Snapshots and recovery¶

Practical 2.7 snapshots-and-recovery-annex.pdf · PDF

Has a phone or a computer ever refused to start on you? A logo that never goes away, a black screen, a restart that never ends. What did you do — and what did you lose?

On Friday 19 July 2024 that happened to about 8.5 million Windows computers at the same time. Airports, banks, hospitals and shops stopped around the world. It was not an attack: it was an update. The last page said always update. This page is the other half: before you change a system, know how you will go back. Then you break your own machines on purpose — and get them back.

8.5 million blue screens¶

The security company CrowdStrike sent an automatic update to its Falcon program for Windows. The update contained an error. Every PC that received it showed a blue screen, restarted, and showed it again.

The fix could not be sent over the network, because the machines never finished starting. A person had to go to each PC, start it in a recovery environment — a small rescue system — delete one file (C-00000291*.sys) and restart. Machine by machine.

Three safety nets¶

Think of a trapeze artist. Nobody tries a new jump without a net underneath — and the net goes up before the jump, not after the fall. Computers have three kinds of net:

A snapshot is the saved state of a virtual machine's disk at one moment, which you can return to.

In virt-manager a snapshot lives inside the VM's qcow2 disk file: the file keeps the old blocks and writes the changes next to them. That is why taking one takes seconds.

Put up the net¶

A snapshot of each VM¶

In virt-manager, open deb-lab (on your connection to the class server) → View → Snapshots → the + button → name before-break → Finish. Do the same for win11. Then check it on the host. The host is the class server, so open a terminal on your PC (not inside a VM) and log in to it with the same user and password as in virt-manager:

ssh <user>@<server>    # the same login as virt-manager
virsh -c qemu:///session snapshot-list deb-lab
exit                   # back to your PC

It prints a table with Name, Creation Time and State: two rows, clean and before-break. The state is running if the VM was on when you took it, shutoff if it was off.

A restore point in Windows¶

A restore point is a saved copy of Windows' system files, installed programs and settings at one moment.

In win11: Start → type Create a restore point → open it. Select drive C: → Configure → Turn on system protection → OK. Then Create… → name before-vlc. Windows answers The restore point was created successfully.

System Protection is off by default on Windows 11. No protection, no restore point; no restore point, no way back.

Break A: the lost password¶

Recall the boot relay from Unit 1: firmware → bootloader → kernel → login. The bootloader, GRUB on Debian, shows a menu for about five seconds. Most people never look at it. It hides a door: recovery mode.

Recovery mode starts Debian with almost nothing — no desktop, no network, one text screen — and gives you a shell as root to repair the system.

The exercise: your neighbour changes your password in secret.

sudo passwd USERNAME

(USERNAME is your user name in the VM.) Log out. You cannot log in. Now get the machine back:

1. Restart the VM. Click inside the window at once and press Down to stop the countdown.
2. Choose Advanced options for Debian GNU/Linux, then the line that ends in (recovery mode).
3. It asks Give root password for maintenance (or press Control-D to continue): type the root password.
4. Set a new password and restart:

passwd USERNAME
reboot

The prompt in recovery mode ends in #: you are root. passwd asks twice for the new password and answers password updated successfully.

mount -o remount,rw /
passwd USERNAME
sync
reboot -f

Break B: the lost menu¶

Now delete GRUB's configuration file and restart:

sudo rm /boot/grub/grub.cfg
sudo reboot

The VM stops at a black screen with GNU GRUB and a bare grub> prompt. Which runner of the relay dropped the baton? The bootloader: it started, but it no longer knows which kernel to load.

Do not try to be a hero at the grub> prompt. In virt-manager: View → Snapshots → select before-break → the play button (Run selected snapshot). It takes seconds.

Then log in. Which password works now — the old one, or the one from Break A? The old one. The snapshot is older than both breaks, so it threw away the bad change and the good one.

The Windows Recovery Environment¶

WinRE (Windows Recovery Environment) is a second, tiny Windows that lives in its own partition of the disk and can start when the big one cannot.

It is where the CrowdStrike file was deleted, 8.5 million times. Four ways in:

1. From a working Windows: Start → Power → hold Shift and click Restart.
2. Settings → System → Recovery → Advanced startup → Restart now.
3. Start the PC from a Windows installation USB and choose Repair your computer.
4. By itself: after two failed starts in a row, Windows opens it automatically.

The first screen offers Continue, Use a device, Troubleshoot and Turn off your PC. Under Troubleshoot → Advanced options:

Safe Mode starts Windows with only the basic drivers and no extra programs, so that you can find and fix the problem.

In Startup Settings → Restart → press 4: a black desktop, the words Safe Mode in the corners, low resolution, no network. Safe Mode does not fix anything by itself; it gives you a quiet room to work in.

Windows: go back in time¶

Install a program, and create a document:

winget install --id VideoLAN.VLC -e

On the Desktop, create a text file notes.txt with one line in it. Then Win+R → rstrui.exe → choose before-vlc → Scan for affected programs (it lists VLC as "will be deleted") → Next → Finish. It restarts by itself; do not force the VM off while it works.

After the restore:

Which net, for which fall?¶

flowchart TB
    F["<b>Something broke</b>"] --> Q1{"Do you know<br>the exact cause?"}
    Q1 -->|"yes"| H["<b>Repair by hand</b><br>recovery mode, WinRE,<br>Command Prompt"]
    Q1 -->|"no"| Q2{"Is it a VM with<br>a snapshot from before?"}
    Q2 -->|"yes"| S["<b>Revert the snapshot</b><br>lose every change since"]
    Q2 -->|"no"| Q3{"Windows, with a<br>restore point from before?"}
    Q3 -->|"yes"| R["<b>System Restore</b><br>documents stay"]
    Q3 -->|"no"| B["<b>Recovery tools,<br>then the backup</b><br>(Unit 4)"]

A real laptop has no snapshots. If it does not start after an update, what is left is the recovery tools — and then the backup.

Key takeaways¶

• Put the net up before the change: a snapshot, a restore point, or knowing how to repair by hand.
• A snapshot saves the whole VM disk at one moment; reverting throws away everything after it. It is an undo button, not a backup.
• GRUB's recovery mode gives a root shell to repair Debian, for example to reset a password.
• A restore point brings back system files, programs and settings, never your documents. System Protection is off by default.
• WinRE is a tiny Windows for repairs; it opens by itself after two failed starts. Safe Mode starts Windows with the minimum.

Quick check¶

Snapshots were one button in virt-manager. Next you see the same button in the tool that data centres use — and you build a small data centre inside the class server: Proxmox VE.