Helping people with computers... one answer at a time.

Reformatting a computer erases everything on the primary hard drive, so it's important to save your data first. Backup solutions are often best.

My husband wants to reformat his computer, because of a virus. He wants to save certain files, and wants to know the best way to save those files.

First, I want to commend you on realizing that a reformat of your machine erases everything. Sadly, many people don't realize or overlook this aspect.

There are two approaches that I recommend, and the choice boils down to understanding exactly how confident you are that you won't miss anything.

And for the record, I'm never that confident, myself.

If you want to be totally, absolutely sure you don't miss something important, then you want to take a complete backup image of your computer.

By that I mean use a backup program line Acronis TrueImage or an equivalent, and backup your entire machine, most likely to an external hard disk.

Now, ideally this should mean no extra work on your part. Why? Because you should already be backing up regularly. It's perhaps the single most important thing you can do to prevent data loss due to any number of different disasters.

"If you want to be totally, absolutely sure you don't miss something important, then you want to take a complete backup image of your computer."

So if you are backing up regularly, just make sure you have a complete image of everything prior to reformatting.

If you're not backing up regularly, well then now would be a perfect time to start.

I'm going to assume that this wasn't the answer you were looking for. I strongly recommend that you backup and use a backup-based solution, but let's assume for a moment that you actually are totally protected in some other way and simply don't need to.

I'm also going to assume you know exactly which files you need to save; the entire list. I'll presume that you won't miss a single file that you'll be sorry to have missed later. (Yes, I'm still nudging you back to a backup based solution. Subtle, eh? Smile)

In that case, your options are actually fairly simple:

  • Copy the file(s) to floppy disks

  • Copy the file(s) to a USB flash drive

  • Copy the file(s) to an external hard disk

  • Copy (or "burn") the file(s) to a CD or DVD

  • Copy the file(s) to another machine on your local area network

Really, that's all there is to it. The bottom line is that you need to copy those files to some other place so that you can copy them back after your machine has been reformatted.

Of the options above, I tend to prefer burning them to CDs or DVDs.

Why?

Because that way you've also created a permanent backup of the files at the same time.

Yes, when it comes to backing up, I have a bit of a one-track mind.

Article C3469 - August 7, 2008 « »

Share this article with your friends:

Share this article on Facebook Tweet this article Email a link to this article
Leo Leo A. Notenboom has been playing with computers since he was required to take a programming class in 1976. An 18 year career as a programmer at Microsoft soon followed. After "retiring" in 2001, Leo started Ask Leo! in 2003 as a place for answers to common computer and technical questions. More about Leo.

Not what you needed?

13 Comments
Ziggie
August 7, 2008 12:16 PM

Leo, since the reader mentioned a virus, wouldn't an image of the hard drive also capture that virus? How would anyone be protected if they're re-instating the virus whenever they restore from backup?

--zigg

Ken B
August 7, 2008 1:39 PM

Yes, a full system backup would also back up the viruses. However, so would just backing up a single infected file.

The idea here is to make sure that you didn't miss an important file before the wipe-and-reinstall, because after the wipe, you're not going to get anything that you missed.

Once the system is reinstalled, and an up-to-date antivirus and anti-spyware program are installed, they should pick up any infected files that you try to copy back. (In fact, if you back up to a writable media, such as an external HD, you can scan it before restoring anything.)

And, once you have everything that you need restored, and the system is "clean", you can do another full system backup at that point.

Phil
August 8, 2008 2:10 AM

I'm confused - why can't a simple antivirus scan solve the problem? - Surely if the virus can be found and healed on the external hard drive back-up(or other media) before re-copying, then surely this can be done on the existing machine - Can someone please explain?

Ken B
August 8, 2008 8:21 AM

Well, some people are of the opinion that "the only way to be sure you got rid of the infection is to reformat and reinstall".

Beyond that, however, is the fact that many infections actively target and disable the antivirus/antispyware/etc. programs. If your system is infected, you many not be able to run the program.

The typical end-user, and many technicians, simply don't have the tools and the experience to remove many of the really nasty programs out there.

Leo
August 8, 2008 9:28 AM
There are several good questions and responses above. I want to touch briefly on the issues raised:

Zigg: you're absolutely correct, a full backup would also backup the virus infection. Note that I'm not suggesting that the machine be restored completely from that backup. The point is that the backup includes all the files on the machine, and as they're needed they can be extracted from the backup (and presumably virus scanned as well).

Phil: no, a simple anti-virus cannot be trusted to just fix the problem. The very definition of viruses and malware is that they go out of their way to be undetectable. In an absolute sense, once you've been infected by almost anything you've lost total control of your machine. You can run an anti-malware scan, but how do you know, I mean really know, that it caught and cleaned everything? You don't.

The closest any anti-malware scanner can ever get is: "we believe you're clear of everything we know about and everything that we could find". The corollary to that statement is that "you could still be infected by malware we don't know about, or that hid from us too well."

The reason that most people simply rely on anti-malware scanners to do the job is that most, but not all of the time even though there's no guarantee, it's enough. And it's generally impractical and very painful to reformat after every infection.

That's why prevention is so much less painful than the cure.

Thanks Ken B for your comments above as well; right on target.

-Leo
Fastfreddie1959
August 12, 2008 12:26 PM

when i try to remove a virus i also go into
the registry and delete it from there, but
this is based on if i know what the virus is.
Leo you are right, as i have encountered trojans
that will change names as fast as i can find it.
Ive even found them in the system32-folder
deleted it from there only to find that it
was buried in the registry so much that even
i couldnt find it.
But like you this is what i do..but i don't
have your knowledge and i could spend days
searching for answers when there are none.
I look forward to your Email solutions.

Colin Clements
August 15, 2008 10:26 AM

Hi Leo

Isn't a simpler solution to move the files in question to the D drive and just reformat the C
drive? The files can be left there permanently as they are easily accessed and scanned for viruses with a "clean" anti-malware program.

Regards

B
August 18, 2008 11:24 AM

I may be paranoid, but for a system rebuild I usually do a double back up. There is always a small chance that your backup will fail. [I have seen this a few times.]

[The first time I learned this was when a paper tape punch machine had a broken tooth on a gear resulting in an occasional irregularity in the hole spacing. More recently, I had a DVD burner that caused write errors in the last 10% of discs.]

Jeff Burns
August 19, 2008 9:06 AM

Leo,
You haven't mentioned the registry in this thread. When a hard drive is rebuilt from scratch, the new registry will be "clean". Why not restore the full image to a new folder, named something like "Restored from backup of Old Drive on MM-DD-YY". With the entire old folder structure under that one new folder, nothing in the registry will be pointing to those restored folders and files.

I then give myself a few months to "remember" what I forgot to restore into the new operational folders. If I haven't needed to recover anything for say, 6 months, I just delete that one folder and get all my disk space back.

By the way, the next time I run a full system scan, it finds the malware files in the "old" area and deletes them at that time.

I have a lot of respect for your thoughts on this Leo. If there is a flaw in my thinking here, please say so.

You've described what I do when I take a full backup before a rebuild. Doen't have to be copied back to the hard disk somewhere, but as long as it's available you can always go back and get files that you forgot. That's why I recommend it.

-Leo

Ken
September 4, 2008 7:00 PM

Please help! I have a virus so I'm trying to back up my pc and get rid of the virus and then restore my files. The problem is when I try this I get an error message saying catastrophic failure (0x8000ffff), what should I do!!! HELP!!! Ken

Lisa
October 25, 2008 7:25 AM

I have read through all of this and I was wondering if you know what to do in a situation where you can't start up windows, can't get to a DOS prompt, etc.... How can I get to my files to back them up now? I have an external hard drive and I want to do a full system recovery but I can't bring myself to do it until I have copied all my pictures, music files and documents over tot he external hd. Please help if you can. The manufacturer suggested going to someplace which services my brand of laptop, but that just reeks $$$$$. I'm fairly good at figuring things out myself and would rather give myself a headache fixing this instead of paying someone else to do something as simple as backing up a file. I just need to know if there is some way to get these files out of harms way.. . . Thanks, Lisa

There are a couple of approaches, but none of them what I would call "simple". You could temporarily put your hard disk as the second drive in another machine. You could try booting from a Linux live CD and if it recognizes both your hard drive and your external drive you could use it to copy the files. Most everything else would a variation on either of those themes: take the drive elsewhere, or boot from something that will read it.

All this assumes that the drive is actually working, by the way. If not then it's probably time for a technician's advice on the specific failure.

Finally, I have to point out that regular backups would prevent this crisis, so once you're set up again be sure to start backing up.
- Leo
26-Oct-2008

Michael
October 28, 2008 9:12 AM

In a case like Lisa's, SpinRite could very well be the solution. It fixes or relocates bad sectors and can often restore the usability of drives that have become so corrupt that windows cannot load or where the file system is unrecognizable. It saved my data last week, even if I did have to force mount my drive afterwards with a linux live cd to copy the files.

whs
October 28, 2008 11:40 AM

I think Knoppix is a good solution.
http://www.shockfamily.net/cedric/knoppix/

Comments on this entry are closed.

If you have a question, start by using the search box up at the top of the page - there's a very good chance that your question has already been answered on Ask Leo!.

If you don't find your answer, head out to http://askleo.com/ask to ask your question.