Saturday, December 22, 2007

Operating Systems: Investigating Corrupt Drivers

You suspect that some driver on your Windows XP system is the source of the system crashing and locking up.
How can you verify that all drivers on the system have not been changed?
1. Run DiskProbe.
2. Run the DMDIAG.EXE program from the Run dialog box.
3. Run ASR.
4. >>Run the SIGVERIF.EXE program from the Run dialog box.

Explanation : Windows 2000 and Windows XP support the verification of digital signatures assigned to device drivers. If you suspect a problem with a driver, run SIGVERIF.EXE to scan for drivers that are not digitally signed. To use the utility, enter the command in the Run dialog box.
A digital signature is an electronic signature that can be used to authenticate the identity of the sender of a message or the signer of a document, and possibly to ensure that the original content of the message or document that has been sent is unchanged. Digital signatures are easily transportable, cannot be imitated by someone else, and can be automatically time-stamped. The ability to ensure that the original signed message arrived means that the sender cannot easily repudiate it later.
A digital signature can be used with any kind of message, whether it is encrypted or not, simply so that the receiver can be sure of the sender's identity and that the message arrived intact. A digital certificate contains the digital signature of the certificate-issuing authority so that anyone can verify that the certificate is real.

If changes to the operating system cause instability or startup problems, you can use the Automated System Recovery (ASR) tool to restore the system state and all files stored on the system volume. ASR is a last resort option to use after you have unsuccessfully tried other recovery methods, such as rolling back drivers, restoring from backups, performing parallel installations, and using System Restore. ASR restores system state files and settings and restores your ability to start the system. For example, hard disk corruption might prevent you from starting Windows XP, and the damage might be serious enough to prevent you from using Safe Mode, Recovery Console, or the Last Known Good Configuration. ASR will restore the Windows XP files that originally were installed from CD-ROM and may place incompatible file versions on the hard drive if files from service packs had been installed after original installation.

DiskProbe is a sector editor tool for Windows XP Professional that allows administrators to directly edit, save, and copy data on a physical hard disk. With DiskProbe, you can replace the Master Boot Record, repair damaged partition table information, and repair or replace damaged boot sectors.

DMDIAG is a command line tool that displays the location and layout of dynamic disks and disk volumes.
Objective: Operating Systems