Reply
Contributor
Hallmark
Posts: 19
Registered: ‎12-01-2011

Re: NIS 2012 doesn't scan my RAID drives

I must start with a 'mea culpa'.  It looks like my original post should have been titled;

 

      "NIS 2012 doesn't scan my *GPT* drives"

 

With that out of the way, I think it's time for me to shut up and just listen for a while as a new discussion seems to be emerging.

I recall a phrase about people having 'one mouth and two ears' for a good reason - so I'll listen and learn.

 

Thanks again all.

Hallmark

 

 

 

 

 

twixt
Posts: 246
Topics: 6
Kudos: 119
Blog Posts: 0
Ideas: 0
Solutions: 13
Registered: ‎09-26-2011

Re: NIS 2012 doesn't scan my RAID drives


DaveH wrote:

twixt wrote:


Hi, Hallmark.  A NIS "Virus Scan" does much more nowadays than just look at files.  The latest rootkit malware infects the MBR.  Also, several pieces of malware make a "hidden" partition to store their files - so things don't show up in the user's boot partition to be revealed by a malware scan.

 

Thusly, NIS Scans nowadays inspect the MBR and the Partition Table to look for evidence of the above kinds of infection. 

 



Norton scans network folders and shares.  That must be done by "just looking at them".  It can't possibly access or read the MBR over a network.

 

Dave



Hi, Dave.  Yes, you are correct.  This is a consequence of the way Windows accesses "Network" files - which is very different from the way Windows accesses "Local" files.

 

Network file access is filesystem independent.  This is how, for example, a user with Windows 98 configured with its local filestore in FAT mode can access/read/write to a network fileshare on an NTFS Partition - even though that W98 machine knows absolutely nothing about NTFS.

 

The above is also how Mac and Windows machines can store/retrieve files from each others' systems - regardless of the filesystem used on either machine.

 

As a result, the Scan-procedures NIS uses for Network Scans are file-based.  They are completely independent of the filesystem hosting the files.

 

 

However, Local file access is filesystem dependent.  Thusly, scans to Local Hard Disks must scan for the unique vulnerabilities that only Local filesystems display.  Since Hallmark's situation clearly describes the necessity to work with GPT - and Windows Backup's refusal to store his backups on the GPT-filesystem Drive Array - by definition those drives are hosted locally by his motherboard.

 

Thus, they are not network fileshares on (for example) a NAS served by Linux - or a NAS using any other filesystem that breaks the 2TB limit.

 

 

Consequently, NIS needs to examine the MBR and the Partition Table on the locally-hosted RAID Array to look for evidence of malware.  And therefore, Hallmark bangs into the problem with the current version of NIS being unable to understand 64-bit GPT partition-table entries.

 

Ditto with Speed Disk.   Speed Disk does not "see" Network fileshares that have assigned Drive Letters - and rightly so.  Since there is no access to the FAT or MFT through a network fileshare - there is nothing for Speed Disk to work with as far as defragmentation is concerned.  So again, Speed Disk only works on Local Hard Disks.

 

 

Once NIS (and all the rest of the related Symantec Software such as NU, Ghost and N360) are updated to understand and work with Local Disks partitioned with GPT - the whole problem described in this thread will go away.  Until then, we have the "gotchas" mentioned.

 

 

Contributor
Hallmark
Posts: 19
Registered: ‎12-01-2011

Re: NIS 2012 doesn't scan my RAID drives

I listened (OK - I read) and I've learned.

 

I could suggest a 'fallback' to simply reading local (GPT based) files with standard system calls that most apps use, then virus scanning the contents. But - your answer makes good sense explaining the way things are, not as I might wish them to be.

 

No good for defrag of course but would provide *some* virus detection functionality where there is currently none.

 

Thank you twixt (et al)

 

 

Contributor
Hallmark
Posts: 19
Registered: ‎12-01-2011

Re: NIS 2012 doesn't scan my RAID drives

OK - I'm probably about to show a good example of how a little learning is a dangerous thing.

 

Having done some research on GPT, including http://msdn.microsoft.com/en-us/windows/hardware/gg463525,  I see it includes a 'Protective MBR'.  This seems designed to provide information along the lines of (pardon the not technical language) "I exist but if you don't understand GPT then don't mess with me!"

 

As my NIS2012 scans one item on each of my two GPT drive letters, D & E, I assume that one item is the 'Protective MBR'.  If that is the case, at least the message is working!

Atomic_Blast
Posts: 1,135
Kudos: 217
Solutions: 39
Registered: ‎09-05-2011

Re: NIS 2012 doesn't scan my RAID drives

Hi Hallmark:

 

I submitted a Product Suggestion for Norton GPT partition support in this thread...

 

http://community.norton.com/t5/Product-Suggestions/Need-GPT-support-for-all-Norton-products/td-p/608...

 

As a suggestion, you might want to post in the Malwarebyte's Forum and see if they support it, as a temporary

solution. I don't think that they do at this time. GPT and the Unified Extensible Firmware Interface (UEFI)

are relatively new technologies which haven't (yet) penetrated the mainstream market.

 

Kind of similar to 64-bit Browser and Native USB 3.0 support.

 

It's coming; Patience! :smileyhappy:

 

Best,

 

Atomic_Blast :)

"Every day is just another increment on the bell curve of life."
Contributor
Hallmark
Posts: 19
Registered: ‎12-01-2011

Re: NIS 2012 doesn't scan my RAID drives

Thanks and I've already added my 'second' for your GPT support request.

 

I understand that all things take time but GPT isn't so new and has been a predictable issue looming with the constant growth of storage.  While I know marketing folk don't like to list the things a product can'd do, I think it would more honest if Symantec mentioned somewhere (that is *readily* found) that GPT isn't currently supported.  I had a good look at the website product pages and searched through the forums before posting my original message.  I wont claim I read everything in the forums but I couldn't find mention it wasn't supported.

 

Interestingly, Symantec provide an explanation of GPT in their glossary - http://www.symantec.com/business/security_response/glossary/define.jsp?letter=g&word=gpt-guid-partit... - but singularly fail mention their products *don't* (yet) support it.  Actually, the System Requirements for Ghost Imaging Tools states "Support for FAT, FAT32. NTFS, non-boot GPT partitions, native Linux ExT2 and ExT3" but NIS2012 has no mention (I can find) of GPT whatsoever. 

 

So, the claims of Symantec products supporting all those 32 and 64 bit versions of Windows (assume TM and C and all of that so MS don't sue me) are perhaps just a little 'Economical with the truth'.

 

Good job I'm not a lawyer :-)

twixt
Posts: 246
Topics: 6
Kudos: 119
Blog Posts: 0
Ideas: 0
Solutions: 13
Registered: ‎09-26-2011

Re: NIS 2012 doesn't scan my RAID drives


Hallmark wrote:

OK - I'm probably about to show a good example of how a little learning is a dangerous thing.

 

Having done some research on GPT, including http://msdn.microsoft.com/en-us/windows/hardware/gg463525,  I see it includes a 'Protective MBR'.  This seems designed to provide information along the lines of (pardon the not technical language) "I exist but if you don't understand GPT then don't mess with me!"

 

As my NIS2012 scans one item on each of my two GPT drive letters, D & E, I assume that one item is the 'Protective MBR'.  If that is the case, at least the message is working!



Hi, Hallmark.  Yes, NIS would read the "Protective MBR" - since for compatibility reasons that MBR is located exactly where it is normally created using any utility which creates MBR Partitions using 48-bit LBA.  NIS would also read the Protective MBR's Partition Table.  However, the whole idea behind the "Protective MBR" is to prevent Utilities that do not understand GPT from seeing a "missing" MBR and an "empty" MBR-style Partition Table - and then interpret that as if the drive was unpartitioned.  (User: GAK!  What happened to my data!)

 

The idea behind the "Protective MBR" is to create a placeholder - to keep non-GPT-aware Utilities from monkeydiddling with what they don't understand.  The above allows backwards-compatibility - by allowing non-GPT-aware Utilities to be installed on machines using GPT Partitions - while ensuring those non-GPT-aware Utilities do not have the ability to access GPT Partitions in error while-at-the-same-time avoiding reports of "things that aren't so".

 

 

Now, let's talk about why GPT-support is not yet supported in NIS.  Adding support for newly-emerging technologies in something as vitally-important as Anti-Malware Software is fraught with risk.  There is an expectation from the General Public that this stuff is supposed to be absolutely bulletproof before it is released.  Yet, the environment required to properly test said advancements has not demonstrated verified stability itself.  So, things get delayed until the environment required to test said improvements demonstrates in the real world said stability and reliability.

 

You have commented in a previous post that Windows 7's own Backup Utility refuses to back up to GPT targets.  Hmmmm.  Now why would that be?  Could Microsoft themselves be somewhat-less-than-confident in the "bulletproofness" of their Backup Software when it comes to GPT support?  Nobody knows.  However, what should Symantec interpret that lack-of-support to mean - in the absence of any explanation from MS as to why said GPT support is missing from MS' own Backup product?

 

Ah, ze light bulb - she begins to glow dimly...  :smileywink:

 

 

As corollary support for the above contention - there is the issue of Microsoft recommending that users continue to use the 32-bit version of MSIE - despite the existence of the 64-bit version.

 

Similarly, there is the issue of Microsoft recommending that users continue to use the 32-bit version of Microsoft Office - despite the existence of the 64-bit version.

 

See the thread at the following link for some of the reasons why Symantec find it prudent to delay the full implementation of 64-bit program support.  The same rationales are equally as valid for support of the 64-bit GPT Addressing Scheme.

 

http://community.norton.com/t5/Norton-Internet-Security-Norton/IE64-and-NIS/td-p/596894

 

 

 

Some comments over-and-above those in the abovementioned thread:

 

So, here we have GPT - an entirely new Partitioning Scheme requiring an entirely new method of Boot Support through the UEFI BIOS.  No history.  No track record.  If I was Symantec, I'd be sweating mightily at risking the Company's reputation by supporting that feature before it is demonstrably stable.  Furthermore, IMO there are not enough systems out there using GPT for either MS or Symantec to know whether or not there's a showstopper bug in that new Partitioning Environment which has yet to reveal itself.  There has certainly been a lot of evolution of UEFI BIOS code - motherboard BIOS updates for new boards are rife with housekeeping errors and "flavour of the month" BIOS releases/rereleases.

 

Since the Boot Process for GPT is handled by the UEFI BIOS - and the UEFI BIOS is a demonstrably unstable environment - would you "bet the Company" on something this unverified in the real world?  With your reputation at stake with millions of users?

 

Hmmm.  Thought not...  :smileyhappy:

 

 

Contributor
Hallmark
Posts: 19
Registered: ‎12-01-2011

Re: NIS 2012 doesn't scan my RAID drives

Hello twixt

 

You bring to light many valid points and nothing I can really disagree with.

 

Discussing generalities, I agree MS themselves can't be said to have fully embraced 64 bit yet.  I know they will often cite their reasons for recommending 32 bit IE and Office as being that the third-party add-ons are not there yet - but we can all take a view as to how significant that really is.

 

My Symantec/NIS issues are in two areas.

 

1.  I'd like Symantec to be rather clearer their support for GPT is currently close to non-existent.

 

2. This is a lot longer than one, above, but stay with me please.  I think my particular setup - or similar - is fast moving into the mainstream (although I don't claim it's there yet).  Specifically, a modest size SSD to boot and store apps for fast startup with a large conventional (rotating) hard disk data store.  As for 'large' data storage it could be RAID or single disks with 3TB devices readily available at reasonable cost.

Defragging of the GPT drives is available from within the OS (but not as we have seen Backup!) so defrag/speed disk are not big issues for me.  What I'd like to have is AV scanning that can give me some peace of mind beyond my caution and generally sensible approach to downloading.

So, if the AV components would at least read the files on the GPT drives and scan them for me I would receive some benefit.  Reading the contents of these disks is not a problem for even ancient apps - some code I wrote 10+ years ago in Borland C++ is perfectly happy reading directories and files from the RAID/GPT.  My surprise therefore is that there seems to be no fallback to a simple read and scan files using standard system calls - so who cares about the file system or partition table?

 

NIS recognises the drive letters on GPT exist and seems to get as far as reading the partition table so I'm thinking along the lines of (pardon the lack of logic diagrams and the use of colloquial language) ;

 

     Read drive MBR.

           Result = 'Regular' stuff - carry on as usual.

           Result = 'Weird' stuff - hmm, let's just see if the OS will provide a list of directories

                         Result = Directory list - then read the files and scan (similar to network drive)

                         Result = Error - then move on to next drive letter or exit.

 

I understand and accept that is far from a perfect solution (and horribly simplistic).  However, it seems to me (perhaps a further demonstration of my ignorance I admit) that it would be a fairly straightforward way to provide some AV functionality without great effort.  Not philosophically so different from virus scanning network drives and step in the right direction at least.

 

Perhaps I've missed something - and to be clear, I'm not banging the table in frustration or anger, it's more a matter that I'm curious.

 

Is it really that if they can't provide *complete* support for GPT, they won't provide *any* support for it in AV products?  I've noticed that they list limited support for GPT in the Ghost product pages (and quite possibly on the box - I've not read one).  Could it be that there a feeling that Ghost users are a little more technically savvy and can understand limitations while the masses who use NIS couldn't understand limited protection (and as a result get none, for now at least)?

 

Just my speculation and curiosity and I don't think any of the above disputes your much appreciated input.

 

Thanks again

Hallmark

twixt
Posts: 246
Topics: 6
Kudos: 119
Blog Posts: 0
Ideas: 0
Solutions: 13
Registered: ‎09-26-2011

Re: NIS 2012 doesn't scan my RAID drives


Hallmark wrote:

Hello twixt

 

You bring to light many valid points and nothing I can really disagree with.

 

Discussing generalities, I agree MS themselves can't be said to have fully embraced 64 bit yet.  I know they will often cite their reasons for recommending 32 bit IE and Office as being that the third-party add-ons are not there yet - but we can all take a view as to how significant that really is.

 

My Symantec/NIS issues are in two areas.

 

1.  I'd like Symantec to be rather clearer their support for GPT is currently close to non-existent.

 

 

[stuff deleted in the interests of brevity]

 

 

Is it really that if they can't provide *complete* support for GPT, they won't provide *any* support for it in AV products?  I've noticed that they list limited support for GPT in the Ghost product pages (and quite possibly on the box - I've not read one).  Could it be that there a feeling that Ghost users are a little more technically savvy and can understand limitations while the masses who use NIS couldn't understand limited protection (and as a result get none, for now at least)?

 

Just my speculation and curiosity and I don't think any of the above disputes your much appreciated input.

 

Thanks again

Hallmark



Hi, Hallmark.  IMO, Symantec would leave themselves completely vulnerable to a negative-marketing campaign - no different than found in many Political Arenas at election time - if Symantec were to officially admit the existence of a feature that is not yet out-of-beta nor properly validated in real-world terms. 

 

 Consequently, I think it is wise for Symantec to state (when prodded and only if required) that: "It's in development, we will release it when it's ready - and not until".  And even then, IMO they are within their rights to say nothing at all - if they consider that the most prudent course of action.

 

Furthermore, Symantec is already getting slagged by its competitors for missing X64 support for MSIE - when MSIE with X64 Flash Support has been demonstrated as acceptably stable as a valid test-environment for less than 2 months.

 

To anyone with Software Development experience, this slagging is utterly unjustifiable.  Why are Symantec's competitors even talking this way?  To me, it reeks yet-again of negative-marketing bias.  I think Symantec does very well by not rising to the bait in this regard.

 

 

Furthermore, IMO you have hit the nail on the head with your closing paragraphs.

 

Many NIS users look at NIS as an "appliance".  They plug it in, turn it on, and it's just supposed to work.

 

What you propose as an acceptable partial-workaround for you -  would leave Symantec open to howls of outrage if they acceded to your request and added "Limited Support for GPT" to NIS.

 

Even if the limitations were clearly delineated in the Product Details - the information would be irrelevant.   Many many many Computer Users see only what they want to see - and are puzzled or confused when reality intrudes upon their preconceived notions.  The result, in many situations, is irretrievable data loss.  This is very accurately described by the Wise Old Computer Saying: "When all else fails, read the instructions."  Regardless, this doesn't seem to happen all that often.  :smileysad:

 

Symantec must design and build NIS so it works well for the "typical" computer user - who wants a "set and forget" environment.  That the product "just happens" to work well for expert users also - is icing on the cake.  But make no mistake - expert users are a small minority of the total Computer User cohort.

 

Note: That expert users happen to be the people - who can find and fix the problems that all computers manifest - is very useful.  However, this in no way confirms we reflect the thinking of "Joe Average".  No way, no how, not at all.  :smileywink:

 

 

 

Finally, that Symantec have added GPT support to Ghost for non-boot GPT Target-Drives/Arrays - is IMO a very courageous move.  Especially considering that MS has not yet gone there with its own Backup product.  But yes, Ghost users tend to be a much more knowledgeable and reliability-driven breed than typical computer users.  Thus, I would be willing to bet that Ghost users who have a GPT Drive or Array have at least some of their images backed up onto MBR 48-bit-LBA Drives as well.  Belt and Suspenders is the usual Ghost motto. (RAID1 Arrays to 5-level Backup Sets as well as Archives - on several different Target Drives here)  :smileyhappy:

 

 

 Hope this fills in more of the missing pieces for you.

Atomic_Blast
Posts: 1,135
Kudos: 217
Solutions: 39
Registered: ‎09-05-2011

Re: NIS 2012 doesn't scan my RAID drives

Hi.

 


twixt wrote:

 

Finally, that Symantec have added GPT support to Ghost for non-boot GPT Target-Drives/Arrays - is IMO a very courageous move.  Especially considering that MS has not yet gone there with its own Backup product.  But yes, Ghost users tend to be a much more knowledgeable and reliability-driven breed than typical computer users.


 

Ghost is not the only game in town. Actually, Acronis True Image Home 2012 and their business line also supports GPT.

 

http://kb.acronis.com/content/24018

 

Atomic_Blast :)

"Every day is just another increment on the bell curve of life."