Recovering a computer

About recovering a computer

^Back to top

If Windows fails to start or does not run normally, you can recover your computer using the Symantec Recovery Disk and an available recovery point.

Note:

If you can start Windows and the drive that you want to restore is a secondary drive (which is any drive other than your system drive, or the drive where your operating system is installed), you can restore the drive within Windows.

The Symantec Recovery Disk lets you run a recovery environment that provides temporary access to Norton Ghost recovery features. For example, you can access the Recover My Computer Wizard to restart the computer into its previous, usable state.

Note:

If you purchased Norton Ghost from your computer manufacturer, some features in the recovery environment might not be available. For example, if the manufacturer installed the recovery environment on your computer's hard disk. Your manufacturer might also assign a keyboard key for the purpose of starting the recovery environment.

When you restart your computer, watch for instructions on your computer monitor, or refer to your manufacturer's instructions.

Starting a computer by using the recovery environment

^Back to top

The Symantec Recovery Disk lets you start a computer that can no longer run the Windows operating system. The Symantec Recovery Disk is included with Norton Ghost. When you boot your computer using the SRD CD, a simplified version of Windows starts that runs a recovery environment. In the recovery environment, you can access the recovery features of Norton Ghost.

Note:

Depending on which version of the product you have purchased, the SRD is either included on your product CD, or as a separate CD. You should place the CD containing the SRD in a safe place. Should you lose the CD, you can create a new one if you have a CD burner. See If driver validation fails in the Norton Ghost™ User's Guide.

Note:

The recovery environment requires a minimum of 512 MB of RAM to run. If your computer's video card is configured to share your computer's RAM, you might need more than 512 MB of RAM.

To start your computer by using the Symantec Recovery Disk

  1. If you store your recovery points on a USB device, attach the device now (for example, and external hard drive).

    Note:

    You should attach the device before you restart the computer. Otherwise, the recovery environment might not detect it.

  2. Insert the Norton Ghost CD into the media drive of the computer.

    If Norton Ghost was installed by your computer manufacturer, the recovery environment already could be installed on your computer's hard drive. Either watch your computer monitor after the computer restarts for on-screen instructions, or refer to your manufacturer's documentation.

  3. Restart the computer.

    If you cannot start the computer from the CD, you might need to change the startup settings on your computer.

    Configuring your computer to boot from a CD

  4. As soon as you see the prompt “Press any key to boot from CD”, press a key to start the recovery environment.

    Note:

    You must watch for this prompt. It can come and go quickly. If you miss the prompt, you must restart your computer again.

  5. Read the license agreement, and then click Accept.

    If you decline, you cannot start the recovery environment, and your computer will restart.

Configuring your computer to boot from a CD

^Back to top

To run Symantec Recovery Disk, you must be able to start your computer using a CD.

To configure your computer to boot from a CD

  1. Turn on your computer.

  2. As the computer starts, watch the bottom of the screen for a prompt that tells you how to access the BIOS setup.

    Generally, you need to press the Delete key or a function key to start your computer's BIOS setup program.

  3. In the BIOS setup window, select Boot Sequence, and then press Enter.

  4. Follow the on-screen instructions to make the CD or DVD device be the first bootable device in the list.

  5. Put your SRD CD into the CD drive, and then restart your computer.

    Note:

    Depending on which version of the product you have purchased, the SRD is either included on your product CD, or as a separate CD. You should place the CD containing the SRD in a safe place. Should you lose the CD, you can create a new one if you have have a CD burner.

  6. Save the changes and exit the BIOS setup to restart the computer with the new settings.

  7. Press any key to start the recovery environment (Symantec Recovery Disk).

    When you start your computer with the SRD CD in the drive, you will see a prompt telling you to “Press any key to boot from CD”. If you do not press a key within five seconds, your computer will attempt to start from the next bootable device listed in the BIOS.

    Note:

    Watch carefully as the computer starts. If you miss the prompt, the computer will need to be restarted again.

Preparing to recover a computer

^Back to top

Before you start the recovery process, you should scan your computer for viruses. You can run this scan from the Symantec recovery environment. You can also scan your hard disk to check it for corrupted data or surface damage.

Scanning for viruses

^Back to top

If you suspect that your computer was damaged by a virus or other threat, you should run a virus scan before you restore your computer.

To scan for viruses

  1. On the Analyze panel, click Scan for Viruses.

  2. Select one of the following:

    Use the virus definitions currently available

    Select this option to use the definitions that are included on the Symantec Recovery Disk CD.

    Use Update Locator virus definitions folder

    Select this option if you downloaded the latest virus definitions to a disk.

    Locating the latest virus definitions

Locating the latest virus definitions

^Back to top

The Symantec Recovery Disk CD includes virus definitions. However, to help protect your computer from the latest threats, you should use the latest virus definitions that are available. The Update Locator locates the latest virus definitions that are available from Symantec. You must run the Update Locator on a working computer that has Internet access. You can save the virus definitions to a disk and then use them on the troubled computer.

Note:

Depending on which version of the product you have purchased, the SRD is either included on your product CD, or as a separate CD. You should place the CD containing the SRD in a safe place. Should you lose the CD, you can create a new one if you have a CD burner. See If driver validation fails in the Norton Ghost™ User's Guide.

To locate the latest virus definitions

  1. Insert the Symantec Recovery Disk CD into the media drive of the computer.

    The installation program should start automatically.

  2. If the installation program does not start, on the Windows taskbar, click Start > Run, type the following command, then click OK.

    <drive>:\autorun.exe

    where <drive> is the drive letter of your media drive.

    For Windows Vista, if the Run option is not visible, do the following:

    • Right-click the Start button, and click Properties.

    • On the Start Menu tab, click Customize.

    • Scroll down and check Run command.

    • Click OK.

  3. Click Run Update Locator.

  4. Click Find and retrieve virus definitions.

    If more recent virus definitions are not found, you can still scan for viruses on your damaged computer by using the virus definitions that are on the Symantec Recovery Disk CD. However, the computer might not be protected from new viruses or threats.

  5. When prompted, click OK.

  6. Do one of the following:

    • Insert a floppy disk into the floppy disk drive.

    • Insert a blank, writable CD or DVD into the computer's CD or DVD recordable drive.

  7. Locate the newly created Update Locator Virus Definitions folder on your computer's desktop and copy it to the blank disk.

Checking your hard disk for errors

^Back to top

If you suspect that your hard disk is damaged, you can examine it for errors.

To check your hard disk for errors

  1. In the Analyze panel, click Check Hard Disks for Errors.

  2. Select the drive that you want to check.

  3. Select any of the following options.

    Automatically fix file system errors

    Fixes errors on the selected disk. When this option is not selected, errors are displayed but are not fixed.

    Find and correct bad sectors

    Locates bad sectors and recovers readable information.

  4. Click Start.

Recovering a computer

^Back to top

You can restore your computer within the recovery environment. If you have a recovery point for the hard drives that you want to recover, you can fully recover your computer or other hard drive back to the state it was in when the recovery point was created.

To recover your computer

  1. Start the computer by using the Symantec Recovery Disk.

    Starting a computer by using the recovery environment

  2. On the Home panel, click Recover My Computer.

    Note:

    If your recovery points are stored on a CD or DVD and you only have one CD/DVD drive, you can eject the Symantec Recovery Disk CD now. Insert the CD or DVD that contains your recovery points.

  3. On the Welcome page of the wizard, click Next.

    If the Symantec Recovery Disk cannot locate any recovery points, you are prompted to locate one.

    Click View by, and then select one of the following options:

    Date

    Displays all of the discovered recovery points in the order in which they were created.

    If no recovery points were discovered, the table will appear empty. You should then choose one of the remaining View by options.

    Filename

    Lets you browse to another location, for example, an external (USB) drive or removable media to select a recovery point (.v2i) file.

    Select this option, and then do the following:

    • Click Browse, locate and select a recovery point (.v2i file), and then click Open.

    • If you select a network location, type your network credentials.

    • Click Finish.

    System

    Displays a list of all of the drives on your computer and shows any associated recovery points. You can also select a system index file (.sv2i).

    Select this option, and then do the following:

    • Click Browse, locate and select a recovery point (.sv2i), and then click Open.

    • If you select a network location, type your network credentials.

    • Check each recovery point that you want to recover.

      If necessary, add, change, or remove recovery points from the list.

    • Click Finish.

  4. Select the drive that you want to recover.

    If you are recovering your computer, select the drive on which Windows is installed. On most computer systems, this drive is the C drive. In the recovery environment, the drive letters and labels might not match what appears in Windows. You might need to identify the correct drive based on its label, the name assigned to it, or by browsing the files and folders in the recovery point.

    Recovering files and folders from the recovery environment

  5. If you need to delete a drive to make space available to restore your recovery point, click Delete Drive.

    When you click Delete Drive, the drive is only marked for deletion. The actual deletion of the drive takes place after you click Finish in the wizard.

    If you change your mind before you click Finish, go back to the Target Drive page of the wizard, and then click Undo Delete.

  6. Click Next, and then select the options that you want to perform during the recovery process, as follows:

    Verify recovery point before restore

    Verifies whether a recovery point is valid or corrupt it is restored.

    This option can significantly increase the time required for the recovery to complete.

    Check for file system errors after recovery

    Checks the restored drive for errors after the recovery point is restored.

    Resize restored drive

    Automatically expands the drive to occupy the target drive's remaining unallocated space.

    Partition type

    Sets the partition type as follows:

    • Primary partition: Because hard disks are limited to four primary partitions, select this type if the drive will have four or less partitions.

    • Logical partition: Select this type if you need more than four partitions. You can have up to three primary partitions, plus any number of logical partitions, up to the maximum size of your hard disk.

    Set drive active (for booting OS)

    Makes the restored drive the active partition (for example, the drive from which the computer starts).

    You should select this option if you are restoring the drive on which your operating system is installed.

    Restore original disk signature

    Restores the original, physical disk signature of the hard drive.

    Disk signatures are included in Windows Server 2003, Windows 2000 Advanced Server, and Windows NT Server 4.0 Enterprise Edition (SP3 and later). Disk signatures are required to use the hard drive.

    Select this option if either of the following situations are true:

    • Your computer's drive letters are atypical (for example, assigned letters other than C, D, E, and so forth).

    • You are restoring a recovery point to a blank hard drive.

    Restore Master Boot Record (MBR)

    Restores the master boot record. The master boot record is contained in the first sector of a physical hard disk. The MBR consists of a master boot program and a partition table that describes the disk partitions. The master boot program looks at the partition table of the first physical hard disk to see which primary partition is active. It then starts the boot program from the boot sector of the active partition.

    This option is recommended only for advanced users and is available only if you restore a whole drive in the recovery environment.

    Select this option if any of the following situations are true:

    • You are restoring a recovery point to a new, blank hard disk.

    • You are restoring a recovery point to the original drive, but the drive's partitions were modified since the recovery point was created.

    • You suspect that a virus or some other problem has corrupted your drive's master boot record.

    Preserve domain trust token on destination

    Preserves the token that is used to authenticate a user or a computer on a domain. This option helps ensure that a recovered computer is recognized by a network domain after it is recovered.

    The options that are available depend on the restore destination that you selected.

  7. Click Next to review the restore options that you selected.

  8. Check Reboot when finished if you want the computer to restart automatically after the recovery process finishes.

  9. Click Finish.

  10. Click Yes to restore the drive.

Restoring multiple drives by using a system index file

^Back to top

You can run the Recover My Computer wizard from the Symantec Recovery Disk to restore a computer that has multiple drives. This type of restore operation uses a system index file (.sv2i) to reduce the amount of time that is needed to restore the drives. When a recovery point is created, a system index file is saved with it. The system index file contains a list of the most recent recovery points, which includes the original drive location of each recovery point.

If you have suffered a catastrophic hard drive failure, you can also use Symantec Recovery Disk to perform a bare metal recovery of a computer.

To restore multiple drives using a system index file

  1. Start the computer by using the Symantec Recovery Disk.

    See Starting a computer by using the recovery environment .

    Drive letters in the recovery environment might not match those in the Windows environment.

  2. On the Home panel, click Recover My Computer.

  3. Click Next.

  4. Click View by, and then select System.

  5. Click Browse, locate and select a system file (.sv2i), and then click Open.

    The system index file is in the same location as the recovery point location.

  6. If you select a network location, type your network credentials.

  7. Check each recovery point that you want to recover.

    If necessary, add, change, or remove recovery points from the list.

  8. Click Finish.

Recovering files and folders from the recovery environment

^Back to top

You can use the Symantec Recovery Disk to start your computer and to restore files and folders from within a recovery point.

The recovery environment includes several support utilities that you can run to troubleshoot networking or hardware issues. For example, you can ping a computer, renew IP addresses, or get information about a hard-disk partition table.

To recover files and folders from the recovery environment

  1. Start the computer by using the Symantec Recovery Disk.

    See Starting a computer by using the recovery environment .

  2. Click Recover, and then click Recover My Files.

  3. Do one of the following:

    • If the Symantec Recovery Disk cannot locate any recovery points, you are prompted to locate one. In the Open dialog box, navigate to a recovery point, select one, and then click Open.

    • If the Symantec Recovery Disk finds recovery points, select a recovery point from the list, and then click OK.

    Note:

    If you have trouble finding the recovery points in a network location, in the File name box, type the name of the computer and share that holds your recovery points. For example, \\computer_name\share_name.

    If you are still having problems, try entering the computer's IP address.

    Using the networking tools in the recovery environment .

  4. In the tree view pane of the Recovery Point Browser, double-click the drive that contains the files or folders that you want to restore to expand it.

  5. In the content pane of the Recovery Point Browser, do one of the following to select the files or folders that you want to restore.

    To select all items

    Press Ctrl+A.

    To select a group of files that are next to each other

    Select the top file, press Shift, and then select the last file in the list.

    To select a group of files that are not next to each other

    Press Ctrl as you select the files.

  6. Click Recover Files.

    Where possible, the Recover Items dialog box automatically completes the Restore to this folder box with the original path from which the files originated.

    If the original location does not include a drive letter you must type the drive letter at the beginning of the path.

    Note:

    While in the recovery environment, drive letters and labels might not match what appears in Windows. You might have to identify the correct drive based on its label, which is the name assigned to it.

  7. If the original path is unknown or you want to restore the selected files to a different location, click Browse to locate the destination.

  8. Click Recover to restore the files.

  9. Click OK to finish.

Exploring your computer

^Back to top

You can explore the files and folders on your computer from the recovery environment by using the Explore My Computer feature.

This feature uses the Recovery Point Browser and functions similarly to Windows Explorer. You can browse the file structure of any drive that is attached to your computer from the recovery environment.

To explore your computer

  • In the Analyze pane, click Explore My Computer.

Using the networking tools in the recovery environment

^Back to top

If you store your recovery points on a network, you need access to the network to restore your computer or your files and folders from the recovery environment.

Note:

Additional computer memory might be required to recover your computer across a network.

Starting networking services

^Back to top

If you need to start networking services, you can do so manually.

To start networking services

Using the pcAnywhere thin host for a remote recovery

^Back to top

The Symantec Recovery Disk includes a pcAnywhere thin host, which lets you remotely access a computer in the recovery environment. The pcAnywhere thin host contains the minimum settings that are needed to support a single-use remote control session. The thin host requires an IP address for hosting a remote control session.

Note:

You cannot deploy a thin host to the recovery environment. The thin host can only be started from Symantec Recovery Disk to host a remote control session in the recovery environment. The thin host in Symantec Recovery Disk does not support file transfers and cannot be used to add drivers for network or storage devices.

To start the pcAnywhere thin host

^Back to top

After you start the thin host from the Symantec Recovery Disk, it waits for a connection from a remote computer. You can connect to the thin host to remotely manage a recovery or to perform other tasks in the recovery environment. You must use Symantec pcAnywhere to connect to the thin host.

To start the pcAnywhere thin host

  • On either the Home or Network panels in the recovery environment, click Start the pcAnywhere Thin Host.

    The networking services are started if necessary. The thin host waits for a connection.

Remotely connecting to the thin host

^Back to top

Symantec pcAnywhere lets you remotely connect to a computer that is running in the recovery environment. The computer must be running the pcAnywhere thin host that is included in the Symantec Recovery Disk, and it must be waiting for a connection. Once connected, the client computer can remotely manage a recovery or perform other tasks that are supported in the recovery environment.

Note:

The client computer cannot transfer files or add additional drivers for network or storage devices on the computer that is running the thin host.

To remotely connect to the thin host

  1. Ensure that the computer to be remotely managed (the host) has started in the recovery environment and that the pcAnywhere thin host is waiting for a connection.

  2. Obtain the IP address of the thin host computer.

  3. On the client computer, in Symantec pcAnywhere, configure a remote connection item.

    For more information, see the Symantec pcAnywhere User's Guide.

    Note:

    You do not need to choose to automatically login to the host on connection.

  4. When you configure the connection in pcAnywhere, do the following:

    • Select TCP/IP as the connection type.

    • Specify the IP address of the host computer.

    • Choose to automatically login to the host on connection.

      If you do not include the login information, you are prompted for it when you connect to the thin host.

    • Type the following login name:

      symantec

    • Type the following password:

      recover

    The thin host shuts down when there is an attempt to connect by using any incorrect configuration settings.

    To prevent unauthorized users from tampering with your settings or launching a session without your permission, set a password for your remote connection item.

    This option is available in the Remote Properties window on the Protect Item tab. The thin host does not support encryption.

  5. In pcAnywhere, start the remote control session.

    If the connection attempt is unsuccessful, the thin host must be restarted on the host computer before you make another attempt to connect.

  6. Remotely perform the necessary tasks on the host computer.

    The remote control session ends when the thin host is closed, when the thin host computer is restarted, or when the remote control session is ended.

    After the host computer starts Windows, the client computer can deploy and connect a thin host on the computer to verify the success of tasks that were performed in the recovery environment.

Mapping a network drive in the recovery environment

^Back to top

If you started the networking services after you started the recovery environment, you must map a network drive. This lets you browse to that drive and select the recovery point that you want to restore.

If there is no DHCP server or the DHCP server is unavailable, you must provide a static IP address and a subnet mask address for the computer on which you are running Symantec Recovery Disk.

Configuring network connection settings

After you provide the static IP address and subnet mask address, you can enter the recovery environment. However, because there is no way to resolve computer names, when you run the Recover My Computer Wizard or the Recovery Point Browser, you can only browse the network by using the IP addresses to locate a recovery point. You can map a network drive so that you can locate the recovery points more effectively.

To map a network drive in the recovery environment

  1. In the recovery environment main window, click Network, and then click Map a network drive.

  2. Map a network drive by using the UNC path of the computer on which the recovery point is located.

    For example: \\computer_name\share_name or \\IP_address\share_name

Configuring network connection settings

^Back to top

You can access the Network Configuration window to configure basic network settings while running in the recovery environment.

To configure network connection settings

  1. In the recovery environment main window, click Network, and then click Configure Network Connection Settings.

  2. If you are prompted to start networking services, click Yes.

Getting a static IP address

^Back to top

If you want to restore a recovery point that is located on a network drive or share, but you are unable to map a drive or browse to the drive/share on the network (usually caused by the lack of an available DHCP service), you can assign a unique static IP address to the computer that is running the recovery environment. You can then map to the network drive or share.

To get a static IP address

  1. In the Network Adapter Configuration box, click Use the following IP address.

  2. Specify a unique IP address and subnet mask for the computer that you want to restore.

    Be sure that the subnet mask matches the subnet mask of the network segment.

  3. Click OK.

  4. Click Close to return to the recovery environment's main menu.

  5. In the Network pane, click Ping a Remote Computer.

  6. Type the address of the computer that you want to ping on the network segment.

  7. Click OK.

    If you specified a computer name or a computer name and domain as the address method, make note of the IP address that is returned from the computer that you pinged.

    If communication to the storage computer is operating as expected, you can use the Map Network Drive utility to map a drive to the recovery point location.

Getting a static IP address if the ping is unsuccessful

^Back to top

If you ping an address and the address does not respond, you can use the ipconfig /all command to determine the correct IP address.

To get an IP address if the ping is unsuccessful

  1. On the computer that contains the recovery point that you want to restore, at a DOS prompt, type the following command, and then press Enter.

    ipconfig /all

  2. Write down the IP address that is displayed.

  3. Return to the computer that is running the recovery environment and run the utility Ping Remote Computer with this IP address.

Viewing properties of recovery points and drives

^Back to top

You can view the properties of recovery points and the drives that are contained in them.

Viewing properties of a recovery point

^Back to top

You can view various properties of a recovery point by using the Recovery Point Browser. The following properties are available for viewing:

Description

A user-assigned comment associated with the recovery point

Size

The total size (in megabytes) of the recovery point

Created

The date and time that the recovery point file was created

Compression

The compression level that is used in the recovery point

Spanned

Whether the entire recovery point file is spanned over several files

Password protected

The password protection status of the selected drive

Encryption

The encryption strength that is used with the recovery point

Format

The format of the recovery point

Computer name

The name of the computer on which the recovery point was created

Catalogued

If you enabled search engine support for the recovery point, this property is displayed.

Created by

Identifies the application (Norton Ghost) that was used to create the recovery point.

To view the properties of a recovery point

  1. In the Recovery Point Browser, in the tree panel, select the recovery point that you want to view.

  2. Do one of the following:

    • On the File menu, click Properties.

    • Right-click the recovery point, and then click Properties.

Viewing the properties of a drive within a recovery point

^Back to top

You can view the following properties of a drive within a recovery point:

Description

A user-assigned comment associated with the recovery point.

Original drive letter

The original drive letter that was assigned to the drive.

Cluster size

The cluster size (in bytes) that is used in a FAT, FAT32, or NTFS drive.

File system

The file system type that is used within the drive.

Primary/Logical

The selected drive's drive status as either the primary partition or the logical partition.

Size

The total size (in megabytes) of the drive.

This total includes used and unused space.

Used space

The amount of used space (in megabytes) within the drive.

Unused space

The amount of unused space (in megabytes) within the drive.

Contains bad sectors

Indicates if there are any bad sectors on the drive.

To view the properties of a drive within a recovery point

  1. In the Recovery Point Browser, in the tree panel, double-click the recovery point that contains the drive that you want to view.

  2. Select a drive.

  3. Do one of the following:

    • On the menu bar, click File > Properties.

    • Right-click the recovery point, and then click Properties.

About the Support Utilities

^Back to top

The recovery environment has several support utilities that Symantec Technical Support might ask you to use to troubleshoot any hardware issues that you encounter.

You might be required to supply the information that is generated by these utilities if you call Symantec Technical Support for help resolving problems.

Note:

You should only use these tools as directed by Symantec Technical Support.