Why would you need to update your CNC machine anyway? Surely such a device is locked down and wouldn't fall prey to the kinds of vulnerabilities a corporate PC would. Presumably you're referring to the fact your CNC machine is setup to be operated remotely? The risk of someone accessing your CNC machine is probably lesser than that of someone infiltrating a corporate network and wreaking havoc on files, stealing information and credentials.
I'm in the same boat where I work with XP running on our CNC machines. You can only lock them down so much and still have support from the manufacturer. It's just a standard xp box like any office pc would be running. The machines are all on the office network and are connected to the internet. It is just too valuable to keep them off the network. The foreman who is operating the machine can look at shop drawings on the manager's computer. Someone in the office draws a piece of furniture in sketchup and can export a cut list directly the the CNC machine ready to run. Run a sheet of material on the machine and it deducts it from the materials inventory. etc etc etc
An operator that plugs in an infected USB drive that injects a virus that will destroy your Uranium enrichment facility? Air gaps are not what they used to be.
The USB drive was presumably infected on a computer that is or could be up to date though, indicating the strong possibility that even if the CNC machine were or could have been up to date, it would still be vulnerable.
What if you get a head crash on a boot drive? Can you reinstall from the original DVD? Maybe yes, but will the authentication code process, which needs a Microsoft server over the Internet, still work? What about getting the XP updates from the data of the DVD you have to the last XP updates? Are those still available? Can you get actual copies of the updates you can apply later without Internet access?
One solution is to backup XP with NTBACKUP. Ever done that? Did you ever try to restore from such a backup? Did it work? My guess is no on all of these. I do XP backups with NTBACKUP occasionally, and have successfully restored from such a backup, but that was not easy -- there was some severe mud wrestling involved. Indeed, the backup I had was useless. How to make a backup using NTBACKUP that will restore? There are deep, dark secrets there!
Live backup tools like NTBackup is only needed if the machine needs to be availble 24/7.
If the machine can be turned off for a couple of hours (not unreasonable for a CNC machine that would require routine maintenance anyway), the easiest way to back it up is to take an image of the entire hard drive. No need to reinstall, no need to mess with fickle filesystem-level backup tools. Just dump the raw binary contents of the hard drive. When needed, you just dump it back to the new drive and reboot. Everything will work as if it was a routine reboot.
Boot up a GPartEd Live CD, plug in an external HDD to store the backup, and do "dd if=/dev/sda | gzip -c > /external/drive/backup.gz". (If you don't need the whole drive, just backing up the MBR and C: partition works fine, too.)
the easiest way to back it up is to take an image of the entire hard drive.
You mean, say, just via XCOPY? So far for my
boot partitions (on one hard drive,
C: is an old Windows 2000 installation;
D: and E: are Windows XP installations;
and my usual boot partition is E:) I have
NTBACKUP of E: on I: on a separate hard disk.
I have successfully restored an NTBACKUP
of a boot partition back to the same drive
letter and boot partition and had a
good running system. Yes, NTBACKUP can
backup a live system, but what's really
involved in backup and recovery of a
boot partition, especially master boot records,
I don't know.
No, not xcopy. By the time you run xcopy, Windows has already booted. It's too late.
My suggestion was to use the 'dd' Unix command (outside of Windows, of course) to back up the raw 0s and 1s on the disk, so that it doesn't matter what kind of OS you have or what kind of paritions you have. It's a very powerful method that lets you make a verbatim copy of every single bit on the hard drive, but of course that also makes it easier to fuck up something.
On my system, especially considering the EOL of XP,
the main issue is just backing up a 'boot partition',
that is, a hard disk partition that is bootable, that
has the usual XP directory tree, and that otherwise has
as little as possible. For everything other than
a boot partition, I have a workable system based on
WinZip and DVDs. A 3TB external hard disk with some
suitable software, maybe just XCOPY, would be better.
Since I have two XP bootable partitions, I could boot one
of the two and get a backup of the other, bit for bit,
if I could find or write a utility such as the one you
mentioned for Unix.
But, then, much of this backup interest is recovering
after a hard drive failure, and if I replace a hard
drive then the new one will no doubt have to be larger
than the old one in which case I wonder if the bit for bit, or record for record, copy I have would boot if copied to the new drive.
That NTBACKUP will backup a live system is convenient but not essential. What is important about NTBACKUP for me
is that, finally, I got it to work, all the way, from
backup to restore.
I also have a copy of Acronis which likely I should
unwrap, study, work with, and use.
Exactly, if it isn't networked then it is basically just an appliance. Just as you don't need to update the software in your microwave oven, you probably don't need to update your CNC machine. The exception to this is probably new features, such as supporting new file formats perhaps.
There might be a slight concern that the CNC machine could be infected by USB-borne malware. The worse case there is probably just infecting other computers through additional USB sticks. That, or industrial sabotage, but that sort of threat was relatively unheard of until recently.
Comments
My CNC machines aren't so easy to update.
Why would you need to update your CNC machine anyway? Surely such a device is locked down and wouldn't fall prey to the kinds of vulnerabilities a corporate PC would. Presumably you're referring to the fact your CNC machine is setup to be operated remotely? The risk of someone accessing your CNC machine is probably lesser than that of someone infiltrating a corporate network and wreaking havoc on files, stealing information and credentials.
I'm in the same boat where I work with XP running on our CNC machines. You can only lock them down so much and still have support from the manufacturer. It's just a standard xp box like any office pc would be running. The machines are all on the office network and are connected to the internet. It is just too valuable to keep them off the network. The foreman who is operating the machine can look at shop drawings on the manager's computer. Someone in the office draws a piece of furniture in sketchup and can export a cut list directly the the CNC machine ready to run. Run a sheet of material on the machine and it deducts it from the materials inventory. etc etc etc
Sounds like a good use-case for a VLAN.
By all means let the XP machines communicate with the inventory server and the blueprints NAS, but don't let them route to the Internet.
If you need Internet Explorer updates for those you are using them wrong.
Do not underestimate the incompetence of someone who designed a big metal-cutting robot that runs Windows.
For closed systems I think there is no need to upgrade.
What is the harm of not upgrading, what is the worst thing that can happen?
Of course, this is for a system that is not connected to the outside world.
An operator that plugs in an infected USB drive that injects a virus that will destroy your Uranium enrichment facility? Air gaps are not what they used to be.
The USB drive was presumably infected on a computer that is or could be up to date though, indicating the strong possibility that even if the CNC machine were or could have been up to date, it would still be vulnerable.
What if you get a head crash on a boot drive? Can you reinstall from the original DVD? Maybe yes, but will the authentication code process, which needs a Microsoft server over the Internet, still work? What about getting the XP updates from the data of the DVD you have to the last XP updates? Are those still available? Can you get actual copies of the updates you can apply later without Internet access?
One solution is to backup XP with NTBACKUP. Ever done that? Did you ever try to restore from such a backup? Did it work? My guess is no on all of these. I do XP backups with NTBACKUP occasionally, and have successfully restored from such a backup, but that was not easy -- there was some severe mud wrestling involved. Indeed, the backup I had was useless. How to make a backup using NTBACKUP that will restore? There are deep, dark secrets there!
Live backup tools like NTBackup is only needed if the machine needs to be availble 24/7.
If the machine can be turned off for a couple of hours (not unreasonable for a CNC machine that would require routine maintenance anyway), the easiest way to back it up is to take an image of the entire hard drive. No need to reinstall, no need to mess with fickle filesystem-level backup tools. Just dump the raw binary contents of the hard drive. When needed, you just dump it back to the new drive and reboot. Everything will work as if it was a routine reboot.
Boot up a GPartEd Live CD, plug in an external HDD to store the backup, and do "dd if=/dev/sda | gzip -c > /external/drive/backup.gz". (If you don't need the whole drive, just backing up the MBR and C: partition works fine, too.)
You mean, say, just via XCOPY? So far for my boot partitions (on one hard drive, C: is an old Windows 2000 installation; D: and E: are Windows XP installations; and my usual boot partition is E:) I have NTBACKUP of E: on I: on a separate hard disk. I have successfully restored an NTBACKUP of a boot partition back to the same drive letter and boot partition and had a good running system. Yes, NTBACKUP can backup a live system, but what's really involved in backup and recovery of a boot partition, especially master boot records, I don't know.
No, not xcopy. By the time you run xcopy, Windows has already booted. It's too late.
My suggestion was to use the 'dd' Unix command (outside of Windows, of course) to back up the raw 0s and 1s on the disk, so that it doesn't matter what kind of OS you have or what kind of paritions you have. It's a very powerful method that lets you make a verbatim copy of every single bit on the hard drive, but of course that also makes it easier to fuck up something.
Thanks for the clarification.
On my system, especially considering the EOL of XP, the main issue is just backing up a 'boot partition', that is, a hard disk partition that is bootable, that has the usual XP directory tree, and that otherwise has as little as possible. For everything other than a boot partition, I have a workable system based on WinZip and DVDs. A 3TB external hard disk with some suitable software, maybe just XCOPY, would be better.
Since I have two XP bootable partitions, I could boot one of the two and get a backup of the other, bit for bit, if I could find or write a utility such as the one you mentioned for Unix.
But, then, much of this backup interest is recovering after a hard drive failure, and if I replace a hard drive then the new one will no doubt have to be larger than the old one in which case I wonder if the bit for bit, or record for record, copy I have would boot if copied to the new drive.
That NTBACKUP will backup a live system is convenient but not essential. What is important about NTBACKUP for me is that, finally, I got it to work, all the way, from backup to restore.
I also have a copy of Acronis which likely I should unwrap, study, work with, and use.
Exactly, if it isn't networked then it is basically just an appliance. Just as you don't need to update the software in your microwave oven, you probably don't need to update your CNC machine. The exception to this is probably new features, such as supporting new file formats perhaps.
There might be a slight concern that the CNC machine could be infected by USB-borne malware. The worse case there is probably just infecting other computers through additional USB sticks. That, or industrial sabotage, but that sort of threat was relatively unheard of until recently.