Slashdot Mirror

In my blog, I describe my use of BootIt Bare Metal to rapidly test installs of "semi-embedded" software I write that involve wrapping third-party installs of drivers as sub-installs. This will work only as long as BIOS's and Microsoft continue to support "legacy mode". I'm just hoping that the scientific & embedded world finishes moving to Linux before "legacy mode" disappears.

There are a lot of similar and tangentially related responses, so I'll make this one post instead of responding inline to each one.

SETUP
My partitions look like this in gparted:

[ PRI/BOOT: Windows w/ TrueCrypt OS encryption ] [ EXTENDED: [ LOGICAL: normal, unencrypted partition where TrueCrypt file containers reside ] ]

Note that TrueCrypt replaces whatever existing bootloader is on the drive with its own so it can run pre-boot authentication to decrypt the OS.

Yes, I realize that I don't store any data on the OS/software partition, but there are still system caches, logs, databases and other potential data leaks to consider. For example, the encryption keys for the file containers get stored in the hiberfile. Without encrypting the OS, it would be fairly easy for an attacker to access the keys to the encrypted file containers. With the OS encrypted, this is not an issue.

BACKUP
I use TBU IFL (self contained bootable imaging software) to backup the OS partition in it's raw, encrypted form. Yes, this causes it to backup empty space and it takes quite a bit longer to run. Differential backups do work and are a smaller filesize than the original full backup, but they still take just as long.

From the research I've been doing on TrueCrypt's forums, it appears the reason that I can only restore these backups on the original drive is due an insufficiency in TrueCrypt's rescue system.

What I've found is that I can use Windows-based imaging software to backup the OS partition in it's decrypted form, restore the image to a new drive and re-encrypt it. It's a bit of a process, but it's still faster and easier than running the full TrueCrypt decryption process, copying the partition to the new drive and re-encrypting. I could use the imaging software's own encryption scheme to protect the image if I want.

When I backup my data, I do exactly what many have suggested here: back it up at the file level by using synchronization software to periodically compare and copy changed files (from inside the TrueCrypt volumes that I've already mounted) to an external drive which contains mounted TrueCrypt volumes of identical size.

FOLLOW-UP
So, to rephrase and answer some of my questions:

1: Non-Portable OS Backups
Solution in this context: use Windows-based imaging software to backup the system volume in its decrypted form. Use the encryption feature built into the imaging software to protect it.

2: Volatility of Data Containers
The problem is not backing up data inside the containers. The problem is that they are volatile. Any data corruption in the area of the partition where a container resides renders that container functionally useless and all contained files inaccessible. Basically, adding a layer of security also adds a layer of instability, but I don't currently see a better way of acheiving that security.

3: SSDs
Still not sure what to think about SSDs, all of my research has yielded mixed results from polar extremes of the spectrum.

The article mentions whitelist technology as the next step beyond conventional signature-based blacklist systems. But that's what I used three years ago, with RegRun. As soon as an executable is run that it doesn't recognize, RegRun pops up an alert asking you if it's legitimate. Of course, this is useful only for the technologically savvy.

But now instead of that, I employ the ultimate in virus recovery (albeit not virus control). Using the multi-boot software BootIt Bare Metal (like a commercial version of GRUB, GParted, and other utilities rolled into one), I keep a clean OS on a separate partition that I can copy over the main partition at any time. Of course, I keep data on fileservers instead of my local hard drive.

The point of the resizing would be to make space for another extended partition, not another primary one. As I noted elsewhere in this discussion, Linux and certain other operating systems can be installed into and booted from logical volumes in extended partitions.

You CAN have more than four primary partitions, though... sorta: BootIt Next Generation.

You're only partially correct about the limitation: normally MBR disks are limited to four PRIMARY partitions. The limit on non-primary (extended) partitions is a bit more generous. Further, some operating systems are able to boot from extended partitions, including Linux. In the specific instance you lamented, then, you could have left ALL the partitions (if you resized one or more) and simply installed Linux into a new extended partition. I have done exactly that myself more than once.

If you want more than four primary partitions, I know of at least one method to get them: BootIt Next Generation.

Well if you can't access it in any way, then why would it matter? Remember, what folks are afraid of is some hacker will get their CC numbers or some business will end up with a lawsuit because the hackers got everyone's social off their old machine. But I have yet to see anyone actually pull anything useful off without going clean room, which frankly is so crazy expensive that no hacker in his right mind would bother. And for the poster that said it would take too long? You do know there are free programs like this that can boot off CD and do the job for you, right? Hell I bet the FLOSS guys have a nice CD that you can stick in that is simple to script. Simply write a script, burn the disc, and then set the headless machine in the corner.

And finally let us not forget that in this economic downturn that many machines being tossed by enterprise and SMBs as "junk" could be given a new lease on life and help those that have not been as fortunate as us. I repair and give away machines from businesses and you would be surprised what even a 400MHz P2 can do for those that have none. I have turned a 233MHz into a bookkeeping appliance for a little church who helps out families, the homeless, and migrant workers by installing Puppy Linux with OO.o and some simple Dbases set up. Once shown how the wife of the pastor makes her own databases using the wizard and uses them to track donations, make mailing lists, help with inventory, etc. I have given a 400MHz to a single mom who cried because she now had a way to help her kids with homework and thanks to that donation would have something nice to give her kids for Xmas, and I have set up a group of old 350-600MHz along with an old 700MHz donated server I was able to talk the school out of for a class project on networking for a shelter for battered women. They use them to teach office skills to the women to help them become self sustaining and the server reimages them and does backups on the ones we gave the office workers.

So while the cost of a new HDD might not be a big deal for most of us, for them it could have hurt. I tell all of those that are nice enough to donate that I will DoD-7 wipe the HDD, which for the smaller drives in older machines really doesn't take long. And of course now that IDE drives are no longer being made they will probably end up more expensive which will make it even harder for somebody who doesn't have much to begin with to afford one. I figure it is better for the environment as well as my heart to take a little time and sit a PC in the corner and run DoD-7 than it is to just see it end up as more e-waste polluting our landfills. Don't you?

Many posters have already listed excellent tools for creating a snapshot offline.

From what you've described, however, it sounds like you might be interested in something that can take a snapshot of a Windows PC while Windows is running.

DriveImage XML is free for personal use
http://www.runtime.org/driveimage-xml.htm

If you need something commercial and you don't mind spending $40, then Image for Windows is also an excellent choice:
http://www.terabyteunlimited.com/purchase-image-for-windows.htm

yick im going to waive my mod points to post this little gem ftp://terabyteunlimited.com/burncdcc.zip
1 its freeware
2 all it does is burn isos
3 if you can't figure it out sell your computer
4 if you manage to make a coaster your drive is defective (or your box is "compromised")

I couldn't find active links for one or two of them myself, but here's an updated list -- in some cases these aren't the original sites, which have disappeared, so obviously it's worth being extra careful with antivirus software... apologies for the mess of links; the filter doesn't like short lines...

1by1 (play MP3s), AriskKey (recover passwords), AutoRuns (enumerate startup tasks), BurnCDCC (burn ISO images), CD (basic CD player), CDex (rip CDs + convert MP3/WAV), Copier [0X Copy Machine] (scan + print), CWShredder (clean spyware), DComBob (tame DCOM), DirLister (make quick file lists), Discover (force windows onscreen), DupeLocater (find and clean), FileRecovery [PC Inspector] (undelete), Folder2ISO (use with BurnCDCC), FoxitReader (read PDFs), GUIPDFTK (split/join PDFs), HijackThis (find spyware), HJSplit (split/join files), Identify_Boards (identify hardware), KatMouse installer (due to MS drivers), LCISOCreator (make ISO image from CD), Leaktest (test firewall), Microsoft keygen (people lose things), MultiRes (change res + force refresh), Multi Timer (stopwatch), NoteTab Light (text editor), NTest (test monitor setup), OnTop (pin windows to foreground), Process Explorer (task manager), ProduKey (recover passwords), Registry Commander (virus cleanup), ResHacker (examine executables), Rootkit Revealer (just in case) ShootTheMessenger (turn service off), Shred by AnalogX (simple filer shredder), TedNPad (unicode text editor), TFT (dead pixel locator), UNPnP (tame SSDP), UPX (compress executables), UnitConverter (what it says), utorrent (basic torrent app), VCdControlTool (mount ISO images),

BING is tricky: it stores multiple customized MBRs, and then loads whichever one is appropriate for the boot configuration which you choose. It also has an option to support MORE than four primary partitions; when that's enabled, not only does that let you have as many environments as you please, usually with no worries about OS conflicts with partition sizes and locations, you can quite literally dictate exactly which volumes are visible to which environments. It doesn't just merely mark those volumes as hidden, it removes them from the MBR/partition table which that OS uses to boot.

The only downside, and I'd think it's a small one for most people, is that (using the extra primaries option) you can no longer use other partition management software, because it no longer knows the physical layout of the volumes and would corrupt the ones it can't "see". BING has decent built-in partition management, however, even supports imaging to USB opticals. It might also be a bit less technical and dumbed-down for yer ma and pa, but it's fine for geeks.

Made by Terabyte Unlimited: http://terabyteunlimited.com/

Mark

BootitNG has also image/restore functionality...
http://www.terabyteunlimited.com/

what you have is basicaly a photocopy of a cd use http://www.terabyteunlimited.com/downloads/burncdc c.zip to burn the image to a real cd

--

Flippant answer: It is possible -- just don't install that silly Windows OS. Presto! No more problem installing Linux, no need for any non-free software.

Semi-flippant answer: Why not turn this question around and ask why the wonderful copy of Windows you got "free" with your machine (and I use "free" here only in the loosest sense) requires you to spend $69.95 just for the privilege of installing a second operating system on the machine that you own?

Non-flippant answer: You don't have to spend any additional money to install Linux. There's several free options available. Here's three of them just off the top of my head:

• Knoppix - the most recent version includes qtparted, which can resize NTFS. And even after you've installed the distro of your choice, Knoppix makes a great recovery CD, so hang onto it. Downside for the bandwidth-challenged is that this is a 700MB ISO image.
• Mandrake - the first Mandrake 9.1 installation CD can resize NTFS partitions. Slightly smaller (650MB ISO) download than Knoppix. Might be handy if you don't have any 700MB CD-Rs handy.
• BootIt NG - the maintenance mode has a very easy-to-use NTFS resizer. (Shareware, 30-day free trial use. If you can't get your NTFS partition resized within a month, give up and have the 8-year-old kid from next door give you a hand.) Very small download -- it's a bootable floppy image -- so a decent option if you're stuck with dial-up access and want to avoid sucking down a 650-700MB ISO image.

It is still possible. Go grab BootIt NG and follow the prompts to create an ISO image. Burn the bootable CD, boot your system, enter maintenance mode (instead of installing to your hard drive). Voila, you have a full-fledged partitioning program that doesn't depend upon Windows, or any other OS for that matter. Works great, I have used it many many times to create/resize/delete partitions for dual-boot systems.

I always use BootIt NG to create/resize/modify partitions. It contains nearly as many tools as Partition Magic, works with virtually any partition type, and has a decent interface. You can create a bootable CD or floppy and not have to worry about which OS is installed (unlike PM).

• Drivers: Via, nVidia, and Intel chipsets; ATI Rage 128, ATI Radeon, and nVidia GPUs; Highpoint HPT37x and Promise Ultra IDE controllers; miscellaneous 3Com, AMD, Intel, Linksys, and NetGear NICs; Sound Blaster PCI, Sound Blaster Live, Santa Cruz, and Via integrated sound cards; DirectX; Palm Desktop; Nero UDF reader
• Applications: Mozilla, CDex, OpenOffice.org, Pixia*, SmartFTP
• Plugins and viewers: Adobe Acrobat Reader, Flash Player, Ghostscript and GSView, IrfanView, Java Runtime Environment, QuickTime, Winamp
• Emergency rescue stuff: Norton Disk Editor, Diskman, DOSLFN, MBRWork, Norton Disk Doctor, RegEdit, CTMOUSE, FIPS, Ghost, NTFSDOS, Partition Manager, Partition Resizer, RawWrite plus a DOS boot disk image, Info-Zip UNZIP, Restoration
• Miscellanous utilities: Ad-Aware, UnxUtils, wget, PGP, Privoxy, Restoration, TweakUI, TweakUI XP, VDMSound, XVI32

* I'd like to include The Gimp, but I often install the free/Free stuff from this CD onto computers I give to charity, where people might take offense to the name. I'll probably replace Pixia with CinePaint in the future.