unix

David Farquhar is a computer security professional, entrepreneur, and author. He has written professionally about computers since 1991, so he was writing about retro computers when they were still new. He has been working in IT professionally since 1994 and has specialized in vulnerability management since 2013. He holds Security+ and CISSP certifications. Today he blogs five times a week, mostly about retro computers and retro gaming covering the time period from 1975 to 2000.

Trolling the web for nothing in particular

Dave Farquhar Linux February 19, 2002November 3, 2025Bob Costas, Bud Selig, debian, eye candy, hp, jetdirect card, Major League, Major League Baseball, red hat, Red Hat Linux, spam, unix

Yes, Brian, baseball will soon return. I hate the things Major League Baseball does (Bob Costas once likened choosing sides between the players and the owners to choosing sides between Iran and Iraq), but we’ve chosen to stay together for the kids. I’m sure everyone who cares (and some who don’t) can guess what I think of Bud Selig, but I’ll tell you anyway, soon enough.
In the meantime, I look like Ars Technica today. Oh well. I don’t do this very often.

Blogging. Wired News had its take on the phenomenon, and threw out some interesting stats.

In January alone, at least 41,000 people created new blogs using Blogger, and that number is always increasing, [Blogger founder Evan] Williams said. Some have put the total number of weblogs at more than 500,000.

Alongside the boom, however, there have recently been a few faint signs of backlash. As increasing hordes take on the task of trying to keep new sites looking nice, sounding original and free from banalities, more hordes just seem to fail.

Blog critic Dave Linabury offered a recipe for success:

“It really can take a lot of time,” he said. “I spend two hours a day on my weblog. Many people don’t realize this, they think it’s a quick way to get popular. And after awhile they get really discouraged and say, ‘he got 2,300 hits today, I got four.’ The bulk of people out there get less than two dozen hits.”

“I don’t want to be elitist,” Linabury added, “but all these people out there with popular weblogs, they’ve been doing it longer and they stick to their guns.”

I can attest to that. The people who get more traffic than I get almost all have been doing this longer. But I can tell you one thing: It’s never enough. Back when I was getting 80 visits a day I wanted 150. When I was getting 150 visits a day, I wanted 250. Now that I get about 500 visits a day, I’m awfully distressed to see people are getting 2,300. And by the time I reach 2,300, I’m sure there will be people getting 5,000 or even 10,000. (Note that visits are the number of unique visitors; hits are the number of files served up. Hit count is deceptive. I get 500 visits per day but closer to 1,000 or even 1,500 hits per day, due to people visiting, reading comments, and then often reading something from a previous week. And if they do a search, that’s at least two additional hits.)

Another feather in Internet Explorer’s cap. To my knowledge, no new security vulnerabilities have been reported in Internet Explorer this week, but the newest security patch, released last week, contains a bug that can cause a VBscript directive that previously worked to crash the browser.

Microsoft says Webmasters need to modify their pages not to use the directive.

That’s nice (I don’t use VBscript on this site) but there are embedded devices, such as HP’s JetDirect card, that use the directive. So early adopters of this patch may find themselves unable to do their jobs.

Better webmaster recommendation: Don’t use VBscript or ActiveX or other Microsoft-owned languages in your Web pages at all. Better end-user recommendation: Use Mozilla or a derivative instead of Internet Explorer.

Recompiling Debian for your hardware. This thread comes up every so often, and with the popularity of Linux From Scratch and Gentoo, the appeal of a compiled-from-scratch Debian is undeniable. But does the small speed improvement offset the increased difficulty and time in upgrading?

The consensus seems to be that recompiling gzip, bzip2, and gnupg with aggressive options makes sense, as does recompiling your kernel. Recompiling XFree86 may also make some sense. But expending time and energy in the perfectly optimized versions of ls and more is foolhardy. (Especially seeing as speed demons can just get assembly language versions of them from www.linuxassembly.org.)

A Guide to Debian. This is a guide, still incomplete, that gives a number of tips for someone who’s just installed Debian. The tips are applicable to other many other Linux (and even Unix) flavors as well.

Spam. A coworker walked into my cube today and asked me how he could keep web robots from harvesting e-mail addresses from his web site. I found myself referring once again to the definitive piece on the subject, from Brett Glass (who gets my nomination for the greatest computer columnist of all time, for what that’s worth).

The RULE project. A project has emerged to bring Red Hat Linux back to its roots, and allow it to run on older, less-powerful hardware.

From their site:

This install option is meant to benefit primarily two classes of users:

* GNU/Linux newbies who cannot afford modern computers, but still need, to get started more easily, an up to date, well documented distribution.
* System administrators and power users who have no interest in eye candy, and want to run updated software on whatever hardware is available, to minimize costs, or just because it feels like the right thing to do.

I love their FAQ. Check this out:

1.0 Hardware is so cheap today, why bother?

1. This is a very limited and egoistic attitude. Eigthy per cent of the world population still has to work many months or years to afford a computer that can run decently the majority of modern, apparently “Free” software.
2. Many people who could afford a new computer every two years rightly prefer to buy something else, like vacations, for example…. Hardware should be changed only when it breaks, or when the user’s needs increase a lot (for example when one starts to do video editing). Not because “Free” Software requires more and more expensive hardware every year.

These guys have the right idea. I can only hope their work will influence other Linux distributions as well.

Linux uptime. (Sure, a little original content.) When I was rearranging things months ago, I unplugged the keyboard and monitor from my webserver, then I never got around to plugging them back in because I didn’t have to do anything with it.

The other day, I had occasion to plug a keyboard and mouse back into it. I went in, did what I wanted to do, then out of curiosity I typed the uptime command. 255 days, it told me. In other words, I haven’t rebooted since last May, which, as I recall, was about when I put the machine into production.

More Linux tricks

Dave Farquhar General February 16, 2002September 30, 2010apache, IBM, unix

OK, I gotta tell this joke.
Osama bin Laden gets taken out by a daisy cutter. He’s standing up there at the pearly gates, where he’s met by George Washington. “You tried to harm the country I birthed!” he said. And he sucker-punched him.

“You tried to take Americans’ liberty, so they gave you death!” screamed Patrick Henry, who popped out of nowhere. Then he threw an anvil at him.

Thomas Jefferson and James Madison came out and started tag-teaming him, followed by 68 more freedom-loving Americans wielding assorted large and heavy objects.

Finally, John Randolph decided he’d had enough, so he picked up this bloody pulp that used to be bin Laden, and threw him over to the gate for his fiery judgment.

Bin Laden looks up at an angel standing there. “This isn’t the least bit like what I was promised!” he cried.

“I told you there’d be 72 Virginians waiting for you when you got here!” the angel said. “What’d you think I said, genius?”

—

Let’s talk about some Unix/Linux tricks. Since yesterday’s mention of top drew some positive response, I might as well talk briefly about a few more tricks.

First, the shell itself. If you can’t remember a command, type the first letter or two and hit the tab key twice. You’ll see all the possible combinations. Tab completion also saves you keystrokes and works on filenames too. Let’s say I’m editing /etc/apache/httpd.conf, here’s the key sequence I’ll probably end up using:

na[tab]/e[tab]apa[tab]h[tab]

It saves me more than half the keystrokes. It also lets me be lazy–as long as I remember roughly where the file is and what letter it starts with, I’ll find it quickly.

Steve DeLassus asked me once a couple of years ago why I didn’t use that trick. I said because I’d get addicted to it and hate not having it in Windows. Out of necessity I started using it. I hate Windows command prompts now.

If you want to see your disk usage, or how much space you have free, use the du and df commands. (I never have problems remembering that last one for some reason.)

If you need to see what’s inside your computer, remember the /proc subdirectory. This is Linux-specific, because each Unix variant has its own nuances about /proc. By viewing the file /proc/pci, you’ll get detailed information on the PCI devices in your computer. By viewing /proc/interrupts, you’ll find out what IRQs are in use and what’s sharing what. The /proc/scsi and /proc/ide trees will give you information on the disk subsystems. By poking around inside /proc, you can find out more about a PC than the old standby Norton Diagnostics for DOS used to tell you. Your Linux installation CD can be a valuable diagnostic tool–just boot a troublesome PC with it and hit ALT-F2 (or CTRL-ALT-F2 if it’s a distribution that uses a GUI-based installer) to switch to a console. Or use a single-floppy Linux distribution.

And as for learning this stuff, the only thing I can recommend is total immersion. I asked Charlie, our Unix sysadmin at work, how he learned Emacs. “I just set my edit variables to emacs and lived with it,” he said. “And after about a month I liked it.”

I think I’ll stick with nano or pico or joe or ee, personally. I know enough vi to be able to use it in an emergency. But his approach works for all things Unix. Either dual-boot the PC you have or pick up a cheap second PC. It’s not difficult to find an old Pentium, complete, for under $100 and a price pressure from cheap LCDs has had the nice side-effect of pushing the price of conventional CRT monitors way down. There’s enough good free Linux software out there now that you can live in Linux for long periods of time and still get the same things done in Linux that you would in Windows while you gain valuable and marketable skills.

While you’re at it, eat lots of salmon and blueberries (not necessarily together). They’re supposed to be good brain food, and that can’t hurt.

Once you’re starting to feel like you know something, pay IBM developerWorks a visit. They’ve got a certification prep series up there. You may not wish to spend the time and money to get certification, but by reading the series, you’ll get a good idea of what you know and don’t know, and you’ll learn some more good stuff in the process.

Linkfest Friday…

Dave Farquhar General February 15, 2002April 15, 2017apache, apple, debian, hp, IBM, journalism, markup, Missouri, mysql, oracle, PHP, red hat, SQL, university of missouri, unix

Let’s start things off with some links. Web development’s been on my mind the last few days. There’s a whole other world I’ve been wanting to explore for a couple of years, and I’ve finally collected the information that’ll let me do it.
Redirecting virus attacks — Your neighbor’s got Nimda? Here’s how to get his IIS server to quit harassing your Apache server. (Suggests redirecting to a bogus address; I’m inclined to redirect either to 127.0.0.1 or www.microsoft.com, personally.)

DJG’s help setting up MySQL. Apache, MySQL and PHP are a fabulous combination, but bootstrapping it can be a painful process. People talk about writing a sendmail.cf file as their loss of innocence, but I’ve written one of those and I’ve tried to set up the LAMP quartet. The sendmail.cf file was easier because there’s a whole lot more written about it.

Short version: Use Debian. Forget all the other distributions, because they’ll install the pieces, but rarely do they put the conduits in place for the three pieces to talk. It’s much easier to just download and compile the source. If that doesn’t sound like fun to you, use Debian and save some heartache. If you’re stuck with the distro you have, download ApacheToolbox and use it. You’ll probably have to configure your C/C++ compiler and development libraries. That’s not as bad as it sounds, but I’m biased. I’ve compiled entire distributions by hand–to the point that I’ve taken Linux From Scratch, decided I didn’t like some of the components they used because they were too bloated for me, and replaced them with slimmer alternatives. (The result mostly worked. Mostly.) You’ve gotta be a bit of a gearhead to take that approach.

Debian’s easier. Let’s follow that. Use this command sequence:

apt-get install apache
apt-get install php4-mysql
apt-get install mysql-server

Next, edit /etc/apache/httpd.conf. There’s a commented-out line in there that loads the php4 module. Uncomment that. Just search for php. It’ll be the third or fourth instance. Also, search for index.html. To that line, add the argument index.php. If you make index.php the first argument, access to PHP pages will be slightly faster. Pull out any filetypes you’re not using–if you’ll never make an index page called anything but index.html or index.php, pull the others and Apache will perform better.

Got that? Apache’s configured. Yes, the php installation could make those changes for you. It doesn’t. I’m not sure why. But trust me, this is a whole lot less painful than it is under Red Hat.

But you’re not ready to go just yet. If you try to go now, MySQL will just deny everything. Read this to get you the rest of the way.

Once you’ve got that in place, there are literally thousands of PHP and PHP/MySQL apps and applets out there. If you can imagine it, you can build it. If HTML is a 2D world, PHP and MySQL are the third and fourth dimension.

Am I going to be playing in that world? You’d better believe it. How soon? It depends on how quickly I can get my content whipped into shape for importing.

This is the holy grail. My first editing job was doing markup for the Digital Missourian, which the faculty at the University of Missouri School of Journalism believe was the first electronic newspaper (it came into being in 1986 or so). By the time I was working there in the late summer of 1995, it had been on the ‘Net for several years. About eight of us sat in a room that was originally a big storage closet, hunched in front of 486s, pulling stories off the copydesk, adding HTML markup, and FTPing them to a big Unix cluster on the MU campus. We ran a programmable word processor called DeScribe, and we worked out some macros to help speed along the markup.

No big operation works that way anymore. There aren’t enough college students in the world. You feed your content to a database, be it Oracle or IBM DB2 or Microsoft SQL Server or MySQL or PostgresSQL. Rather than coding in straight HTML, you use a scripting language–be it PHP or ASP–that queries the database, pulls the content, applies a template, and generates the HTML on the fly. The story goes from the copy editor’s desk to the Web with no human intervention.

There are distinct advantages to this approach even for a small-time operation like me. Putting the content in a database gives you much more versatility. Some people want overdesigned Web sites. Some want something middle-ground, like this one. Others want black text on a gray background like we had in 1994. You can offer selectable formats to them. You can offer printer-friendly pages. You can even generate PDFs on the fly if you want–something some sites are doing now in an effort to gain revenue. If you have content from various sources, you can slice and dice and combine it in any imaginable way.

I can’t wait.

Optimizing a Linux box in-place

Dave Farquhar General February 13, 2002September 30, 2010apache, compaq, firewall, hp, mysql, PHP, red hat, Red Hat Linux, unix

Here’s the Linux bit I promised yesterday. I wrote it much earlier, so I might as well throw it out there.
Our test firewall at work is an old Pentium-200 running Red Hat Linux and a commercial firewall app. (No, I won’t disclose which one. Security, you know.) It’s a bit slow. A P200 is severe overkill for the firewall built into the Linux kernel (Steve DeLassus and I made a firewall out of the first PC he ever bought, a 486SX/20 of 1992 vintage, which, save the loss of the original power supply in an electrical storm, has never required any service), but this commercial package does a lot more than the simple firewalls built into Unixish kernels do.

It had 72 megs of RAM in it and swapped mercilessly. Its speed seemed to be OK once it was booted, but seeing as this is a testbed, it tends to get rebooted an awful lot. I needed to do something for it.

So I trekked into the PC graveyard to see what I could dig up. I found a Compaq 386DX/20. I left that alone. That’ll be useful if I ever need to pillage a pair of Compaq drive rails, which has happened before. Unfortunately those rails are worth more than the rest of the computer. I also spotted a Mac SE. That’ll be handy if I ever need a doorstop. Then I found a Pentium-75 and another Pentium of unknown speed. I opened them up. The 75 had a pair of 16-meg sticks. I opened up the unknown Pentium and looked inside. Ugh. Socket 4. That meant it was a Pentium-60, or, at best, a Pentium-66. It had a pair of 8-meg sticks.

I pulled the memory sticks out of the 75. The 60 didn’t have anything usable in it, save a pair of hard drives, both 540 megs, one a Quantum and the other a Seagate. I took the Seagate because it was easier to unbolt. I don’t have any way of knowing at this late date which of those drives was the better performer, and it probably doesn’t make much difference anymore.

The idea was to add some memory, and put in a second hard drive dedicated to virtual memory. Since the likelihood of the machine needing to read data from a drive and simultaneously hit virtual memory was fairly high, I wanted the virtual memory on its own drive. Furthermore, Linux’s partition-read
mechanism isn’t terribly efficient. This doesn’t matter for SCSI drives, which re-order I/O events, but for IDE drives it matters a lot. So getting the swap partition onto a dedicated drive was likely to improve performance a fair bit. (If this were a production system, it would probably have a SCSI
drive in it.)

So I swapped in the 16s for the 4s and found an empty bay to hold the 540, which I put on the second IDE channel as master (another performance trick), and booted Linux. The next trick is to use your favorite disk partitioning tool (I like cfdisk, but I can navigate plain old fdisk) to blow away whatever partition is on the new drive (this one was /dev/hdc) and create a single partition. I just made it the size of the drive, since 2.4 can deal with large swap partitions and Linux is smart enough to use whatever virtual memory it needs, not just automatically use all it has available. Then I set
it to type 82. Linux can do swapfiles, but a filesystemless dedicated swap partition gives better performance.

Next, I edited /etc/fstab. I found an entry for the swap partition pointing at /dev/hda2. I changed that to /dev/hdc1. That means I now have a small swap partition just sitting on the first drive unused, but that’s not a big deal to me. The system’s not using the disk space it has. While I was there, I noticed the CD-ROM drive was pointing at /dev/cdrom. I asked Charlie, our Unix/Linux guru, if Red Hat had some intelligence I didn’t know about. He said /dev/cdrom was just a symlink. I changed the entry to read /dev/hdd, which is where the CD-ROM drive ended up after my shuffle. Better to just code things directly than try to track symlinks, in my estimation.

Next, I issued the command mkswap /dev/hdc1 to initialize the swap partition. Then I rebooted and listened.

Indeed, during boot, the second drive was getting activity. I logged in and ran top, then hit shift-M to have a look at memory usage. The firewalling software was eating up a lot. But swap usage was down.

I decided to try cutting memory usage down a little more. I loaded /etc/inittab into vi. Red Hat by default gives you six virtual consoles. This machine has little need for more than two. Pulling the extras saves you a couple of megs. Near the end of the file you’ll see several lines that look something like this:

1:2345:respawn:/sbin/mingetty 38400 tty1

I commented out the last four of those. Hit the i key to put vi in insert mode, scroll down to those lines, add a # to the beginning of them, then hit ESC, then hit ZZ (shift-Z twice) to rapidly save the file, no questions asked. (I know, vi ain’t friendly, but it’s there.)

Then I had a look at /etc/rc3.d to see what daemons were running. I found apmd, sendmail, and gpm running. That was a waste of a couple megs, not to mention a possible security risk. I vaguely remember all three of them having had security issues in the past, and sendmail is one of those programs that should never be running unless you need it. Yes, this machine’s just practice, but Hall of Fame catcher Johnny Bench found that if he got sloppy and just let wild pitches go while he was warming up pitchers, he wasn’t as sharp at blocking potential wild pitches during the game when
it counted. So he worked just as hard during practice as he did during the game. Now he’s considered the greatest catcher of all time.

So I applied the Johnny Bench principle and disabled them with the following command sequence:

mv /etc/rc3.d/S26apmd /etc/rc3.d/K26apmd
mv /etc/rc3.d/S80sendmail /etc/rc3.d/K80sendmail
mv /etc/rc3.d/S85gpm /etc/rc3.d/K85gpm

I rebooted to find memory usage down by about 4 megs and the system booted a little faster. It was also more secure.

Total downtime: About 45 minutes.

That was time well spent. I may end up having to just bite the bullet and get some memory, but the system will perform better with these changes no matter how much memory is in it. And, more importantly, performing this exercise made me notice something I hadn’t noticed before. It let me tighten up security.

Had I blindly just ordered some memory to put in the system, or a new PC, like some people unfortunately advocate, I wouldn’t have necessarily noticed that as quickly.

—
Speaking of Linux, I did finally get Apache, PHP, and MySQL all talking together on my church’s 486. I used phpWeblog, which is an awfully nice package. Pages load in an acceptable two seconds. I notice the machine is paging, so a little more memory will probably help that. It’s amazing that people are throwing away Pentium-class machines when even a 486 has enough power to be a decent intranet server.

Not everyone’s so fortunate as you and me. Give ’em to someone who can use them if you don’t want them.

Dave Farquhar General February 8, 2002September 30, 2010unix

A philosophy of life

A week or two ago, e-mail went out from one of our VMS administrators. He wanted to reboot one of our VMS systems.
Later in the day, our other VMS administrator sent out mail. He wanted to reboot one of our systems.

My boss responded to the second message:

NT guys, please find something to reboot. The VMS guys are catching up with you.

-Middle Management

A couple days later, we had to reboot one of our NT systems. We were talking about that at lunch. I looked across the table. “We’re ahead of you today,” I said.

“You’re ahead of us most days,” he laughed. Yes, NT’s not exactly the bastion of stability, while VMS is as stable as Unix.

“It’s not enough for us to win the war. We have to win every battle,” I said, punctuating every syllable of the last two words with my fist on the table.

I was being ridiculous. We all knew I was being ridiculous.

But I was talking to one of my friends tonight about something completely unrelated, and as I struggled with what we were talking about, I realized those words, and the sentiment behind them, permeate just about everything I do.

I’m not sure that’s such a good thing.

Dave Farquhar General January 25, 2002September 30, 2010power brick, troubleshooting, unix

Utility infielder

My phone rang early Thursday morning. It was my boss again.
“Can you take a look at the RAS server? I’m tied up in meetings all day so I won’t have a chance to fix it myself.”

The RAS server is a small beige Lucent box. I’d dealt with it on the client side far too many times. I don’t understand the appeal of 28.8 dialup with only five lines, but I guess if you don’t want to pay for Internet dialup, it must just be the greatest thing since Linux.

So he e-mailed me the configuration of the machine, told me the root password, and I was off. It seems to run some kind of embedded Unix, but the command set is extremely limited. Since people were having problems dialing in, I didn’t want to find it was a hardware problem. Using US Robotics Sportster modems, I wasn’t going to rule that out. The Sportster was the best consumer-grade modem out there, but the Courier was professional. Nothing compares to a Courier.

I knew of a couple of US Robotics Courier v.32 modems in the back room. So I plundered them, brought them back to my desk, and started configuring. Then I realized why those modems were in the back room. The v.32 standard was 14.4. It didn’t matter if those old Couriers connected every single time–nobody was going to be happy with 14.4 dialup. So I piled the Couriers–each about the size of a modern laptop, along with a good-sized external power brick–on a corner of my desk and started looking at what I had.

After playing around for an hour or so, I was able to figure out how to get the status and configuration of the modems. And I almost immediately found the problem. The first person to dial in always had problems. Well, the modem on port 0 wouldn’t hold its configuration. I plugged my laptop into an analog phone line. It connected, first try. My modem just didn’t seem to care. I disconnected, and went into the back room. I checked to make sure all the modems were identical and had identical DIP switch settings. Indeed they did. I traced the cables. Nothing looked bad. The modem lights looked fine too.

I played with it all day. It was a true misadventure. Eventually I figued out the modem on port 0 wasn’t responding because there was no modem on port 0. I dialed in and stayed dialed in for a couple of hours. Catching up on e-mail and going to random Web sites at 28.8 wasn’t exactly a delight. Eventually I figured out that we were using an init string for USR v.32 (14.4) and not v.34 (28.8/33.6) modems. The difference was slight: the 14.4 string set register S0 to 1. The 28.8 string didn’t. I had someone who’d been having problems dial in. No problems. And she got better speed than ever before. I couldn’t believe it. Over the S0 register? Why would that make a difference? But if anyone knows modems inside and out, it’s Lucent. Not only do they make tons and tons of modem chipsets, they also make the equipment that all of them have to use to communicate, so while no one’s seen everything, they’ve probably seen more than everyone else. And init strings have always been a black art.

So I left, satisfied. I played out of position, but I found the problem. At least I found a problem, and my solution sounded plausible. My first day troubleshooting a piece of networking infrastructure looked successful.

Dave Farquhar General December 21, 2001September 30, 2010boot floppies, CGI, unix

Some goodies for your CD burner

This is the coolest thing I’ve seen in a really long time! Everyone and his uncle who has no clue how CD burners work wants a networked CD burner, for some reason. But it’s not as easy as just throwing the drive in a server and sharing it out with write access, as you probably know.
Leave it to someone else to think of combining the power of CGI scripts and the Unix command line to create a Web-based networked CD burning solution. So with this and a minimalist PC (any Pentium with 24 megs of RAM and a 1-gig hard drive ought to be more than enough) and a Linux-compatible CD burner, you can give controlled access to a CD burner to anyone on your network with a Web browser. It’ll even burn bootable CD-ROMs for you.

So now I’m half tempted to permanently install my 2X CD burner in my 486 so that any of my computers can use it, any time.

Speaking of bootable CDs… I’ve mentioned Bart’s way to create bootable CD-ROMs before, but it warrants another mention. Bookmark it. Bart Lagerweij has a great collection of boot floppies as well, and some good utilities, including low-level SCSI utilities.

Windows CD burning software. So you got a great deal on an OEM CD-R or CD-RW only to find it didn’t include software? What to do? You re-use the copy of Easy CD Creator that came with your old CD-R, that’s what. And then you’ll upgrade Windows and you’ll really regret that–Easy CD Creator is one of the most finicky programs I’ve ever seen about Windows versions. Upgrade Windows, you’ll have to buy a new version of Easy CD Creator. So if you’re smart, you’ll tell Roxio where to go and what to do with itself and buy Nero Burning ROM.

If you’re smart and cheap, you’ll pay this site (watch out for the annoying popups and popunders, sorry) a visit. It’s free CD burning software for Windows, based on GNU tools. It comes with dated versions of cdrecord, so you’ll want to download a newer version of CDRTools (current version as I write is 1.10; v1.11 is pre-release code so you use it at your own risk) and extract it to the directory you installed the front-end.

It’s not as flashy as the commercial tools and it doesn’t necessarily have all the features you’ll find in a retail shrink-wrap package, but it’s functional, and some people will find it easier to use. It happily runs on any 32-bit Windows. You can make as many copies of it as you want and install it anywhere you want. It’s legal, and much less invasive than the commercial tools. Good deal.

It was a high-stakes game, and I won.

Dave Farquhar General December 10, 2001September 30, 2010boot disk, data recovery, intel, MBR, steve gibson, symantec, unix, VHS, windows 2000

Who’s to say where the wind will take you
Who’s to know what it is will break you
I don’t know where the wind will blow
Who’s to know when the time has come around
I don’t wanna see you cry
I know that this is not goodbye
–U2, Kite

When I last left you, I was denying it was time to say goodbye to the data on a friend’s hard drive. I’d found some information on the Internet that promised to get her data back, but I hadn’t done it yet. As often is the case with the Internet, the instructions I found online for doing the job were close. They were not quite right, but they brought me close enough that I was able to make it work.

Removing Form.A from a FAT32 drive is difficult. I was able to verify its presence using the free-for-private-use F-Prot, but F-Prot wouldn’t remove it, Usenet reports to the contrary.

One word of warning: Do as I say, not as I do. The first thing I should have done was make a bit-for-bit backup copy of the drive. I didn’t do that right away. Norton Ghost will work, though it’s not exactly a bit-for-bit copy. A better approach is to get a mini-distribution of Linux and use the standard Unix dd command to make a backup copy. (For example: dd /dev/hda1 /dev/hda2 bs=1024k) Once you have a copy of the drive, work from the copy! If you don’t know how to do all this, do not attempt recovery yourself. It’s much too easy to mess up your drive beyond any hope of recovering your data. This information is presented for informational and entertainment purposes only. I make no representation whatsoever that this will work for you. For all I know it’ll install Gator on your computer and leave the dome light on in your car and erase all your VHS tapes.

I downloaded a utility called ivinit.exe from www.invircible.com (don’t e-mail me if their Web site is down; I could only get to their site about one time out of four myself). It’s a very limited utility; I’d chained the drive off another drive for recovery purposes but ivinit will only work on the primary partition on your C drive. So I disabled the primary drive. Ivinit found it and warned me that the MBR and its mirror didn’t match. I restored the MBR from its mirror, then rebooted. I re-enabled my primary drive, let it boot, and tried to access the drive. I got the invalid media type error again. I ran FDISK, which told me I had a single FAT32 partition. That was a good sign.

So I ran MBRWORK.exe, deleted the MBR and EMBR and told it to recover my partitions. It found a single FAT32 partition. Excellent. I rebooted, tried to read drive C, and… Yeah. Invalid media type paid me another unwelcome visit.

I ran the real-mode version of Norton Disk Doctor from a recent copy of Norton Utilities. You have to be very careful with Norton Disk Doctor; never run it unless you’re positive the version you have knows about FAT32. Otherwise, you’re setting your hard drive up for a train wreck. NDD wasn’t too happy. It wanted to scavenge and rebuild the partition table, and it didn’t offer me a chance to make a backup copy. I never let a low-level utility do anything that it won’t let me undo. I aborted.

At this point I wised up. I put an Intel 10/100 network card in the PC I was using to recover the data, plugged into my network, grabbed my magic network boot disk, and connected up to the big Windows 2000 computer I use for editing video. I ran Norton Ghost and told it to make an image of the disk. To my amazement, it found a single 3.8-gig FAT32 partition and started running through filenames!

Like I said, Ghost doesn’t normally do a bit-for-bit copy; it stores enough information to recreate a valid copy of your partition. If your partition isn’t quite valid, that means you don’t get an exact copy. The upside of that is that Ghost can be a useful data recovery tool, assuming it can make sense of your partition. And fortunately, it looks like it’ll make sense of partitions that Windows itself doesn’t want to touch.

Theoretically, I could have restored the data by just making an image with Ghost, then restoring the image immediately afterward.

Norton Disk Doctor revived the partition, and it revived it more quickly than a Ghost restore would have. Then I ran into another pitfall–everything in the root directory appeared OK, and most subdirectories one level deep were fine, but anything nested gave sector not found errors. Norton Disk Doctor offered to fix that stuff, but I had a gut feeling that I shouldn’t go that route. Any time there’s the possibility of bad sectors, I want SpinRite.

As soon as I ran SpinRite, it reminded me of why I should bring it into the game as quickly as possible. It reported that the drive’s CMOS parameters appeared incorrect and it was hesitant to continue. That’s good–incorrect CMOS parameters can cause the problems I was seeing. And trying to repair the drive with messed up CMOS parameters will lead to nothing good–something that Steve Gibson is certainly aware of, and something that Symantec may not necessarily care about. In this case, the parameters were wrong because I put the drive in another system and it defaulted to a different addressing method. Whenever you’re doing data recovery and you want to move the drive, you need to be sure you get addressing straight or you’ll do a whole lot more harm than good.

After I corrected the CMOS, a simple DIR /W /S ran through the entire drive with no complaints. Norton Disk Doctor found no filesystem errors or low-level errors. SpinRite doesn’t do anything about filesystem errors, which is why I went back to NDD–use NDD when you suspect filesystem problems, but always always turn surface-scan-type stuff over to SpinRite. And there’s no harm in running SpinRite first–it’ll alert you to problems that NDD might not notice.

Along the way I learned a whole lot more than I ever wanted to know about boot-sector viruses. AntiCMOS and Form were able to coexist together nicely, and on just about any computer purchased new between 1992 and 1996, they’d just happily infect any disk you used and you’d probably never be the wiser. With the release of Windows 95B and FAT32, Form became destructive. (Why should Microsoft test new filesystems for compatibility with old viruses?) Wendy told me the problem appeared after she left an old disk in the computer before she booted it up. I suspect their old computer picked up the virus at some point, and since it wasn’t destructive under DOS and Windows 3.1, they never noticed. The computer just happily infected disks. Boot sector viruses flourished in the early 90s, as everyone needed a boot disk to play Doom or other tricky DOS games, so people traded boot disks like recipes. As often as not, those boot disks carried viruses.

When I went to put the drive back in, the dreaded “Operating system not found” paid me a visit. I hadn’t wanted to try to boot off the drive while it was in another PC for obvious reasons. So I did the standard drill. First up: fdisk /mbr. Strikeout. Second: sys c:. Strikeout. Finally, God reached down with His two-by-four and smacked me upside the head to knock some sense into me. I ran plain old fdisk and found the problem–no active partition. So I set the partition to active, and boom. The system booted up and was its old self again. It seems like I always make that mistake.

Data recovery is definitely a trade or a skill, not a science or process.

Dave Farquhar General December 7, 2001September 30, 2010unix

Do I ever have a story…

Do I ever have a story! But it’s way too late to tell it properly. I’ll tell it either later today or this weekend.
Until then, I need say only one thing.

Give me Unix or give me death.

And I need to write another one-sentence paragraph.

That’s OK. In college I wrote a one-word paragraph once. It was in one of my most beloved pieces. What was the word? Remember, this was college.

Beer.

I’m slap-happy, and I’m late for an appointment with my pillow, so, see ya.