Slashdot Mirror
The Hidden Treasures of Sysinternals
Barence writes "PC Pro contributing editor Jon Honeyball has written a nice feature on the latest treasures to be found on the Windows Sysinternals website. Among them are a tool for creating virtual hard disks from physical drives, a hard disk read-write monitoring tool, and a utility for putting ISO images onto flash drives. They're free, but they're effective."
I used SelfImage recently to dd a windows 2003 box to an LVM-based virtual machine on Proxmox, a Debian-based Virtual Machine Server. Worked a treat. While I see the benefit of created a Microsoft VHD if you're an MS shop, we're a mix so being able to pump a live physical disk into a remote logical volume was great.
These have been available for a long time, used to just be from a site called Sysinternals run by Russonivich before Microsoft hired him. This guy is, literally, the person who wrote the book on Windows. Windows Internals is the current name, used to be called Inside Windows 2000. A wonderful technical document of the internal workings of Windows.
At any rate, Russonivich produces extremely useful tools. Not the sort of thing you want in the hands of inexperienced users, as many of them can break your system, but extremely powerful. I use them all the time in the course of my job, especially when there's manual malware removal that needs to be done. So far, malware is unaware of the ability to suspend a process, which Process Explorer will do. So you suspend the malware, its watcher process doesn't know to restart it. You then use autoruns to remove the startup entries. At that point you can reboot, it won't start, and you can clean up the residuals.
There are no silver-bullet solutions for booting ISOs via USB. A silver-bullet solution requires doing "floppy emulation", which is something that can't be easily done in a general-purpose way. For CD booting, each BIOS has this functionality implemented differently. For USB booting, the bootloader has to figure out how to do this. MEMDISK and GRUB4DOS are the only ones I know that do floppy emulation.
But then you have to do CD drive emulation too.
The way almost all ISO=>USB booters work is to pull the pieces apart and make them work without floppy+CD drive emulation. But this requires intimate knowledge of how that ISO normally boots, and thus it can't be a silver-bullet solution.
Heck MS's PSS would routinely have you use his tools even before the purchase because nothing they put out internally was nearly as useful.
Around the time MS hired Russinovich a lot of people on Slashdot were worried that it would mean the death of Sysinternals's tools, but what you say is why that argument was almost ridiculous: there'd have been open revolt within MS if that went down.
(I suppose they could have kept the tools internal to MS, but that didn't seem likely.)