike Lambert All Rights Reserved Page 14 of 28 THE DISASTER RECOVERY DISKETTE -- MAKING THE MAGIC FLOPPY If you think that because you may not know how to use every tool, and therefore should not prepare a Disaster Recovery Disk(s), please reconsider. If you have a problem and cannot deal with it, you will probably call upon a Data Recovery Specialist to solve your problem. While the Data Recovery Specialist will have the equivalent of disk 1, the data saved on disk 2 is unique to you. The cost of NOT providing disk 2 to a Data Recovery Specialist may convince you to have it in the future. Disk 3 is the software you are using to backup and restore your system, if the Data Recovery Specialist doesn't have what you need, they may have to purchase it. Guess who pays for that purchase. If the Data Recov- ery Specialist does not have the equivalent of disk 4, guess who might paying them while they acquire it! 5.1 Real Disasters The easiest way to get an idea of what value this preparation is, is to look at some real things that happen and how these disks help us solve them. 5.1.1 CMOS loss A variety of things can happen that can affect the contents of CMOS. A power surge can corrupt the contents of CMOS. Of course, you, the user can change your CMOS settings. At least one virus is known to modify CMOS contents. If you ever "take your system to the shop" to get it repaired, whose to say what will be there when you get it back? And since batteries do not last forever, one day, if you keep your computer long enough, the battery will fail. You'll have a few hours to get a new battery and replace it, but if you've got the data backed up, you won't have to worry about rushing out and buying one. I was installing a computer system and needed to install a lan card. When I opened the case, I found that the motherboard was bowed a bit. I had to remove and reinstall it. Somehow during the maneuver, I must have shorted the CMOS because when I powered up the system, no hard drive! Well, the IDE drive in the computer was not in the list of known drives in the BIOS. I needed to enter all of the drive characteristics. I could open the computer and hope that they were written on the hard drive where I could see it, or restore our backup copy. All I had to do to get me out of this situation was insert DRF Disk 2 and boot the computer. The CMOSCHK program in the AUTOEX- EC.BAT told me that the CMOS setting were different from the saved copy. When asked if I wanted to restore the data, I merely had to answer yes. I did, rebooted the computer, the AUTOEXEC.BAT ran again rechecking CMOS and MBR. Everything was fine; I reboot- ed the hard disk and was able to continue with my work. Copyright 1993 (c) Mike Lambert All Rights Reserved Page 15 of 28 THE DISASTER RECOVERY DISKETTE -- MAKING THE MAGIC FLOPPY 5.1.2 The MBR The MBR seems to be one of those things that gets stepped on often. Viruses present a constant threat. MBR infectors are common viruses and "disinfecting" the system seems a mysterious affair. Many users find that the virus still haunts them after repeated attempts to "disinfect" their system. More than one novice DEBUG user has overwritten the MBR accidentally. There are programs that modify the MBR and many seasoned users will still stay well away from the mysterious MBR. See section 5.1.5 for the "conventional wisdom" of solving the MBR virus "disinfection". Read it once so you know what you will hear, then forget about following that advice. Low Level Format is NOT the solution for virus "disinfection". The way you should always get rid of any virus is to overwrite the virus with the correct information, file, etc. If the virus has infected the MBR, it is the MBR that needs to be fixed. DRF Disk 2 is your answer for all your MBR problems. All we have to do is stick DRF Disk 2 and hit the reset button. PUTMBR in the AUTOEXEC.BAT file runs, finds the MBR is different and asks if it should be replaced with the backup copy. We answer yes, hit the reset button to reboot DRF Disk 2 and we find the pesky virus is gone. The whole "disinfection" process takes a couple of minutes, is done right, and we've back computing again. Compare that with any "low level format your disk" advice you get! 5.1.3 The Unbootable Hard Disk This has got to be the problem that occurs the most. If the MBR is good, the problem lies in the Boot Sector or the Operating System files (to include CONFIG.SYS and AUTOEXEC.BAT). DRF Disk 1 is the answer to this problem. Before we assume it is a problem booting that disk with the operating system, it would be a good idea to boot DRF Disk 1, rename CONFIG.SYS and AUTOEXEC.BAT, and then reboot the hard disk. If it still doesn't come up, then the problem is located in the BS or the operating system executable files. If the system does boot, the problem is in the CONFIG.SYS or AUTOEXEC.BAT files. In that case, fixing CONFIG.SYS or AUTOEXEC.BAT is the answer. Otherwise, when it is the BS or operating system executa- ble files, SYS is probably the answer. I have a friend whose daughter takes a laptop computer off to college. Every time she comes home for a visit, she has computer in hand and after explaining that one of her "computer expert" friends tried to fix her computer, it doesn't boot anymore. The first time I got this call we made a DRF Disk 1 over the phone and used SYS to replace the Boot Sector and Operating System files. Dad keeps a copy of the disk and on the subsequent com- plaints, just boots DRF Disk 1 and types in SYS C:. Copyright 1993 (c) Mike Lambert All Rights Reserved Page 16 of 28 THE DISASTER RECOVERY DISKETTE -- MAKING THE MAGIC FLOPPY Consider this other real story. User A needed a file on a tape that User B had backup up to tape. User A, while running tape restore program accidentally copied one of the Operating System files to their own C:. User A wasn't aware that User B wasn't running the same version of DOS. User A found out the hard way when the system wouldn't boot the next day. Fortunately DRF Disk 1 was available, User A booted DRF Disk 1 and ran SYS to put new copies of the correct DOS to the hard disk. There are also several viruses that infect the Boot Sector of the hard disk or one of the DOS system files. DRF Disk 1 is the answer to these problems, just boot DRF Disk 1 and SYS C:. The single most common target of a virus is COMMAND.COM. In these cases, booting any of the bootable DRF disks and copying COMMAND.COM to C: is the answer. COPY COMMAND.COM C:\ is the command. Note that earlier versions of DOS did not copy COMMAND.COM to the target disk with SYS. If you decide to use SYS when cleaning a virus from system files, always follow it with a COPY COMMAND.COM C:\. In every case of a virus infection, you'll always hear "Boot a clean copy of DOS and scan your computer for viruses". DRF Disk 1 is that disk. This disk is so important, that's why I said to "never remove the write protect from this disk" earlier when we created DRF Disk 1. Besides, I've seen more than one case that dirty bus or cable connector connections cause the floppy disk to write garbage to the floppy disk. This can't (shouldn't) happen if the disk is write protected. Many times you will hear that "the virus destroyed the low level format", and its just not true. Remember Michelangelo? I heard many say that is what it did. It didn't. The virus just wrote all over all of the beginning portion of the hard disk. This de- stroyed the MBR, BS, FAT, Root directory, and whatever data was in it's reach. Well, this sure made the disk unbootable! The solution for this is DRF Disk 1. It will boot the system and has an operating system, FDISK, and FORMAT on it. This is all that will be needed to create new hard disk partitions. Here's the way it would go: 1. Boot DRF Disk 1 2. Use FDISK to create the necessary partitions, take care to ensure that the primary DOS partition is Active. 3. Use FORMAT to DOS format the partitions 4. If you didn't use the /s switch when formatting the primary DOS partition, use SYS C: 5. Use DRF Disk 3 and recover programs and data from you backup copies 6. Boot DRF Disk 1, put in DRF Disk 2, and backup a new copy of your MBR and EPBRs. Write protect DRF Disk 2 when finished. An interesting note on Michelangelo: if you have a large disk and Copyright 1993 (c) Mike Lambert All Rights Reserved Page 17 of 28 THE DISASTER RECOVERY DISKETTE -- MAKING THE MAGIC FLOPPY let's say with a 32Mb C: and D: etc., the chances are that the extended partitions are still there. Remember that we have a copy of the MBR and the EPBRs on DRF Disk 2. If you restored the MBR and EPBRs, the chances are that you can reboot your system with DRF Disk 1 and have access to all the logical drives in the extended partition. 5.1.4 Recovering Files From Backup Copies Everyone has had some reason or another to have to get a backup copy of a file. Whether it is a virus, accidentally deleting a file and then not being able to undelete it, or the infamous FORMAT C:, having DRF Disk 3 and a current back is the answer. Some time ago, I brought down my FAX/BBS system to change a disk controller. Drive C: hosts DOS and the FAX, drive D: hosts the BBS. I powered up after replacing the disk controller and drive C: would not spin up. I had to replace the disk and start from scratch. I booted DRF Disk 1, prepared the new disk with DRF Disk 4, and recovered everything using DRF Disk 3 and the tape backup I made just before powering the system down. I then backed up the new MBR to DRF Disk 2 and I was finished. It would have been a real disaster if I hadn't been prepared. Consider another example. A client uses DOS 4 and a third party memory manager. It was configured when the computer was pur- chased. One day the memory manager had an exception error and halted the computer. The only way to restart the computer was the reset button. Logical drive D: is used to store the databases. As you might expect, when the system halted, all the database files were left open and who knows what the system was doing when the error occurred. The result was logical drive D: was a total loss. The file structure was so corrupted, it wasn't worth trying to fix. DRF Disks 1 and 3 came to the rescue. DRF Disk 1 was booted and D: was DOS formatted. DRF Disk 3 was used to recover all of the databases back to D:. The end result was that the system was back up in 35 minutes and only three hours work was lost (good backup procedures). This is not as difficult as it seems. Executables only need to be backed up once, and data after you have changed it. If you take the time to determine how you want to backup and then put those backup and restore programs on DRF Disk 3, it is an easy matter to use DRF Disk 3 and recover anything you need. I prefer recovery from backups to the "disinfection" method of recovering from a virus infection. It is a simple matter to just copy all the executables from your clean, original backup copy. While "disinfection" is attractive because some feel it "easier", "disinfection" is not an exact science. Any responsible Data Recovery Specialist will always choose "restore from backup" to Copyright 1993 (c) Mike Lambert All Rights Reserved Page 18 of 28 THE DISASTER RECOVERY DISKETTE -- MAKING THE MAGIC FLOPPY "disinfection". Remember that it is your data that is going to manipulated by the program that was "disinfected". What would happen to your data if the program that manipulates it was not disinfected properly? 5.1.5 Read Errors and Low Lever Formatting The first caveat for this section is: If you don't know what you are doing, STOP! Find someone who does know what they are doing and get some help. YOU are responsible when you format your hard disk. Take due care and you will proba- bly not have any difficulty. The "convention wisdom" for "disinfecting" an MBR virus such as Stoned, Michelangelo, Joshi, NoInt, multi-partite, etc. viruses is "to low level format your hard disk". This is NOT true! If someone tells you this, you should immediately find someone knows what they are talking about! The only reason someone tells you to Low Level Format the hard disk is because they know of no other way to rewrite the MBR. NEVER USE A LOW LEVEL FORMAT TO SOLVE A VIRUS PROBLEM! unless you have reliable information from an EXPERT that the low level format is damaged. There are many of people who pretend they know; they don't! There is only one virus that I ever heard of that ACTUALLY modi- fied the format of a track on the hard disk. I've never actually seen it so I can't even verify this rumor. Remember, don't demol- ish the house to fix a leaking faucet. Note in Appendix C that Disk Manager is capable of formatting single tracks. If a track's format was lost, it could be repaired without formatting the entire disk. If you do have an MBR virus, you should go to section 5.1.2. DO NOT ATTEMPT TO LLF YOUR HARD DISK UNLESS YOU: 1. Have tried all other options to get your hard disk "up". 2. Are reasonably sure that a LLF WILL solve your problem. 3. You have all the information you need for the formatting session. 4. You have the appropriate software. 5. You have an alternate plan in case the worst happens. I have seen disk problems when reorienting a computer. On occa- sion I've experienced a high number of read errors because the drive was turned on its side. In this case, I reoriented the computer again so that the drive was on its front, backed up the disk, turned the system on its side, reformatted the disk and Copyright 1993 (c) Mike Lambert All Rights Reserved Page 19 of 28 THE DISASTER RECOVERY DISKETTE -- MAKING THE MAGIC FLOPPY then copied all of the backup programs and data to the hard disk. If you can boot the hard disk and read your data, this is the time to make a current backup. If you do have to address this formatting issue, you'll need DRF Disk 1, 2, 3, and 4. DRF Disk 1 if you can't boot your hard disk, DRF Disk 4 to do the necessary low level formatting, and DRF Disk 3 to recover all your programs and data from your backup copy. Make a new backup copy of your MBR on DRF Disk 2. Here's how the reformatting session goes: YOU SHOULD NOT ATTEMPT TO DO LOW LEVEL FORMATTING UNLESS YOU HAVE ALL OF THE INFORMATION YOU WILL NEED AND YOU KNOW WHAT YOU ARE DOING. 1. Boot the system with DRF Disk 1. 2. Use your disk maintenance software on DRF Disk 4 to diagnose, repair, or format the hard disk. CONSULT YOUR DISK CONTROLLER AND DISK DRIVE DOCUMENTATION AND FOLLOW THE INSTRUCTIONS. Once the hard disk has been reformatted you will need to put DOS partitions on the disk. 3. Use FDISK to partition the disk. If you have a large disk, consider partitioning it into two partitions. The idea behind this is to have a relatively small C: that holds your DOS, device drivers, utilities, batch files, recovery software, etc. Use the rest of the disk for D: where you make it your default disk and do all of your work in that partition. The reasoning behind this is that if something destroys your current partition (D:), if C: has not been destroyed, you will be able to boot C: and have all of the tools necessary to recover D: from backup copies. Ensure that the Primary DOS Partition is Active. 4. Use FORMAT to prepare the partitions for DOS. FORMAT C: /S will put a copy of the operating system files on C: and make it bootable. 5. Use your software to restore your software and data from your backup copy. 6. Backup your new MBR on DRF_DISK_2. This will be the time that you will discover what other utilities you need to have available. Make a list and copy them to DRF_DISK_2 or DRF_DISK_3 if space is available. Create a new DRF_DISK_5 if necessary. DRF_DISK_5 does not have to be bootable. Copyright 1993 (c) Mike Lambert All Rights Reserved Page 20 of 28 THE DISASTER RECOVERY DISKETTE -- MAKING THE MAGIC FLOPPY 6. OTHER SOFTWARE Carefully consider what is important to you and your system. Prepare to add any additional software that will be of use in recovering your system. 6.1 More DOS Examine your use of the DOS capabilities. Perhaps you are using MIRROR, DRIVER.SYS, etc. Be sure to add these programs and any data to your recovery disks if you will be needing them. With the advent of DOS 6.0 there are new capabilities and addi- tional DOS software (and more disks) may be required. For in- stance: If compressed partitions are used, DBLSPACE.BIN will be required. In fact, it is nor an operating system file so it will be included on your bootable disks when you FORMAT x: /S or SYS x:, costing you approximately 51k on each bootable volume. 6.2 Generic Virus Detectors Those that use generic virus detectors and followed your manufac- turer's directions have an emergency recovery disk. Of course this is a part of the Disaster Recovery Disk set. Good generic detector products also save all critical data (CMOS, MBR, EPBRs). This should overlap the data and recovery utilities on DRF Disk 2. Be sure you know how to use this software in the event of a virus problem. It may be possible that the AV software may not be able to restore your MBR unless C: can be accessed through DOS as C:. In this event, the separate save and restore programs and data on DRF Disk 2 will be required. 6.3 Communications Software It would be a very good idea to have a set of your communications software available in case you need to acquire other software to effect your recovery. 6.4 Other Virus Detection Utilities If its a virus infection that you are faced with and you are not using a generic detector, virus detection utilities (often called scanners) may be able to identify a subset of the software you will need to replace. If you choose this method, be sure to keep these utilities up to date and free of virus infection. Most good scanners have the capability to add external signatures for viruses that the scanner does not recognize. Remember you have an ASCII editor on DRF_DISK_2 so don't use the possibly infected editor on the hard disk. Put the external string file on C: instead of removing the write protect from your scanner DRF disk. Copyright 1993 (c) Mike Lambert All Rights Reserved Page 21 of 28 THE DISASTER RECOVERY DISKETTE -- MAKING THE MAGIC FLOPPY 7. SUMMARY If you take the time to plan for restoring your system, a disas- ter becomes an inconvenience. An inconvenience is always dealt with more efficiently than a disaster is. The first thing you'll need is Disaster Recovery Disks. It is important that you review your situation, resources, and computer use so that you will have all the tools you will need, when you need them. These tools will get you started, but remember that without backup copies of your programs and data, the Disaster Recovery Disks are of limited use. You must also come up with a backup and recovery strategy that will provide you with backup copies that will restore your system so you can get back to work when the worst happens. Acknowledgements ---------------- Microscience is the maker of Hard Disk drives and the author has been unable to locate them. CMOSCHK.COM, CMOSSAVE.COM, and CMOSREST.COM are authored by Roedy Green, Canadian Mind Products, Vancouver BC Canada and can be freely used for any purpose except military. Filename is CMOS11.xxx where xxx is an archive extension. GETMBR.COM and PUTMBR.COM are authored by Mike Lambert, Herndon, VA and can be freely used but no fee can be excepted for providing the programs. Filename is MBRSAVE2.xxx where xxx is an archive extension. Trademarks ---------- Disk Manager is a registered trademark of Ontrack Computer Systems, Inc. 7213A is a trademark of Maxtor Corporation DBLSPACE is a trademark of Microsoft Corporation Copyright 1993 (c) Mike Lambert All Rights Reserved Page 22 of 28 THE DISASTER RECOVERY DISKETTE -- MAKING THE MAGIC FLOPPY APPENDIX A Getting Info on the Hard Disk This section is very short, its just too simple! I have two IDE drives in my 386. The first was a Microscience 115Mb drive. Unfortunately I did not try to get information from the manufacturer before that was no longer possible. This illus- trates the need to do so as soon as possible. The second drive I have is a Maxtor 7213A. It was packaged by a reseller who provided limited information; really, installation instructions only. Their tech support gave me the expected, "its impossible to do" answer to my LLF maintenance questions. I found that Maxtor has an 800 number for technical support. I invested 10 minutes and phoned Maxtor. I told them that I would like to get all the information possible on the 7213A to include any support utilities, along with LLF information. Maxtor was very helpful. While they did not provide a formatter for the 7213A, they could provide two things. First, a number of utilities and information available on their BBS; and second, Ontrack's Disk Manager was the suggested software to Low Level Format the 7213A (just take the defaults for that drive model and go! they said). I was given a few filenames on the BBS that were pertinent to my hard drive. I called their BBS and spent 20 minutes downloading several files that included an initialization utility, full specifications on the drive, jumper settings (necessary for adding a second IDE drive, etc.), IDE drive identification utilities, etc. I printed out the information on my model drive and included it in the scanty "manual" I got from the reseller. I copied all the files to my disaster recovery disk for that system. Now, I'm ready for the possibility of handling an LLF problem on my Maxtor IDE drive. Even if I was not able to do the work my- self, the information is invaluable for the Data Recovery Spe- cialist that may have to work on my drive if necessary (not to mention the jumper settings for multiple drive configurations). In the environment with malicious software that can damage my hard disk, it is comforting to be prepared. Copyright 1993 (c) Mike Lambert All Rights Reserved Page 23 of 28 THE DISASTER RECOVERY DISKETTE -- MAKING THE MAGIC FLOPPY APPENDIX B Large Drive Format Issues Let's look at a few of the problem areas that are encountered with large drives and formatting. These are translation, defect management, skewing, Zone Bit Recording, and track alignment. This is not an in depth technical discussion on every technical issue, but a general information discussion of the larger issues to illustrate why LLF has gotten to be a very complex task. With this general information, you will be able to appreciate the work involved, why special software is needed, and why some will just tell you "that it can't be done" (the easy way out). I do not provide a hard disk background and this discussion is not geared for the novice. There are many books that describe disks, platters, cylinders, heads, etc. If you have difficulty with this section, read one of these books to become familiar with disk drive characteristics. Translation ----------- Large capacity drives, mostly the popular IDE drives, provide the large capacity by having a large number of cylinders per disk and possibly a large number of sectors per track. These values fall outside of the primitive BIOS protocol that DOS must use to access the drive. It is the limits of this BIOS protocol that is responsible for the problems we now see. In the space of two 16- bit words, the cylinder, head, and sector have to be specified. Because of the limited number of bits available, there are maxi- mum values that can be specified. DOS actually converts its needed sector into a logical block number and then converts it to the BIOS protocol Head, Cylinder, Sector. The BIOS then converts it back to a logical block number. (Silly but true). When the drive's physical geometry lays outside this protocol capability, the area cannot be "used by DOS". "Used by DOS" is a misleading statement, its actually "outside of the BIOS interface protocol". The solution drive manufacturers use to solve this problem is re-translating the geometry for the whole disk into something that the BIOS protocol can handle. For example: My 203Mb Maxtor's physical geometry is: 1698 cylinders, 4 heads, 42 sectors per track In this case the 1698 cylinders is more than the 1024 cylinders that can be specified in the BIOS protocol. The manufacturer solves this by "translating". This means that it will tell the BIOS that it has: 683 cylinders, 16 heads, 38 sectors per track The drive is then put into "translation mode" so that when the BIOS protocol specifies a cylinder, head, and sector, the drive Copyright 1993 (c) Mike Lambert All Rights Reserved Page 24 of 28 THE DISASTER RECOVERY DISKETTE -- MAKING THE MAGIC FLOPPY translates that into the *real* cylinder, head, and track. You can imagine that if you tried to format this drive saying 683, 16, 38; we'd have a real problem formatting the real 1698, 4, 42! No, the drive will not "translate" during formatting. Its going to take special software to get the drive out of "translation mode" and into "physical mode" to format it. Defect Management ----------------- Drive manufacturers have endeavored to provide a means to manage the defective sectors on a disk for the operating system. Consid- er this: Sector 3, head 2, cylinder 345 has a defect and can no longer hold data reliably. The only way for the operating system to know not to use it is to have it in its "bad block list". No problem if known from the beginning, but it is interesting when using the block to store data this minute. DOS is not known for its han- dling this sort of problem "on the fly". Third party products allow us to "lock out bad clusters in the FAT". But what if the drive took care of the problem? Suppose that the drive has a way of "replacing" the bad sector. It sees that it can't store data in that sector so it stores it in a space sector it has just for this purpose. There are various ways to find this sector later when it is used again. So the drive puts the data in a new sector and every time that sector is accessed, the drive knows where it really stored the sector. The end result is that as sectors go bad on the disk, the disk takes care of replacing them, the operating system does not know that the sector is in fact bad. To provide this service, part of the disk is "not available to the operating system", but is available to the disk drive. How this disk is formatted and how these spare and control areas are allocated and prepared is a major formatting issue. Its going to take special software to do this properly on the specific drive. Skewing ------- Skewing refers to the order in which the heads and cylinders are physically laid out on the disk. Those familiar with sector interleave will have no trouble with cylinder and sector skewing. The manufacturer has determined, based on the performance charac- teristics of the drive, the optimum layout of sectors so that the needed sector is available in the least amount of time. This is a format issue and if not done properly, the disk will not provide the optimum performance intended. Copyright 1993 (c) Mike Lambert All Rights Reserved Page 25 of 28 THE DISASTER RECOVERY DISKETTE -- MAKING THE MAGIC FLOPPY The manufacturer knows how the sectors should be laid out. If you have to LLF the disk, you must have software that will write these sectors as the manufacturer intends. Zone Bit Recording (ZBR) ------------------------ ZBR is best illustrated by looking at 2 circles, one inside of the other. The distance around the circumference of the outer circle is greater than the circumference of the inner circle. When disks are typically formatted, the same number of sectors are written around the inner and outer circle. As consecutive inner circles get smaller, the sectors are closer together. The number of sectors around the circle has to be the maximum number of sectors that can be used on the inner circle. Simplistically, the sectors on the outer circle are bigger than the sectors on the inner circle. They don't need to be, they just are. This wastes space, why not put more sectors of the same size on the outer circle than on the inner circle? ZBR is a technique that provides just this variable number of sectors on the tracks. Outer tracks have more sectors than the inner tracks. What makes this issue so interesting is that all the software we are using assumes that there are the same number of sectors on all tracks. The drive has to be responsible for translating the fixed assumptions to the variable realities. This is a huge formatting issue and not only requires special software to do this properly so that the drive can reliably deliver data from sectors, but it may also require special hard- ware and firmware to write these sectors. This firmware may not be on the drive to do this. Track Alignment --------------- Earlier disk drives determined the place on a disk platter that the track occupied by moving a precise distance from the begin- ning of the disk. This measurement relied on mechanical parts of the drive; and as you'd expect, mechanical parts wear with use. When they wear, they do not precisely place the heads over the track properly. Various techniques have been used to place the heads over the correct track in an acceptable amount of time. One current technique in use now is using what is called a "servo track". This is a track that does not hold any data but when one of the heads is aligned over this track, the other heads in the head assembly are definitely aligned over the other tracks that hold the data. The only job of this track is to provide accurate placement for the head assembly. Naturally this will take up one whole side of one platter. Since there are two sides to every platter, normally you expect to find an even number of physical heads. When you have a disk drive with three platters and find that the physical head count is 5, chances are that the 6th Copyright 1993 (c) Mike Lambert All Rights Reserved Page 26 of 28 THE DISASTER RECOVERY DISKETTE -- MAKING THE MAGIC FLOPPY platter is used for servo tracks. Formatting a disk like this now covers the additional issue of formatting (or not) these servo tracks. Normally there is no write access to these tracks and special hardware and software may be required to accomplish the format of the servo tracks. Summary ------- Low Level Formatting large disks and disks using advanced tech- niques for reliability as disk drives get smaller and faster, has gotten much more complex than older drives that do not employ special strategies. This complexity now dictates considerable knowledge, special software, and possibly special hardware to accomplish LLF for some disks. These requirements have taken the capability to LLF out of the hands of many of those who could take care of LLF in the past. The only thing that can be counted on as the future of disk drives unfolds is that it is going to get more complex and specialized. Copyright 1993 (c) Mike Lambert All Rights Reserved Page 27 of 28 THE DISASTER RECOVERY DISKETTE -- MAKING THE MAGIC FLOPPY APPENDIX C Using Disk Manager (DM) to LLF This is not to be meant as a tutorial or analysis of Disk Manag- er, but just an overview for those unfamiliar with it. Ontrack's Disk Manager has been around for a long time. They were providing multiple, and greater than 32Mb partitions before DOS. If you are using the DM partitioning and drivers to give you custom partitioning, its just a matter of following the prompts. DM will walk you through the entire process, making it virtually painless. DM will take care of the LLF, all the partitioning, and high level preparation for you. The current version is 5.21 and all fits on a 360k disk so it can be used on any system easily. You'll have to provide an operating system as Disk Manager is run from the DOS prompt. Your DRF Disk 1 is used for this. Remove DRF Disk 1 and insert the Disk Manager disk. At the DOS prompt, enter DM to start Disk Manager in Automatic Mode. This mode makes it easy for less sophisticated users to handle the LLF and disk preparation. Partitioning can be handled auto- matically, or individual partitions can be specified. Diagnostics are also available and should be used before formatting. For advanced users, enter DM /M. If control is what you want, manual Mode is the answer. From these menus it is possible for the more advanced user to control all aspects of the disk prepa- ration. Existing drives are identified explicitly in the System Configuration menu. The disk geometry is accessible, CMOS can be updated or changed. A full range of diagnostics are available from the Diagnostic Services menu. The Disk Preparation menu provides access to formatting and partition preparation. Formatting can be completely controlled, even restricted to partitions or individual tracks. Destructive and non-destructive defect scanning is also available. The defect list can be modified. Disk formatting can be defined by manufac- turer and model number. Full control over formatting parameters is available. Partitioning can be controlled at the cylinder level. This is handy for locking out a group of bad cylinders. Copyright 1993 (c) Mike Lambert All Rights Reserved Page 28 of 28