Microsoft Diagnostics and Recovery Toolset Version 6.5 Trial Guide


Trial Guide

Published November 2010

Important Notice

Copyright

The information contained in this document represents the current view of Microsoft Corporation on the issues discussed as of the date of publication. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information presented after the date of publication.

This document is for informational purposes only. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS DOCUMENT.

Complying with all applicable copyright laws is the responsibility of the user. Without limiting the rights under copyright, no part of this document may be reproduced, stored in or introduced into a retrieval system, or transmitted in any form or by any means (electronic, mechanical, photocopying, recording, or otherwise), or for any purpose, without the express written permission of Microsoft Corporation.

Microsoft may have patents, patent applications, trademarks, copyrights, or other intellectual property rights covering subject matter in this document. Except as expressly provided in any written license agreement from Microsoft, the furnishing of this document does not give you any license to these patents, trademarks, copyrights, or other intellectual property.

Unless otherwise noted, the companies, organizations, products, domain names, e-mail addresses, logos, people, places, and events depicted in examples herein are fictitious. No association with any real company, organization, product, domain name, e-mail address, logo, person, place, or event is intended or should be inferred.

 2010 Microsoft Corporation. All rights reserved.

Microsoft, Active Directory, ActiveX, Excel, SoftGrid, SQL Server, Windows, Windows PowerShell, and Windows Vista are trademarks of the Microsoft group of companies.

All other trademarks are property of their respective owners.

Contents

Important Notice

Copyright

Introduction to the Trial Guide

Audience for This Guide

Product Documentation

Overview of Microsoft Diagnostics and Recovery Toolset

Crash Analyzer

ERD Commander

System Recovery Options

DaRT Tools

Trial System Requirements

Microsoft Diagnostics and Recovery Toolset Desktop Client

Minimum Hardware Requirements

Checklist of Tasks

Before You Get Started

Basic Tasks

Additional Information

Installing Microsoft Diagnostics and Recovery Toolset

Download and Create MDOP ISO

Install DaRT Tools

Review DaRT Installation

Crash Analyzer Wizard

Creating DaRT Boot Media

How to Create the DaRT Boot Media

Using DaRT Boot Media Tools

BitLocker Drive Encryption

System Recovery Options

Startup Repair

System Restore

System Image Recovery

Windows Memory Diagnostics

Command Prompt

Microsoft Diagnostics and Recovery Toolset

Troubleshooting

Common Errors on the Microsoft Diagnostics and Recovery Toolset Client

You might need to manually extract and install 64-bit definition updates for Standalone System Sweeper:

Unicode characters are not displayed in some circumstances:

DaRT 6.5 command-line installation will silently fail if run with the quite mode option unless it is run using elevated administrator permissions:

File search fails to move a folder to a different volume:

There is no Input Method Editor (IME) support on ERD:

Some data may not be available on machines where the drive letters are remapped:

Accessing the Microsoft Support Knowledge Base

Contacting Microsoft Training

Introduction to the Trial Guide

This trial guide is designed to help you quickly set up and evaluate Microsoft®Diagnostics and Recovery Toolset(DaRT) in a test environment. This guide provides details of the steps necessary to install DaRT components. You will install Microsoft Diagnostics and Recovery Toolset, create an Emergency Repair Disk, and then review the DaRT tools that will help you accelerate desktop repair.

To help this process flow as smoothly as possible, we recommend that you read this guide carefully before installingMicrosoft DaRT.

Audience for This Guide

This guide was written for Microsoft Windows®system administrators and PC technician support professionals. As an information technology (IT) professional, you should have sufficient knowledge and experience to accomplish the following tasks:

  • Installing software
  • Creating ISOs and boot disks
  • Troubleshooting system startups

Product Documentation

Comprehensive documentation is available in the Microsoft Diagnostics and Recovery Toolset Help.

Release Notes for Microsoft Diagnostics and Recovery Toolset 6.5:

A Tour of the Diagnostics and Recovery Toolset:

Overview of MicrosoftDiagnostics and Recovery Toolset

Many IT departments take a proactive approach to backing up network data, but tend to be reactive in planning for desktop system failures because they have no tools or processes in place that enable them to be prepared. Instead, they typically reimage problem machines, but that can result in a loss of user settings, personalization, and data. Microsoft Diagnostics and Recovery Toolset can help you save time and reduce the challenges associated with troubleshooting and repairing system failures on Windows-based desktops. Administrators can easily restore PCs that have become unusable, rapidly diagnose probable causes of issues, and quickly repair unbootable or locked-out systems, all faster than the average time it takes to reimage the machine. When necessary, you can also quickly restore critical lost files. This helps IT teams make PCs safer to use, keeps employees productive, and makes desktops easier and less expensive to manage.

Microsoft Diagnostics and Recovery Toolset 6.5is a complete suite of powerful and versatile tools that allow you to repair unbootable or locked-out systems, restore lost data, and diagnose system and network issues while the system is safely offline. Microsoft DaRT includes the following tools:

Crash Analyzer

This lets you examine a Windows crash dump file,helping you determine the problem that caused the system to fail. For more information about how to analyze a system crash, see the Crash Analyzer section in this guide.

ERD Commander

This is tool is used to create the DaRT disk, a boot disk that adds functionality to the Windows Recovery Environment (Windows RE), which provides utilities and wizards that help perform system diagnosis and repair procedures, such as recovering data, disabling problematic drivers, and removing hotfixes. For more information about diagnosing and repairing systems, see the Creating DaRT Boot Mediasection in this guide.

System Recovery Options

Once you start the computer with the DaRT boot media, Windows RE is launched, and presents the administrator with questions to initialize the environment, including initializing the network adapters as well as selecting the language and Windows installation for repair. After preparing the environment, you see the System Recovery Options dialog box, which contains the following options:

  • Startup Repair
  • System Restore
  • System Image Recovery
  • Windows Memory Diagnostics
  • Command Prompt

A detailed description of each of these options can be found later in this guide.

DaRT Tools

When booting from DaRT boot media, an additional option to the normal Windows Recovery Environment menu is presented, the“Microsoft Diagnostics and Recovery Toolset” link. When you click this link, you are presented with an additional 14 tools, including a Solutions Wizard, to help you decide which tool is best to use in your current scenario, and a Help link. These tools are listed below in Table 1, and detailed individually later in this guide:

Task / Solution
Edit the Registry / The ERD Registry Editor utility provides information about the registry that can help you repair a system.
Regain access to a system / The Locksmith wizard can be used to list the local user accounts and change passwords.
Diagnose a system failure / The Crash Analyzer can be used to diagnose the cause of a system crash and identify the driver that caused the failure.
Salvage and repair partitions or volumes / The Disk Commander can be used to salvage or repair partitions, or volumes.
Recover deleted files / The File Restore utility can be used to find and restore deleted files from any supported Windows-based file system.
Erase disks or volumes / The Disk Wipe utility can be used to securely erase disks or volumes.
Search for particular files / The Search utility allows you to restrict the scope of your search by specifying part of the name, search location, estimated size of the file, or the time when the file was modified.
Browse drives / The Explorer utility allows you to browse folders and files that are stored on various drives.
Perform administrative tasks to manage the computer / The Computer Management utility provides recovery tools to help you:
  • Disable problematic drivers or services.
  • View event logs.
  • Partition and format hard disk drives.
  • Get information about Autoruns.
  • Get information about the computer.

Configure TCP/IP / The TCP/IP Config utility helps you to display and set a TCP/IP configuration.
Uninstall Windows hotfixes and service packs / Hotfix Uninstall can be used to remove Windows hotfixes or service packs from a system that cannot be started.
Check and repair system files / The SFC Scan utility helps you check system files and repair any that are corrupt or missing.
Use an antimalware tool / The Standalone System Sweeper utility helps detect malware or other unwanted software, and alerts you to potential risks.

Table 1: List of tools included in the DaRT Boot Disk

Trial System Requirements

For this evaluation,one computer will run Microsoft Windows 7. You can use virtual machines on a single physical computer that meets the system requirements of this trial.

In this trial, it is important that you set up Microsoft Diagnostics and Recovery Toolsetin a test machinethat is not your production workstation since you may be performing tasks that may disrupt the use of this system. The purpose of this trial is for you to gain an understanding of the tools available to administrators withDaRT. You can address any questions relating to integration into your production environment, such as which tools to give to administrators, developing a process for updating the antivirus and antimalware definition files,and developing documentation for IT staff.

The following section lists the computer systems used for this trial evaluation.

Microsoft Diagnostics and Recovery ToolsetDesktop Client

  • Windows7 Enterprise or Ultimate Editions
  • Windows Server®2008R2

Minimum Hardware Requirements

  • 1GHz 32-bit (x86) or 64-bit (x64) processor
  • 1GB of system memory
  • CD or DVD drive (writeable CD or DVD drive required to create ERD CD or DVD)
  • BIOS support for starting the computer from a CD or DVD drive

Checklist of Tasks

The following table lists all the tasks that need to be completed in the correct order. If you have not worked with DaRT before, it is strongly recommended that you follow this sequence of tasks carefully to ensure a successful installation and test of the DaRT system. If you complete all the tasks listed under “Basic Tasks” you will have successfully completed the basic system evaluation. If you want to continue with evaluating other system components, refer to the list of tasks under “Additional Information.”

Before You Get Started

Task / Pre-Requisite / Tip
Creating DaRT Boot Disk / Windows 7 or Windows Server 2008 R2 installation media / Copy installation media to a network share or local directory prior to running the ERD Commander Boot Media Wizard
Windows Debugging Tools / Download from
Windows Symbol Files / Download from

Basic Tasks

Area / Task / Method
DaRT 6.5 Tools / Create en_desktop_optimization_pack_2010_x86_x64_dvd_x16-58156.iso / Download MDOP ISO
Establish access to DaRT tools / Install DaRT Tools
Look at results of the DaRT installation process / Review DaRT Install
Crash Analyzer for DaRT 6.5 / Go through the Crash Analyzer process / Examine Crash Analyzer
DaRTBoot Media for DaRT 6.5 / Establish access to a failed system by creating the DaRT Boot Media / DaRT Boot Media
Review DaRT Tools / DaRT Tools

Additional Information

Area / Task / Method
Crash Analyzer for DaRT 6.5 / Test Crash Analyzer process with demo crash dump files / Crash Files

Installing Microsoft Diagnostics and Recovery Toolset

The section guides you through the step-by-step process of installingMicrosoft Diagnostics and Recovery Toolset.

Note: You must use the software and operating system versions listed in the following section to ensure that the instructions and screen shots are accurate for the purposes of your testing and evaluation.

Download and Create MDOP ISO

MSDN and TechNet subscribers can download DaRT and use in a proof-of-concept (POC) or test environment. In order to download the Microsoft Desktop Optimization Pack (MDOP) to license for production use, you must be a Software Assurance (SA) customer. For more information on becoming an SA customer, go to

Existing SA customers can download MDOP, and the entire suite of tools that it includes, at any of the following Microsoft sites:

Volume Licensing Service Center (VLSC):

MSDN:

TechNet:

Once you have downloaded the MDOP ISO file, burn the ISO to CD or DVD media. Then simply start the media, and install Microsoft Diagnostics and Repair Toolset.

Install DaRT Tools

Installing the DaRT tools is a simple process. Simply insert the MDOP media and the click the link for Microsoft Diagnostics and Repair Toolset, as seen in Figure 1. If your company policy disables Autorun features on CD and DVD media, browse to the Launcher directory and then click Launcher.hta.

Figure 1: Splash screen displayed when the MDOP 2010 media is run from CD or DVD media.

Once you click on the Microsoft Diagnostics and Repair Toolset link, you will be presented with another screen, with options to install different versions of DaRT for the different operating systems supported, as well as options for 32-bit or 64-bit OS support. See Figure 2 for a complete list of options available. Make sure you select the appropriate version for the desktop or server you need to recover. For the purpose of this guide, in the DaRT 6.5 for Windows 7 and Windows Server 2008 R2 section, select Install DaRT 6.5 (32-bit) or (64-bit) based on the Windows version installed.

Figure 2: Microsoft Diagnostics and Recovery Toolset can be installed to support many operating systems and versions.

Note: Documentation for each of the available options can be found on the MDOP media by browsing to the x:\DaRT\Documents folder (where x is the letter assigned to your CD/DVD Rom drive).

When you click Install DaRT 6.5 (32-bit), the Microsoft Diagnostics and Recovery Toolset 6.5 Setup Wizard will launch.

  1. On the Welcome to the Microsoft Diagnostics and Recovery Toolset 6.5 Setup Wizard page click Next.
  2. On the End-User License Agreement page, click I agree.
  3. On the Select Installation Folderpage, accept the default installation folder, and in the Install Microsoft Diagnostics and Recovery Toolset 6.5 for section, click AllUsers if other users will log onto this computer and need access to DaRT. Otherwise, leave the default setting and then click Next.
  4. On the Choose Setup Type page, select Complete to install the Crash Analyzer Wizard and the ERD Commander Boot Media Wizard.
  5. On the Ready to Install page, click Install.
  6. On the Completing the Microsoft Diagnostics and Recovery Toolset 6.5 Setup Wizard page, clickFinish.

Review DaRT Installation

When DaRT has been successfully installed, you will see the Microsoft Diagnostics and Recovery Toolset program group on your Start\All Programs menu. Within the program group you will notice four (4) available options:

  • Crash Analyzer Wizard
  • ERD Commander Boot Media Wizard
  • Help
  • Release Notes

The Help link will open a Microsoft Compiled HTML file (CHM) file with step-by-step instructions on using the two available tools. The Release Notes link will open the relnotes.htm file, which is also available in the C:\Program Files\Microsoft Diagnostics and Recovery Toolset directory.

Crash Analyzer Wizard

The Crash Analyzer Wizard helps you to analyze a crash dump file to identify the driver that caused the system to fail. You can use Crash Analyzer to review crash dump files, e.g., crash dump files that may be a result of a Blue Screen of Death (BSoD) incident.

Before using the Crash Analyzer tool, you should download and install the Microsoft Debugging Tools for Windows and Symbol Files. Microsoft Debugging Tools for Windows can be downloaded from You will also need a crash dump file to analyze.

The following is a list of options available for ensuring you have access to the Symbol Files:

  • Copy the Dump File to another system: If the Symbol Files cannot be downloaded due to a lack of an internet connection, copy the crash dump file to another system that does have an internet connection, and run the Crash Analyzer Wizard from that system.
  • Access the Symbol Files from another system: Download the Symbol Files from a system that does have an internet connection, and then copy the Symbol Files to the system that has the crash dump file you wish to analyze. Alternatively, you can download the Symbol Files to a system that has an internet connection and share the folder that contains the Symbol Files. Then from the system that contains the crash dump file you wish to analyze, map a network drive to that shared folder.
  • Access the Symbol Files through an HTTP proxy server: If the symbols cannot be downloaded because an HTTP proxy server must be accessed, use the following steps to access an HTTP proxy server:
  • In DaRT 6.5, the Crash Analyzer Wizard has a new setting available on the Specify Symbol Files Location page, marked Proxy server (optional, using the format "server:port"). You can use this text box to specify a proxy server. Enter the proxy address in the form <hostname>:<port>, where the <hostname> is a DNS name or IP address, and the <port> is a TCP port number, usually 80. There are two modes in which the Crash Analyzer can be run:
  • Online mode: In this mode, if the proxy server field is left blank, the wizard uses the proxy settings from Internet Options in Control Panel. If you enter a proxy address in the text box that is provided, that address will be used, and it will override the setting in the Internet Options.
  • Windows Recovery Environment: When the Crash Analyzer is run from DaRT, there is no default proxy address. If the computer is directly connected to the Internet, a proxy address is not required, so you can leave this field blank in the wizard setting. If the computer is not directly connected to the Internet, and it is in a network environment with a proxy server, you must set the proxy field in the wizard to access the symbol store. The proxy address can be obtained from the network administrator. Setting the proxy server is essential only when the public symbol store is connected to the Internet. If the symbols are already on the ERD disk, or if they are accessible locally, setting the proxy server is not required.
How to Open and Run the Crash Analyzer
  1. Click Start\All Programs\Microsoft Diagnostics and Recovery Toolset\Crash Analyzer Wizard.
  2. On the Welcome to the Crash Analyzer Wizard page, click Next.
  3. On the Specify Microsoft Debugging Tools for Windows page, type the path to the directory containing the Microsoft Debugging Tools for Windows, or click the download link to download the package, if you have not pre-downloaded the tools and have an Internet connection, and then click Next.
  4. On the Specify Symbol Files Location page, select the appropriate option, as described above, and then click Next.
  5. On the Specify Dump File page, browse to the location of the crash dump file you wish to analyze, and then click Next.
  6. On the Analysis Summary page, click to view the details of the summary, and then when you are finished, click Next.
  7. On the Recommendations page, review the recommended actions, and then click Finish.

Creating DaRT Boot Media