Axcient Help Center

Performing a Bare Metal Restore with the Replibit Recovery Toolkit

Bare Metal Recovery (or BMR) is the process of restoring a protected system directly back onto newly replaced hardware or a Virtual Machine. Using the Replibit Recovery Wizard, you can restore a Protected System from an Appliance or Private Cloud Vault without the need to first load an Operating System.

Before you begin the Bare Metal Recovery process, you should first download the latest Replibit Recovery Toolkit from the Axcient site. The Replibit Recovery Toolkit is built on Linux and contains a comprehensive set of tools and utilities for performing system recovery, diagnostics, troubleshooting, and general digital forensics.

To access the Replibit Recovery Toolkit:

  1. Download the latest Replibit Recovery Tool iso file from the Axcient website.

    image35.png
  2. Create a bootable USB flash drive or burn the ISO onto a DVD.

  3. From the target machine, boot from the USB or DVD and wait for the disk to load.

  4. On the desktop, you will find a set of utilities:

    1. The Disk Manager displays a list of all attached disk devices in the system, allowing you to mount or dismount disk volumes for file access.

    2. The GParted tool is a Graphical Partition Management utility.

    3. The Recovery Wizard recovers systems from a Replibit Appliance or Vault.

    4. The Remote Support link launches the Axcient online remote support portal.

      image36.png
  5. The system task bar gives you access to additional utilities. For example:

    1. The Launcher Menu gives you access to a list of installed applications.

    2. The Quick Launch bar gives you access to both Chrome and Firefox web browsers for your convenience.

    3. The File Manager allows you to browse local and network files and is similar to Windows Explorer.

    4. The Desktop Selector button allows you to toggle between two virtual desktops.

    5. The Task Tray contains the Network Manager and the Shutdown Menu.

      image37.png
Additional Utilities

In addition to its core utilities, like the Disk Manager and the Recovery Wizard, the Replibit Recovery Toolkit gives you access to tools that will help you perform diagnostics and troubleshooting tasks.

For example:

  • Clamtk is an antivirus scanner, used to scan and remove viruses and malware on an infected system, from the safety of an offline environment. Before launching Clamtk, use Disk Manager to mount the infected volume(s) of the offline system. You can then click the Update button to check for the latest updates.

    image38.png
  • The Forensic Registry Editor (Fred) is a utility to browse and edit Windows Registry files from within a Linux environment. Before launching Fred, use the Disk Manager to mount the disk volume containing the Windows system folder.

    Note

    By default, Fred opens the registry hive in read-only mode for forensic analysis. If you want to make changes to the registry, click the Edit menu and then select Enable Write Support.

    image39.png
  • GParted is a powerful partition management utility that allows you to:

    • Check, create, delete, resize, move, format, or copy partitions;

    • View multiple operating systems, computing platforms, and filesystems; and

    • View filesystems commonly available under Windows, Mac, and Linux.

      Right-click a partition within the main window for a list of operations that can be performed. After you select the required operations, click the Checkmark button in the top toolbar to perform all pending actions.

      image40.png
  • The Hardware Info utility provides a graphical display of discovered hardware within the system. This tool is useful for determining which drivers you might need to install when recovering a Protected System to a different hardware or virtual device.

    image41.png
  • iSCSI Manager is a simple utility for managing connections to remote iSCSI disk volumes.

    iSCSI Manager operates similarly to Microsoft’s iSCSI Initiator tool on Windows. You can use this tool to connect to disk volumes that have been exported from a SAN or NAS device, or from an Appliance or Vault.

    image42.png
Hardware Requirements for a Bare Metal Restore

When you select your replacement hardware, pay attention to the hardware specifications and limitations of the Bare Metal Recovery process.

The Bare Metal Recovery process requires the following:

  • 1GB RAM

  • 1Ghz CPU

  • Bootable DVD or USB Support

The following recovery scenarios are unsupported:

  • Bare Metal Recovery cannot be performed onto any hardware platform that requires Windows-only drivers. For example, you cannot use any system with an unsupported motherboard RAID adapter (for example, Dell PERC S3xx series, Intel Cxxx controllers, and HP SmartArray B120/B320, as well as most white-box motherboard RAID controllers).

  • The Recovery Wizard cannot recover systems with multiple Windows volumes on a single physical disk. Please reference the Knowledgebase for a different set of instructions.

Performing the Bare Metal Restore Process

When your hardware is prepared, you can begin the Bare Metal Restore process. We highly recommended that you test the Bare Metal Restore process to become familiar with both the recovery process and its limitations, ensuring you are prepared in the event of a real disaster.

Note: After performing a full system recovery, Replibit will automatically perform a new Full Backup at the next scheduled time in order to synchronize the recovered system with the backup image. This Full Backup will only write changed data, but it is essential to ensure that the Backup image remains in sync with the Protected System.

To perform a Bare Metal Restore:

  1. From the system that you wish to recover, boot from the Replibit Recovery Toolkit CD or USB image.

    image43.png
  2. Before beginning the recovery process, click to launch the Disk Manager utility from the desktop.

  3. In the Disk Manager utility, examine the properties of the physical disks installed in the system. Make a note of their size and device names. You will need to know the Linux device names where you plan to restore. Unlike Windows, Linux does not use drive letters to identify disk devices. For example, the first disk in the system is typically /dev/sda and the first partition on that disk would be /dev/sda1. Note: The destination disk selected for recovering a volume must be at least as large as the original Windows source volume.

    image45.png
  4. From the desktop, launch the Recovery Wizard.

    image46.png
  5. In the Recovery Wizard utility, enter the following information:

    1. In the IP address field, enter the IP address (or FQDN) of the Appliance or Private Cloud Vault from which you are recovering your Protected System.

    2. In the Username field, enter the username of an admin on an Appliance, or the Customer account on a Vault.

    3. In the Password field, enter the password of the account entered above.

  6. Click the Next button to continue.

    image47.png
  7. In the next screen, use the Choose Protected System to recover drop-down menu to select the Protected System that you would like to recover.

  8. In the Choose Snapshot to restore field, select whether you would like to restore from a list of recent Snapshots or from a specific date.

  9. Click the Next button to continue.

    image48.png
  10. If you selected to restore from a list of recent Snapshots, use the Choose Snapshot to restore drop-down menu to select the specific Snapshot.

    If the Protected System is protected by an encryption password, you will also be prompted to enter the password. Please note that the Recovery Wizard always exports iSCSI volumes in Live Mode. If you are recovering a system that has been running as a virtual machine in Live Mode, select the same running recovery point so that you restore all data changed while virtualized in recovery mode.

  11. Click the Next button to continue. The Recovery Wizard will now initialize iSCSI services, export the selected recovery point on the Appliance or Vault, and attach the disk volumes.

    image49.png
  12. When the iSCSI operations have completed, click the Next button to continue.

    image50.png
  13. In the next screen, select the Windows disk volumes that you would like to restore and then select the local disk where the snapshot will be restored.

  14. Click the Next button to continue.

    image51.png
  15. When all recovery operations have completed, click Finish to close and exit the wizard. Reboot the system immediately; or if you are restoring to a system with dissimilar hardware, you will need to inject drivers into the offline system.

    image52.png
Injecting Drivers

If you are performing a BMR to a system with dissimilar hardware, you will need to inject drivers into the offline system.

To inject drivers:

  1. From the desktop, click to launch the Disk Manager utility from the desktop.

    image44.png
  2. In the Disk Manager utility, find the volume containing the C: drive of the Protected System.

  3. Mount this C: drive volume. For example, if you restored C: to /dev/sda, and the second partition contains the C: drive data, select that partition and click the Mount button.

    image53.png
  4. From the desktop, click the Launcher Menu, point to Recovery Tools, and select Driver Injector.

    image54.png
  5. In the Driver Injector screen, configure target settings:

    1. The Select target Windows Operating system drop-down menu will automatically discover the mounted system. If not, make sure the volume containing the C: drive is mounted.

    2. In the Select the folder containing your Windows Driver files section, click the Browse button to select the location containing the Windows drivers you would like to install.

      image55.png
  6. In the pop-up window, select the location containing the Windows drivers you would like to install.

    1. To use the basic set of Windows drivers that have been included on the Replibit Recovery ISO, select /root/Windows-Drivers.

    2. Select Auto scan the System32\DriverStore\FileRepository option to scan the native Windows driver library for device matches.

  7. Wait for the Driver Injector to read through the provided driver files. Verify that driver matches have been located for all critical hardware, such as storage controllers.

    You can choose to manually add specific drivers by selecting the Add button. Please note that the Driver Injector does not validate manually selected drivers. Ensure that you select only drivers that are valid for this Windows Operating System and Architecture.

  8. When you are finished adding drivers, click the OK button.

    image56.png
  9. Click the Next button to continue.

  10. The selected drivers will now be installed. Click Finish when the installation process completes.

    image57.png

Note

After performing a full system recovery or virtualizing a system in Live Mode, Replibit will automatically perform a new Full Backup at the next scheduled time in order to synchronize the recovered system with the backup image. This Full Backup will only write changed data, but it is essential to ensure that the backup image remains in sync with the Protected System.

Recovering a Domain Controller

If you are restoring a Domain Controller, you will need to perform additional steps when booting for the first time after recovery. Simply restoring a Domain Controller to an earlier point in time is insufficient, as the directory is replicated to multiple Domain Controllers and time-stamped with a serial number to identify the latest version.

For example, on the first boot after recovering the Domain Controller, you will need to press the <F8> key and then choose Directory Services Restore Mode from the boot menu. You will also need the original Directory Services Restore Mode Administrator password created when this server was promoted to a Domain Controller. If the Customer does not have this password, contact Microsoft for support.

For complete instructions, please reference the Knowledgebase.

Note

If you allow the Domain Controller to boot normally before performing the steps outlined in the Knowledgebase, Active Directory will be overwritten by replication from other Domain Controllers, and you will have to perform the server recovery again to gain access to the historical directory data.