My husband wants to reformat his computer, because of a virus. He
wants to save certain files, and wants to know the best way to save
those files.
First, I want to commend you on realizing that a reformat of your
machine erases everything. Sadly, many people don’t realize or
overlook this aspect.
There are two approaches that I recommend, and the choice boils down
to understanding exactly how confident you are that you won’t miss
anything.
And for the record, I’m never that confident, myself.
Become a Patron of Ask Leo! and go ad-free!
If you want to be totally, absolutely sure you don’t miss something
important, then you want to take a complete backup image of your
computer.
By that I mean use a backup program line Acronis TrueImage or
an equivalent, and backup your entire machine, most likely to an
external hard disk.
Now, ideally this should mean no extra work on your part. Why?
Because you should already be backing up regularly. It’s perhaps the
single most important thing you can do to prevent data loss due to any
number of different disasters.
don’t miss something important, then you want to take a complete backup
image of your computer.”
So if you are backing up regularly, just make sure you have a
complete image of everything prior to reformatting.
If you’re not backing up regularly, well then now would be a perfect
time to start.
•
I’m going to assume that this wasn’t the answer you were looking
for. I strongly recommend that you backup and use a backup-based
solution, but let’s assume for a moment that you actually are totally
protected in some other way and simply don’t need to.
I’m also going to assume you know exactly which files you need
to save; the entire list. I’ll presume that you won’t miss a single file that you’ll
be sorry to have missed later. (Yes, I’m still nudging you back to a
backup based solution. Subtle, eh? 
)
In that case, your options are actually fairly simple:
-
Copy the file(s) to floppy disks
-
Copy the file(s) to a USB flash drive
-
Copy the file(s) to an external hard disk
-
Copy (or “burn”) the file(s) to a CD or DVD
-
Copy the file(s) to another machine on your local area network
Really, that’s all there is to it. The bottom line is that you need
to copy those files to some other place so that you can copy them back
after your machine has been reformatted.
Of the options above, I tend to prefer burning them to CDs or
DVDs.
Why?
Because that way you’ve also created a permanent backup of the files
at the same time.
Yes, when it comes to backing up, I have a bit of a one-track
mind.
Leo, since the reader mentioned a virus, wouldn’t an image of the hard drive also capture that virus? How would anyone be protected if they’re re-instating the virus whenever they restore from backup?
–zigg
Yes, a full system backup would also back up the viruses. However, so would just backing up a single infected file.
The idea here is to make sure that you didn’t miss an important file before the wipe-and-reinstall, because after the wipe, you’re not going to get anything that you missed.
Once the system is reinstalled, and an up-to-date antivirus and anti-spyware program are installed, they should pick up any infected files that you try to copy back. (In fact, if you back up to a writable media, such as an external HD, you can scan it before restoring anything.)
And, once you have everything that you need restored, and the system is “clean”, you can do another full system backup at that point.
I’m confused – why can’t a simple antivirus scan solve the problem? – Surely if the virus can be found and healed on the external hard drive back-up(or other media) before re-copying, then surely this can be done on the existing machine – Can someone please explain?
Well, some people are of the opinion that “the only way to be sure you got rid of the infection is to reformat and reinstall”.
Beyond that, however, is the fact that many infections actively target and disable the antivirus/antispyware/etc. programs. If your system is infected, you many not be able to run the program.
The typical end-user, and many technicians, simply don’t have the tools and the experience to remove many of the really nasty programs out there.
Zigg: you’re absolutely correct, a full backup would also backup the virus infection. Note that I’m not suggesting that the machine be restored completely from that backup. The point is that the backup includes all the files on the machine, and as they’re needed they can be extracted from the backup (and presumably virus scanned as well).
Phil: no, a simple anti-virus cannot be trusted to just fix the problem. The very definition of viruses and malware is that they go out of their way to be undetectable. In an absolute sense, once you’ve been infected by almost anything you’ve lost total control of your machine. You can run an anti-malware scan, but how do you know, I mean really know, that it caught and cleaned everything? You don’t.
The closest any anti-malware scanner can ever get is: “we believe you’re clear of everything we know about and everything that we could find”. The corollary to that statement is that “you could still be infected by malware we don’t know about, or that hid from us too well.”
The reason that most people simply rely on anti-malware scanners to do the job is that most, but not all of the time even though there’s no guarantee, it’s enough. And it’s generally impractical and very painful to reformat after every infection.
That’s why prevention is so much less painful than the cure.
Thanks Ken B for your comments above as well; right on target.
-Leo
when i try to remove a virus i also go into
the registry and delete it from there, but
this is based on if i know what the virus is.
Leo you are right, as i have encountered trojans
that will change names as fast as i can find it.
Ive even found them in the system32-folder
deleted it from there only to find that it
was buried in the registry so much that even
i couldnt find it.
But like you this is what i do..but i don’t
have your knowledge and i could spend days
searching for answers when there are none.
I look forward to your Email solutions.
Hi Leo
Isn’t a simpler solution to move the files in question to the D drive and just reformat the C
drive? The files can be left there permanently as they are easily accessed and scanned for viruses with a “clean” anti-malware program.
Regards
I may be paranoid, but for a system rebuild I usually do a double back up. There is always a small chance that your backup will fail. [I have seen this a few times.]
[The first time I learned this was when a paper tape punch machine had a broken tooth on a gear resulting in an occasional irregularity in the hole spacing. More recently, I had a DVD burner that caused write errors in the last 10% of discs.]
Leo,
You haven’t mentioned the registry in this thread. When a hard drive is rebuilt from scratch, the new registry will be “clean”. Why not restore the full image to a new folder, named something like “Restored from backup of Old Drive on MM-DD-YY”. With the entire old folder structure under that one new folder, nothing in the registry will be pointing to those restored folders and files.
I then give myself a few months to “remember” what I forgot to restore into the new operational folders. If I haven’t needed to recover anything for say, 6 months, I just delete that one folder and get all my disk space back.
By the way, the next time I run a full system scan, it finds the malware files in the “old” area and deletes them at that time.
I have a lot of respect for your thoughts on this Leo. If there is a flaw in my thinking here, please say so.
-Leo
Please help! I have a virus so I’m trying to back up my pc and get rid of the virus and then restore my files. The problem is when I try this I get an error message saying catastrophic failure (0x8000ffff), what should I do!!! HELP!!! Ken
I have read through all of this and I was wondering if you know what to do in a situation where you can’t start up windows, can’t get to a DOS prompt, etc…. How can I get to my files to back them up now? I have an external hard drive and I want to do a full system recovery but I can’t bring myself to do it until I have copied all my pictures, music files and documents over tot he external hd. Please help if you can. The manufacturer suggested going to someplace which services my brand of laptop, but that just reeks $$$$$. I’m fairly good at figuring things out myself and would rather give myself a headache fixing this instead of paying someone else to do something as simple as backing up a file. I just need to know if there is some way to get these files out of harms way.. . . Thanks, Lisa
All this assumes that the drive is actually working, by the way. If not then it’s probably time for a technician’s advice on the specific failure.
Finally, I have to point out that regular backups would prevent this crisis, so once you’re set up again be sure to start backing up.
26-Oct-2008
In a case like Lisa’s, SpinRite could very well be the solution. It fixes or relocates bad sectors and can often restore the usability of drives that have become so corrupt that windows cannot load or where the file system is unrecognizable. It saved my data last week, even if I did have to force mount my drive afterwards with a linux live cd to copy the files.
I think Knoppix is a good solution.
http://www.shockfamily.net/cedric/knoppix/