Abstract: An initial setup method (100) stores recovery tools (400) and a further setup script (402) on a computer (1000) which has an operating system (302) that need not have any recovery capabilities. At the user site, a further setup method (700, 800) reserves (706) a container space (500) in the file system space (304), creates (716) an image (1008) of the main partition (300), and stores (720) the image in the container. If the partition is corrupted later, the computer can still be booted using virtual boot tools (602), the image can be retrieved (914) from the container even though the partition around it was lost, and the image can then be deployed onto disk (200) over the corrupted partition, thereby restoring a working partition to the computer. This can be done without secondary media such as a recovery CD or floppy, and without a network connection.

Abstract: The invention provides tools and techniques for running pre-boot code on a computer from a file stored in a file system on the computer. The pre-boot code may include an operating system which is not otherwise installed on the system. For instance, the pre-boot code may be used to boot a DOS operating system on a computer which lacks a DOS hard disk partition. The pre-boot code may contain code to perform operations that are difficult to perform after the operating system is booted, such as code for monitoring the boot process to help debug it. The pre-boot code is obtained from the file without using booted file system code, and is then executed. The code may be obtained by redirecting floppy drive I/O to read the pre-boot code from a copy in memory, or to read it as needed from one or more files on the hard disk.

Abstract: The invention provides tools and techniques for migration of user profiles in place on a computer. In one method, a first step provides a migration content storage partition to hold migration content such as user settings. This partition is provided by using a partition manipulation tool to obtain sufficient space on the computer. A second step saves migration content into the provided partition. A third step deploys an image into another partition on the computer, overwriting that partition. A fourth step then uses the migration tool to restore migration content from the migration content storage partition into the newly imaged partition, thereby customizing the new image with at least some of the former image's user settings. The migration content storage partition may then be deleted, or it may be retained and made available to the user as additional storage.

Abstract: Methods and systems are provided for detecting viruses in a computer system without relying on possibly infected system software or a possibly infected standard BIOS. The invention uses a separate BIOS designed specifically for virus detection and removal. This trusted BIOS is tailored to the controller hardware. The invention can detect viruses by detecting inconsistencies between results returned by the standard BIOS and results obtained using the trusted BIOS. The invention may also provide a virus remover. The virus remover relocates facade structures to their proper location, reconstructs boot sectors and Master Boot Records, and otherwise removes viruses.

Abstract: The HKEY_LOCAL_MACHINE\SYSTEM\DISK\Information Windows NT registry key contains disk layout information, such as disk letter assignments. During repartitioning of a hard drive, this key needs to be modified to reflect the new partitions. In order to accomplish this, while in Win32 mode, the modified disk layout information is stored in a temporary registry key. Then, while in Windows NT boot mode, direct reads and writes are performed on the registry files (e.g., “system” and “system.alt”) that contain the “Information” registry key and the temporary registry key to replace the “Information” registry key with the temporary registry key.

Abstract: An initial setup method (100) stores recovery tools (400) and a further setup script (402) on a computer (1000) which has an operating system (302) that need not have any recovery capabilities. At the user site, a further setup method (700, 800) reserves (706) a container space (500) in the file system space (304), creates (716) an image (1008) of the main partition (300), and stores (720) the image in the container. If the partition is corrupted later, the computer can still be booted using virtual boot tools (602), the image can be retrieved (914) from the container even though the partition around it was lost, and the image can then be deployed onto disk (200) over the corrupted partition, thereby restoring a working partition to the computer. This can be done without secondary media such as a recovery CD or floppy, and without a network connection.

Abstract: The present invention provides tools and techniques for facilitating (314) management of storage (122), software (118), and other resources of a computer (102) at a distinct management computer (110) using a disassociated ample image (104) of the managed computer's storage. Ample images may be searched (310) to identify (414) infected files or illegal files, to extract (410) disk usage information, or for other reasons. Ample images may be modified (312) and then deployed (316) back to the original imaged computer and/or to other computers outside the management node. Modifications may change (502, 504, 506) application software, change (508, 510, 512) hardware drivers to match hardware changes on the target computer(s), manipulate (520) partitions, and/or perform other steps to optimize storage, software, or other resources.

Abstract: The invention provides systems and methods for storing and recovering images in a computer partition, and more particularly to tools and techniques for placing and extracting images to and from the same partition that is imaged. Both a factory image and a user-updateable image may be stored on the same partition. Copies of a portion of the partition data and/or the system data for the imaged partition can be stored at a specified location within the imaged partition, in a separate partition, or on a removable recovery medium, thereby allowing images to be recovered after disruption of the imaged partition's system data. The image may be stored contiguously or non-contiguously. The image may also be stored as a system file or as an image container which comprises one or more than one image file. To speed restoration time and to assist recovery, the image may be stored at or near the end of the partition. Familiar or novel image formats may be used.

Abstract: A Windows NT partitioning program partitions a storage device in Windows NT boot mode (i.e., after the Windows NT kernel loads device drivers and before the Session Manager loads the Windows NT user interface). In this mode, the partitioning program is capable of corrupting its own backing store—a Windows NT executable file stored on the storage device—through the partitioning process. Such corruption would generally lead to execution errors in the partitioning program when code or data from the corrupted executable file is paged into the program's in-memory executable image. To avoid such errors, the working set allocated to the executable image is expanded to accommodate all the pageable Windows NT program sections in the executable file. Each pageable program section is then locked into the executable image.

Abstract: Methods and systems are provided for manipulating data in segmented environments such as an instance of a NetWare file system. Unlike the conventional approach that relies on FDISK and the install.nlm and nwconfig.nlm utilities in NetWare, the invention does not destroy user data on the disk after the data is copied to tape or other intermediate storage. Segment-related features such as limits on the number of segments; various configurations of segments, volumes and partitions among drives; and data mirroring, are handled by the invention during “in place” manipulations. Segments, volumes, partitions, and segment clusters or blocks may each be resized. Segments may be merged. Volumes may be consolidated on a single drive. Other manipulations and various combinations of manipulations are also provided.

Abstract: Methods and systems are provided for converting from a complex file system such as a Microsoft NTFS file system or a Linux ext2fs file system, to a simpler FAT file system. Features of the advanced file system are identified and handled. Depending on the circumstances, some features are carried over to the resulting FAT file system, while other features carry over only partially or not at all.

Abstract: The present invention provides tools and techniques for manipulating virtual partitions in a virtual engine environment without necessarily committing each partition manipulation by actually modifying on-disk system structures. A virtual engine, virtual partitions, virtual drives, and other structures in the virtual engine environment permit users to experiment with different partition manipulations in a safe and efficient manner. A batch manager manages a resulting list of partition manipulation operations, which may be optimized. The batch list may also be executed automatically by a conventional partition manipulation engine without requiring additional user input at the end of each list entry. The present invention also provides the ability to manipulate extended partitions automatically and provides support for remote partition manipulation through a two-part user interface architecture.

Abstract: Methods, systems, and articles of manufacture are provided for manipulating partitions while imaging them to another disk on the same or another computer. By integrating partition manipulations with imaging, the invention reduces data movement. Rather than resizing a source partition in place and then imaging the resized source partition, for instance, one embodiment of the invention leaves the source partition intact and performs resizing on-the-fly by manipulating a memory-resident copy of the source partition's file system structures and then copying the modified structures and corresponding portions of the source user data to the target location. In addition to partition resizing, on-the-fly manipulations possible with the invention include cluster resizing, defragmentation, file relocation, and others. Novel image file formats suitable for on-the-fly manipulations are also described.

Abstract: Methods and systems are provided for canonizing, defragmenting, and improving the storage efficiency of advanced file systems stored in one or more disk partitions. Partition and file manipulations are performed without destroying user data, making it unnecessary to copy data to tape or other intermediate storage and wipe the partition clean. Advanced file system features, such as relocatable file system structures and multiple data streams, are treated appropriately during the manipulations.

Abstract: Methods and systems are provided for merging computer disk partitions to reduce the number of partitions. Unlike conventional approaches that rely on FDISK, the invention does not destroy user data on the disk during or after the two or more partitions are merged. Two or more adjoining partitions may be combined. During a merging operation, partitions may have their clusters aligned or resized. The merging partitions may also have their partition type changed. During the merge at least one copy of all system and user data of all partitions is kept on a disk at all times, reducing the risk of data loss.

Abstract: The invention addresses the management of multiple operating systems on a single computer and other boot-time problems. A boot-time graphical user interface is described, including support for menus, tabs, non-ASCII characters, and other graphical user interface components in the pre-boot environment. Approaches to organizing the storage and selection of multiple operating system are also presented, including the use of multiple directories which are identified in operating system boot sectors.

Abstract: A method allows manipulation of disk partitions defined by an IBM-compatible partition table. The disk partitions may be located on one or more disks attached to one or more disk drives. Each partition has an associated file system type, such as FAT or HPFS. An interrupted manipulation may be resumed at a point in the progress of the manipulation near the point of interruption. Available manipulations include verifying the integrity of a partition's file system structures; displaying information about a partition; moving a partition to a different location; resizing a partition; and converting a partition from one file system to another file system. The resizing step is illustrated with particular reference to HPFS file systems and FAT file systems. The details required to perform these manipulations are attended to by an implementing program that requires only general direction from a user.

Abstract: An automated method and apparatus for identifying and copying lost files from a mass data storage device of a computer when file system information (as opposed to the actual data files) stored on the mass data storage device has been corrupted or destroyed. The mass data storage device is scanned on a sector-by-sector basis in order to attempt to identify sectors containing file system data structures and file attributes. Identification is made using data signature and/or pattern matching filters. The location of, and any valid information found in, such sectors is used then to derive information useful in locating files to be copied to another storage device. For example, in a FAT, NTFS or other cluster-oriented file system, if information on the number of sectors per cluster (SPB) is not available from a boot directory, it and a cluster base (the starting sector of cluster 0) are calculated using the physical location of the beginning sectors of the directories or folders.

Abstract: Methods and systems are provided for copying, moving, and resizing disk partitions that contain advanced file systems. Unlike the conventional approach that relies on FDISK and FORMAT, the invention does not destroy user data by wiping the partition clean after data is copied to tape or other intermediate storage. Advanced file system features, including features such as relocatable file system structures, volume sets, suballocation, and database paradigm structures not found in many FAT file systems, are handled by the invention during "in place" partition manipulation.

Abstract: Methods, systems, articles of manufacture, and signal formats are provided for transferring disk images from a transmitting computer to one or more downloading computers. The transfer is done in a manner that allows a technician to start the download to one computer while preparing a second computer for downloading or shutting down a third computer after it has finished downloading the disk image. The computers need not wait for the beginning of a data stream but can instead join the download at specified points within the data stream. This reduces the time spent waiting to begin the download, particularly when the disk image being transferred is large. Compression and connection selection may be performed in response to changes in network performance. Image file packing and error management techniques may also be used, as well as on-the-fly file system instance manipulations.