Re: XP upgrade: FAT32 to NTFS

Tech-Archive recommends: Repair Windows Errors & Optimize Windows Performance

From: Michael Cecil (macecil_at_comcast.net)
Date: 03/13/04 

Date: Sat, 13 Mar 2004 14:08:28 GMT

On Sat, 13 Mar 2004 15:23:07 +0200, "cquirke (MVP Win9x)"
<cquirkenews@nospam.mvps.org> wrote:

>On Fri, 12 Mar 2004 10:57:53 GMT, Michael Cecil <macecil@comcast.net>
>>On Fri, 12 Mar 2004 12:51:08 +0200, "cquirke (MVP Win9x)"
>>>On Mon, 8 Mar 2004 05:42:55 -0800, "Joel"
>
>>>>NTFS is more stable and secure, but it does have it's
>>>>draw backs.
>
>>>Specifically:
>>> - no ability to formally detect and clean malware
>
>>FAT32 can detect and clean malware? Wow, I guess all those AV companies
>>might as well pack it in, eh?
>
>No. FAT32 can be accessed from DOS mode running completely
>independently of the HD's (infected?) code base, thus fascilitating
>formal scanning for malware. Malware can be cleaned, too, with the
>caveat that the DOS-based scanner may not be able to address registry
>settings that need correction.

You may do exactly the same things using a Windows PE CD or a PE Builder
type CD. Although if you load the registry into your PE's regedit, you
should be able to access the areas commonly affected by malware.

>>> - no ability to recover data if the OS can't work
>>> - no ability to interactively check/repair the file system
>>
>>No chkdsk? Wow! I didn't realize that command was just hot air.
>
>ChkDsk is not hot air, but it is NOT an interactive tool either.
>
>ChkDsk does NOT give you the ability to look for file system errors
>and prompt the user before either ignoring them (ChkDsk) or "fixing"
>them (ChkDsk /F) automatically.

The somewhat intelligent user would run Chkdsk first to see if there are
any errors, then run it again with the /f switch to repair them. Not
terribly different from Scandisk from the enduser point of view.

>>>The "more secure" part can also mean "unable to get my data back".
>
>>Get over it already. It's TRIVIALLY simple to create either a Windows PE
>>disc, a similar disc using Bart's PE Builder, or just boot from a Knoppix
>>disc if you like Linux. Don't forget the recovery console.
>
>I've done all three. Here's the mileage:
>
>1) Bart's PE builder
>
>The most promising of the three, but unable to access and alter the HD
>installation's registry. The registry RegEdit sees is the one on
>Bart's CDR, and you can't add a hive from the HD to access that way.

Just load the registry hive off the disk in question manually. Yes,
regedit opens with the PE CD's registry loaded. You wouldn't want to
automatically try and load a hive from a client's machine. If you are
unable to build a PE CD properly you can always get ERD Commander from
Winternals.com. It is preconfigured to allow you to manipulate the
registry on the client machines.

>2) Knoppix and other Linux boot disks
>
>Linux advocates themselves are sceptical about NTFS write safety using
>Linux NTFS drivers. If nothing else, that's cause for pause.

NTFS write support for Linux isn't marked dangerous or experimental with
kernel 2.6. Besides, there are other drivers you could use with Linux
like the one from Paragon (http://www.ntfs-linux.com).

>3) Recovery Console
>
>RC is not an OS; it's just a grab-bag of useful fixin' tricks, much
>like the old Norton DiskTool from the days of MS-DOS. So it cannot
>host an antivirus utility, for example.

No, but you can use it to repair many virus problems if you know which
files to delete or replace.

>Even if you have made the registry settings required to allow RC to...
> - access volumes other than C:
> - write to removable diskettes
> - automatically log into the installation with password
> - support wildcard syntax
>...you find that wildcard syntax (e.g. Copy C:\*.*) doesn't work.
>That cripples RC as a means of evacuating data from a sick PC.

Have you actually ever used it? It doesn't sound like you've tried from
your description. The main point of using the recovery console is you can
access it even when safe mode is too corrupted by a virus to function.
No, wildcards don't function like in DOS but this is NT. You can copy,
rename or replace system files and folders, disable or enable services and
devices. It can repair the system boot sector or the MBR and partition
and format drives.

That's much more powerful than some weak DOS utility that just tries to
disinfect files.

To me, NTFS is so much more stable and so much safer that I would never go
back to FAT16 or FAT32. 

-- 
Michael Cecil
macecil@comcast.net
http://home.comcast.net/~macecil/howto/
http://home.comcast.net/~antiviruscd/

Relevant Pages

  • Re: Malwarebyte Anti-Malware finds many trojans, while others .... why?
    ... malware is known to alter. ... modified policy keys in place, ... Most users don't know what those registry ... MBAM doesn't alert on me for those changes. ...
    (alt.comp.anti-virus)
  • Re: malicious software removal tool
    ... have never had this program on your computer, you still have malware. ... Event Type: Error ... error include insufficient security rights or a corrupt local profile. ... Windows was unable to load the registry. ...
    (microsoft.public.windowsxp.security_admin)
  • Re: registry hacked under XP limited account
    ... >> The thing I want to know is that the registry can be modified ... Running as limited account does VERY LITTLE to stop ... running with administrative rights is a VERY BAD HABIT. ... This tactic will NOT be effective against future malware. ...
    (microsoft.public.security)
  • Re: Malwarebyte Anti-Malware finds many trojans, while others .... why?
    ... It was not a pest. ... malware is known to alter. ... Most users don't know what those registry keys are for. ...
    (alt.comp.anti-virus)
  • Re: Regedit
    ... registry cleaning is not needed on XP, ... If XP is so bad stop complaining and go back to Win98. ... Linux - which I may delete as well, so far I have only run Damn ... There are only two classifications of disk drives: ...
    (microsoft.public.windowsxp.general)