Microsoft Operating System Forum

Bob Gezelter

We have encountered a problem using the restore procedure using NTBACKUP.
Following the install of Windows 2000 from the original disk, booting the
system in SAFE mode, and then doing a restore of a NTBACKUP backup file onto
the C: partitiion, the IP stack is non-functional (NDISWAN.SYS fails with
Error 10; and it is not possible to properly configure the PCMCIA XIRCOM
10/100 Ethernet card).

The PCMCIA card works correctly BEFORE the restore of the backup image. The
original Windows 2000 restore has been tried with/without the XIRCOM card
inserted.

A Windows 2000 Professional mobile suffered what appears to be damage to the
secondary bootstrap during a SCANDISK operation to check for bad sectors. As
a precaution, the drive was forensically imaged (using EnCase(r) software)
without problems. Fortunately, most (but not all) of the user data was on
partitions other than C: and apparently unaffected.

To preserve the original drive for examination, a replacement 140 GB drive
was purchased, and the forensic backup restored to the drive. The C: drive
was not bootable. Using the original CDROM, the system was booted, and
Windows 2000 was installed from scratch on the C: partition. The system was
then rebooted, and BACKUP was used to refresh the C: partition from a backup
that was taken about six months ago (there are only a few newer files on the
system partition, and they can be recovered from the forensic image).

When the system is rebooted following the restore operation, all settings
appear to have been recovered, except that the network stack is unusable.

We have done this type of recovery in the past without any problems. We have
seen problems like this when restoring images to machines other than the
machine that the backup was taken on, but never on the very same system when
switching drives.

This is not a forward looking situation, so comments along the lines of "use
GHOST, ACRONIS, etc." are not particularly productive.

Thanks you for taking the time to review this posting.

- Bob Gezelter, http://www.rlgsc.com

[Note, this was previously posted to the Windows XP Forum, as I did not
notice that Windows2000 was abbreviated as Win2000.]

Pegasus \(MVP\)

"Bob Gezelter" <BobGezelter@discussions.microsoft.com> wrote in message
news:5263EC5F-F543-47C9-A555-28E8F1B715AD@microsoft.com...
> We have encountered a problem using the restore procedure using NTBACKUP.
> Following the install of Windows 2000 from the original disk, booting the
> system in SAFE mode, and then doing a restore of a NTBACKUP backup file
> onto
> the C: partitiion, the IP stack is non-functional (NDISWAN.SYS fails with
> Error 10; and it is not possible to properly configure the PCMCIA XIRCOM
> 10/100 Ethernet card).
>
> The PCMCIA card works correctly BEFORE the restore of the backup image.
> The
> original Windows 2000 restore has been tried with/without the XIRCOM card
> inserted.
>
> A Windows 2000 Professional mobile suffered what appears to be damage to
> the
> secondary bootstrap during a SCANDISK operation to check for bad sectors.
> As
> a precaution, the drive was forensically imaged (using EnCase(r) software)
> without problems. Fortunately, most (but not all) of the user data was on
> partitions other than C: and apparently unaffected.
>
> To preserve the original drive for examination, a replacement 140 GB drive
> was purchased, and the forensic backup restored to the drive. The C: drive
> was not bootable. Using the original CDROM, the system was booted, and
> Windows 2000 was installed from scratch on the C: partition. The system
> was
> then rebooted, and BACKUP was used to refresh the C: partition from a
> backup
> that was taken about six months ago (there are only a few newer files on
> the
> system partition, and they can be recovered from the forensic image).
>
> When the system is rebooted following the restore operation, all settings
> appear to have been recovered, except that the network stack is unusable.
>
> We have done this type of recovery in the past without any problems. We
> have
> seen problems like this when restoring images to machines other than the
> machine that the backup was taken on, but never on the very same system
> when
> switching drives.
>
> This is not a forward looking situation, so comments along the lines of
> "use
> GHOST, ACRONIS, etc." are not particularly productive.
>

Why not? I found ntbackup to be a cumbersome tool when attempting to restore
whole installations, so my pragmatic response is precisely what you call
"not particularly productive".

About your current problem: I would probably uninstall each and every
network component, then reinstall them.

Dave Patrick

Did you enable 48-Bit LBA before doing the restore? Have you applied service
pack and updates prior to restoring?

http://support.microsoft.com/kb/305098

http://support.microsoft.com/kb/303383

Looks like the service pack and this hotfix should have been applied both
before the backup was made and before the system state restore.

http://support.microsoft.com/kb/810161





--

Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect


"Bob Gezelter" wrote:
> We have encountered a problem using the restore procedure using NTBACKUP.
> Following the install of Windows 2000 from the original disk, booting the
> system in SAFE mode, and then doing a restore of a NTBACKUP backup file
> onto
> the C: partitiion, the IP stack is non-functional (NDISWAN.SYS fails with
> Error 10; and it is not possible to properly configure the PCMCIA XIRCOM
> 10/100 Ethernet card).
>
> The PCMCIA card works correctly BEFORE the restore of the backup image.
> The
> original Windows 2000 restore has been tried with/without the XIRCOM card
> inserted.
>
> A Windows 2000 Professional mobile suffered what appears to be damage to
> the
> secondary bootstrap during a SCANDISK operation to check for bad sectors.
> As
> a precaution, the drive was forensically imaged (using EnCase(r) software)
> without problems. Fortunately, most (but not all) of the user data was on
> partitions other than C: and apparently unaffected.
>
> To preserve the original drive for examination, a replacement 140 GB drive
> was purchased, and the forensic backup restored to the drive. The C: drive
> was not bootable. Using the original CDROM, the system was booted, and
> Windows 2000 was installed from scratch on the C: partition. The system
> was
> then rebooted, and BACKUP was used to refresh the C: partition from a
> backup
> that was taken about six months ago (there are only a few newer files on
> the
> system partition, and they can be recovered from the forensic image).
>
> When the system is rebooted following the restore operation, all settings
> appear to have been recovered, except that the network stack is unusable.
>
> We have done this type of recovery in the past without any problems. We
> have
> seen problems like this when restoring images to machines other than the
> machine that the backup was taken on, but never on the very same system
> when
> switching drives.
>
> This is not a forward looking situation, so comments along the lines of
> "use
> GHOST, ACRONIS, etc." are not particularly productive.
>
> Thanks you for taking the time to review this posting.
>
> - Bob Gezelter, http://www.rlgsc.com
>
> [Note, this was previously posted to the Windows XP Forum, as I did not
> notice that Windows2000 was abbreviated as Win2000.]

Bob Gezelter

Dave,

Thank you. I had not downloaded and installed the Service Pack BEFORE
restoring system state. I had presumed, apparently incorrectly, that
restoring EVERYTHING including system state would completely restore the
system to the state at the time of the backup.

Doing the Service Pack before the restore did the trick. A few applications
(e.g. WORD) required a refresh from CD-ROM, but the system appears to be
functional again.

Thank you for the assist!

- Bob

"Dave Patrick" wrote:

> Did you enable 48-Bit LBA before doing the restore? Have you applied service
> pack and updates prior to restoring?
>
> http://support.microsoft.com/kb/305098
>
> http://support.microsoft.com/kb/303383
>
> Looks like the service pack and this hotfix should have been applied both
> before the backup was made and before the system state restore.
>
> http://support.microsoft.com/kb/810161
>
>
>
>
>
> --
>
> Regards,
>
> Dave Patrick ....Please no email replies - reply in newsgroup.
> Microsoft Certified Professional
> Microsoft MVP [Windows]
> http://www.microsoft.com/protect
>
>
> "Bob Gezelter" wrote:
> > We have encountered a problem using the restore procedure using NTBACKUP.
> > Following the install of Windows 2000 from the original disk, booting the
> > system in SAFE mode, and then doing a restore of a NTBACKUP backup file
> > onto
> > the C: partitiion, the IP stack is non-functional (NDISWAN.SYS fails with
> > Error 10; and it is not possible to properly configure the PCMCIA XIRCOM
> > 10/100 Ethernet card).
> >
> > The PCMCIA card works correctly BEFORE the restore of the backup image.
> > The
> > original Windows 2000 restore has been tried with/without the XIRCOM card
> > inserted.
> >
> > A Windows 2000 Professional mobile suffered what appears to be damage to
> > the
> > secondary bootstrap during a SCANDISK operation to check for bad sectors.
> > As
> > a precaution, the drive was forensically imaged (using EnCase(r) software)
> > without problems. Fortunately, most (but not all) of the user data was on
> > partitions other than C: and apparently unaffected.
> >
> > To preserve the original drive for examination, a replacement 140 GB drive
> > was purchased, and the forensic backup restored to the drive. The C: drive
> > was not bootable. Using the original CDROM, the system was booted, and
> > Windows 2000 was installed from scratch on the C: partition. The system
> > was
> > then rebooted, and BACKUP was used to refresh the C: partition from a
> > backup
> > that was taken about six months ago (there are only a few newer files on
> > the
> > system partition, and they can be recovered from the forensic image).
> >
> > When the system is rebooted following the restore operation, all settings
> > appear to have been recovered, except that the network stack is unusable.
> >
> > We have done this type of recovery in the past without any problems. We
> > have
> > seen problems like this when restoring images to machines other than the
> > machine that the backup was taken on, but never on the very same system
> > when
> > switching drives.
> >
> > This is not a forward looking situation, so comments along the lines of
> > "use
> > GHOST, ACRONIS, etc." are not particularly productive.
> >
> > Thanks you for taking the time to review this posting.
> >
> > - Bob Gezelter, http://www.rlgsc.com
> >
> > [Note, this was previously posted to the Windows XP Forum, as I did not
> > notice that Windows2000 was abbreviated as Win2000.]
>
>

Dave Patrick

Good to hear. You're welcome.



--

Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect


"Bob Gezelter" wrote:
> Dave,
>
> Thank you. I had not downloaded and installed the Service Pack BEFORE
> restoring system state. I had presumed, apparently incorrectly, that
> restoring EVERYTHING including system state would completely restore the
> system to the state at the time of the backup.
>
> Doing the Service Pack before the restore did the trick. A few
> applications
> (e.g. WORD) required a refresh from CD-ROM, but the system appears to be
> functional again.
>
> Thank you for the assist!
>
> - Bob