Reboot Insurance

BootBack's snapshot images help you keep systems running despite fatal crashes or other interruptions.

• By Erik Westgard
• November 01, 2005

These pumping-station logging systems are the essence of mission-critical. There are safety and regulatory compliance issues if the log files are lost, damaged or interrupted. The sensors also have limited internal storage, so the servers recording the data have to run all the time or be restored immediately after an outage to maintain a continuous record.

"There was no data network across the permafrost between the living quarters and the servers up there, so if there was a problem, I had to get up in the dark and minus-85-degree cold and drive several miles to restore the servers," Lear says. This "commute" prompted him to give the NTFS file system a serious examination. It also led him to develop tools that could take "snapshots" of the Windows 2000 system image to which he could revert quickly and efficiently. (He is the original developer of the imaging code used in BootBack and now the CTO of Leapfrog Software.)

When he was developing what would ultimately become BootBack, Lear evaluated clustering, RAID and other techniques. He eventually decided to write his own code to capture and store static system images. The BootBack software captures all or selected portions of the Windows file system. Then it stores and labels that image as a snapshot. If there is a failure or if you need to turn back the clock to an earlier system state for whatever reason, you (or the system running automatically) can easily and quickly boot to a previous snapshot image.

The core code Lear developed is now distributed through several partners, including Raxco under the ISR First Defense Label (reviewed in Redmond in March 2005). The only problem I saw in my earlier review of FirstDefense ISR was that while you can recover from software corruption, you aren't protected from disk crashes. In those instances, you have to rely on system backups or other techniques, as you can't store snapshots offline. In BootBack, there's an added feature that lets you store snapshots offline or in an archive.

One advantage of snapshots—as opposed to "live" mirroring and recovery—is that there isn't an ongoing performance hit. Once you copy the snapshot image from the running system, it's done. On my Windows 2003 test system, a basic snapshot was about 3GB and took 45 minutes to produce.

Freeze Frame
BootBack has another feature called Freeze, which lets you take a system snapshot and automatically return to it at reboot or after a crash. This works well in libraries, hotel lobbies, airports and kiosks anywhere, where publicly accessible machines can often crash or accumulate viruses and worms over time. How many times have you walked by a kiosk system showing a crash diagnostic screen? The idea is that you boot back to the same image the next morning, without any of the file corruption, viruses or malware you picked up during the day.

Because you can hide the BootBack images from non-administrative users, one concern is ensuring that you keep your frozen snapshot up-to-date with the latest security patches. BootBack also has a remote control and remote access feature that's very helpful for updating your kiosk or remote applications. You can go by Microsoft's patch release schedule to help manage and schedule updates.

You can also use the Freeze feature as the ultimate "uninstall" routine. If you don't like an application, you can boot to an earlier snapshot and it's gone, including all registry traces and so on. I tried loading up a copy of Adobe Acrobat Reader and then rebooted to a frozen snapshot and it was gone. Freeze can also be helpful for cleaning out particularly nasty instances of spyware. Some of this functionality is, of course, available in Windows XP with Microsoft System Restore, but it's more difficult to do in the server operating system.

Figure 1. Bootback lets you store different snapshot images, including details about those images like date of creation, file size and so on. (Click image to view larger version.)

BootBack also supports data anchoring, a term I find a bit confusing and counter-intuitive. The idea is that BootBack includes everything (except temporary files) on the disk in the main file system when it copies a snapshot. If you anchor files or directories, those are not copied over. So if you anchor the "My Documents" folder while booting a previous snapshot, your data is still there and accessible after rebooting. I find it easier to think of that concept as "data ignoring," where you can reload and restore to an earlier system image and the data is still out there.

Looking at the long list of recurring help desk and system administration nightmares, recovery from an unbootable system or even a corrupted image is definitely near the top for me. BootBack is a helpful tool to consider for resolving those nightmares, particularly for special applications like public-access computers, kiosks and, yes, even mission-critical data logging.