TECHNOTE.TXT - Disaster Recovery Procedure for Backup Exec V5.0
Copyright 1994, Arcada Software, Inc.


    DISASTER RECOVERY OF A WINDOWS NT/NTAS COMPUTER USING
                  BACKUP EXEC FOR WINDOWS NT

These procedures will step you through a complete restoration of the
   Windows NT operating system and are helpful in the following
   instances:

-  The Emergency Repair Diskette cannot revive Windows NT back to an
   acceptable state.
-  An unrecoverable hard drive error has occurred that requires you to
   reformat the disk that contains the Windows NT operating system.
-  Replacing the hard drive that contains the Windows NT operating
   system.


SINGLE COMPUTER PROCEDURE
~~~~~~~~~~~~~~~~~~~~~~~~~
This procedure requires that a Tape Drive is attached to the computer
   to be recovered.  The items you will need are:

-  A current Full Backup of your system and any subsequent
   Incremental/Differential backups.
-  The Windows NT installation disks.
-  The Backup Exec for Windows NT installation disks.

Note: Always log in to Windows NT using the Administrator account (or
      an Administrator equivalent) during this procedure.

Follow these steps:

1. Reinstall Windows NT.  This Windows NT installation will be
   overwritten by your backed up version.  If you are recovering from
   an entire hard disk failure, select to partition and format the
   new disk during Windows NT's setup.  Remember to format the
   partitions with the same File System as before the failure.

2. Install Backup Exec for Windows NT.

3. Using Windows NT Setup, install the Tape Driver necessary for the
   tape drive you have attached.

4. Shutdown and restart the computer (to load the Tape Driver).

5. Start Backup Exec.

6. Insert the latest Full backup tape of the computer to be recovered
   and fully catalog it.  If the subsequent Differential/Incremental
   backups are on a different tape, insert it now and fully catalog
   it also.

7. Select all sets from the Full and Incremental backups that contain
   logical drives on the hard disk.  If Differential backup sets are
   to be restored, only the last Differential set (the newest) needs
   to be selected.

8. Click Restore.  Select the "Restore Registry" switch and ensure
   that the "Restore To Drive:" field is correct.  If the target
   drive is a NTFS partition, select the "Restore File Permissions"
   switch.  If more than one set is being restored, scroll through
   each of the backup sets and select the same switches (if only one
   set was selected, no scroll bar will appear).  While scrolling
   through the sets, ensure that the sets are in chronological order
   (oldest to newest) with the Full Backup set first.

9. Click OK to start the restore.  If prompted to restore over
   existing data, select Yes To All.

10. Shutdown and restart the computer.

11. If there are any filenames starting with REG or USE followed by
    five (5) alphanumeric symbols (e.g., REG84E64, USE491HD.log, etc.)
    left in the \WinNT\System32\Config directory, you may delete them
    now.

The recovery procedure is now complete.



REMOTE COMPUTER PROCEDURE
~~~~~~~~~~~~~~~~~~~~~~~~~
This remote computer procedure uses Backup Exec over a network to
   revive a Windows NT computer.  This procedure requires that Backup
   Exec for Windows NT is running on a Windows NT computer with an
   attached tape drive and is networked with the Windows NT computer
   to be recovered.  The items you will need are:

 - A current Full Backup of the computer to be recovered and any
   subsequent Incremental/Differential backups.
 - The Windows NT installation disks.

Note: Always log in to Windows NT using the Administrator account (or
      an Administrator equivalent) during this procedure.

Follow this step on the computer to be recovered:
1. Reinstall Windows NT - This Windows NT installation will be
   overwritten by your backed up version.  If you are recovering from
   an entire hard disk failure, select to partition and format the
   new disk during Windows NT's setup.  Remember to format the
   partitions with the same File Systems as before the failure.

Follow these steps on the Remote Windows NT Computer:
1. Start Backup Exec for Windows NT.

2. Insert the latest full backup tape of the computer to be recovered
   and fully catalog it.  If the subsequent Differential/Incremental
   backups are on a different tape, insert it now and fully catalog
   it also.

3. Select all sets from the Full and Incremental backups that contain
   logical drives from the hard disk.  If Differential backup sets
   are to be restored, only the last Differential set (the newest)
   needs to be selected.

4. Connect a Network Drive to the administrative share of the computer
   to be recovered (e.g., C$) using the Administrator account on the
   computer to be recovered.  If more than one logical drive is being
   restored, connect Network Drives to the administrative shares of
   these drives also.  If you want to connect to a user created
   share, it must be shared at the root directory of the drive and
   have Full Access permissions.

   To connect to an administrative share in Backup Exec:
     a. Under the Operations menu, select Connect Network
        Drive.
     b. In the "Path:" field, type in the computer name and
        the administrative share name of the computer to be
        recovered, (e.g., \\ComputerName\C$).
     c. In the "Connect As:" field, type in "Administrator".
     d. Click OK
     e. If prompted, type in the password of the
        Administrator account for the computer to be
        recovered.

Note: On Administrative shares, Windows NT creates an administrative
      share for each local drive on the computer during bootup.  The
      names of these shares are simply the drive letter and a dollar
      sign (e.g., C$, D$, E$, etc.).  Each of these are shared at the
      root directory of their respective drive.  For security purposes,
      only members of the Administrators, Backup Operators, or Server
      Operators group may attach to these shares.  These shares are not
      shown in the "Connect Network Drive" window in Backup Exec or File
      Manager, so you must manually type in the name of the computer and
      share name in the "Path" field (e.g., \\ComputerName\C$).

5. Click Restore.  Select the correct Network Drive in the "Restore To
   Drive:" field and ensure the "Restore Registry" switch is NOT
   selected.  If the target drive is a NTFS partition, select the
   "Restore File Permissions" switch.  If more than one set is being
   restored, scroll through each of the backup sets and select the
   same switches (if only one set was selected, no scroll bar will
   appear).  While scrolling through the sets, ensure that the sets
   are in chronological order (oldest to newest) with the Full Backup
   set first.

6. Click OK to start the restore.  If prompted to restore over
   existing data, select Yes To All.


Follow this step on the computer to be recovered:
1. Shutdown and restart the computer once the restore has completed.

Follow these steps on the Remote Windows NT Computer:
1. Using the same Full and Incremental/Differential backup sets you
   just restored from, select ONLY the \WinNT\System32\Config
   directory from each set that contains the active Windows NT
   operating system.

2. Press Restore.  Select the "Restore Registry" switch and the
   correct Network Drive in the "Restore To Drive:" field.  If the
   target drive is a NTFS partition, select the "Restore File
   Permissions" switch.  If more than one set is being restored,
   scroll through each of the other backup sets and select the same
   switches (if only one set was selected, no scroll bar will
   appear).  While scrolling through the sets, ensure that the sets
   are in chronological order (oldest to newest) with the Full Backup
   set first.

3. Press OK to start the restore.  If prompted to restore over
   existing data, select "Yes To All".

Follow these steps on the computer to be recovered:
1. Shutdown and restart the computer once the restore has completed.

2. If there are any filenames starting with REG or USE followed by
   five (5) alphanumeric symbols (e.g., REG84E64, USE491HD.log) left
   in the \WinNT\System32\Config directory, you may delete them now.

The recovery procedure is now complete.


DOUBLE BOOT EXPLANATION
     When Backup Exec restores files that are open, it restores them
as filenames starting with USE followed by five (5) alphanumeric
symbols.  Then, Backup Exec makes a call to Windows NT to tell the
operating system to rename these files to their "real" names at the
next boot up (this instruction is stored in the registry).  Likewise,
when Backup Exec restores Registry files, it restores them as
filenames starting with REG followed by five (5) alphanumeric symbols
and it tells the operating system to rename these files at the next
boot up.  If open files and registry files are restored at the same
time, an additional call to Windows NT is made to attach the list of
files that need to be renamed at boot up to the newly restored
registry.  This is necessary so that when the registry files are
switched at boot up, Windows NT will not 'forget' to rename the other
open files during the bootup sequence.  This process works fine during
local restores.  However, during remote restores, the call for Windows
NT to attach the list of open files to the newly restored registry on
the remote computer fails, and the computer 'forgets' to rename the
files at the next bootup.  For this reason, the remote restore is
split into two operations:
     -Restore the open files
     -Restore the Registry files

This problem has been reported to Microsoft and should be fixed in
   Windows NT v3.51.
