Chris Gray's blog

...finding an NTFS volume after accidentally deleting all your partitions (...go Dad...) :-)

2008-08-16T00:58:00Z

The other day my Dad called me on the phone wanting to know if data could be recovered from a freshly formatted disk. It seems that he formatted his primary hard disk and then accidentally plugged in the wrong power connector on his external backup disk. As silly as his actions seem how many of us back up our data (he does. daily). The problem was that he made two mistakes and as a result over 15 years worth of work were gone in an instant.

I'm blogging about this because his desperation got the gears turning and we were able to get all of his important data back - even after a quick format. I thought some of the more tech savvy people may get a kick out of what we did and I thought I'd take the time to plug Windows Home Server as a way to keep yourself out of this situation (hint hint .Dad :))

[NOTE: I'm sure there are better ways to do this task, I'm also sure what I'm doing isn't completely technically correct. I'm describing what I did over one weekend because worked for me, if you've lost real data you should consider finding a professional data recovery company]

What exactly did he do?
The problems started when he decided to reformat his computer with the goal of reinstalling from a backup. His backup software requires a fresh install of Windows to be completed before running restore, the idea is your provide a working copy of Windows and then the included restore software gets your computer up and running as it was before the format. His computer had one physical hard disk configured with two volumes C: and D: - C: contained all the operating system, D: contained all his data. His steps were as follows:

Step 1: repartition the primary disk to only have one disk (C:)
Step 2: create a new partition filling the entire disk (note, once completed there is only a C:, the D: had been removed)
Step 3: format the partition NTFS
Step 4: start installing Windows
Step 5: during install call me on the phone and describe what was happening
Step 6: on my instruction he yanked the power cord in order to stop the install

What he wanted:
Because the external hard disk containing all the backup data had been cooked (the electronics were bad) getting data off this disk wasn't possible without paying the manufacture well over $1500 for new electronics. (.we did keep this option in our back pocket in case something went wrong, the data is worth over $1500)

Since the D: volume contained all the important files it's conceivable that the data is still around, even after repartitioning and formatting the C: - here's why

When a disk is partitioned a small piece of data (512 bytes or 1 sector) is placed on sector 0 of your hard disk. This piece of data contains a little code called the Master Boot Record (MBR) as well as the partition table. Inside the partition table are the sector numbers for each of your volumes. In my Dads case there used to be two entries in the partition table, one for the C: volume and one for the D: volume. Think of the partition table as a map where each entry represents a location "to get to your D: go to sector 122945445". Then on sector 122945445 start running the code that you see - in the case of Windows you'll likely find an NTFS boot sector (this is the next step in how Windows boots).

Interestingly, the data he cares about begins at the ending of the old C: where the start of the D: volume began. There is a slight chance that because the disk is large and he yanked the power plug early that the data may still exist - even after a repartition and quick format of the C: volume.

This chance exists because NTFS (or really any filesystem) often won't erase all the data, just its bookkeeping data. Often this is done for performance reasons - erasing all the data on a disk can be really slow (figure 55megabytes a second - for a 500gigabyte disk you're looking at around 2.5 hours to do a full format).

My friend Adam says that I'm miserable at analogies and should never attempt one. but I've rehearsed this one in my head a few times so here goes J To help you understand all this pretend that your partition table is the card catalog at a public library. Contained in each card is enough information to locate the book you want within the library. In the case of your computer, the partition table can only hold four entries. but the idea is the same. Now pretend you lost your card catalog - would you panic? Probably not, you'd sure be annoyed as you'd have to spend hours rebuilding the cards. but the books would still be there and the information in those books would be preserved.

What my Dad effectively did was to destroy the card catalog in his library - each of his data files were right where they should be, he just didn't know where his books were.

The library analogy breaks down a little because the act of formatting and reinstalling Windows did in fact put some of his data in jeopardy. Think of it as destroying the first two floors of the library when the book you really care about are located on the third floor and above. The more he allowed the install to continue, the more floors were destroyed permanently.

What we went hunting for:
In order to rebuild his D: volume we needed to know exactly where his D: volume used to be located so we could modify the partition table. Getting this data isn't easy, the format and creation of the new partition table erased all mappings to the location of his data. We needed a way to sift through hundreds of gigabytes of data automatically looking for something that could identify the beginning of the D: volume. After banging our heads for a while we came up with the following (note there are probably better ways to do this, I'm just describing what worked for us J)

1. Clone the hard disk so if we goof up we'll be okay - this leaves the possibility for a professional to repair the disk and find his data
2. Write a little program to open up the PhysicalDisk and look for an NTFS boot sector if found
a. Manually open up each sector & see if it points to an MFT
b. With a sector number from #4 rebuild the partition table

Cloning the hard disk
If anyone cares I can write a blog about this, I wrote a little application that inefficiently copies one disk at the sector level to another disk. I'd be happy to post the source as a rough guide if someone asks.

Program to seek out an NTFS boot sector:
This is where the fun begins, when NTFS creates a volume it always sticks something identifiable at the first sector that describes the size of the volume, how many sectors are in a cluster, etc. This information, along with boot code, lets your computer boot up. We wondered if there could be something that never changed that we could locate programmatically. Turns out that NFTS puts a little signature in the beginning that Windows can later use to identify the disk as NTFS (and not FAT for example). We used a slick tool that ships with WindowsXP named 'dskprobe. Its on the XP install disk in \support\tools.

This simple program lets you read and write sectors on a disk - please do use caution when playing with dskprobe. It's dangerous if you accidentally misuse it! You can easily scramble your disk to a state where it's not usable any longer.

Using DskProbe on a working happy NTFS disk for illustration. Once you get the idea of how everything is put together we'll create a program that looks for our lost NTFS volume

1. Drives->Physical Drive
2. PhysicalDrive0 (double click)
3. "Set Active"
4. Ok
5. Sectors->Read
6. Starting Sector 0, Number of sectors 1
7. Read
8. Notice you've got all kinds of information, this is a working partition table - save it off for later use (File->SaveAs)

9. To figure out where NTFS begins view this data as a partition table (View->Partition Table)

10. Select the partition that you care about, I'm using Partition3 on my computer (so we can see a starting sector that's not for the first volume (not the C: volume), my sample working computer has three partitions

11. Note that the "Relative Sector" is 131057664 (multiply this by 512 bytes per sector to figure out where it begins in bytes). In my case this is about 62.493GB from the beginning of the drive! My first two partitions are approximately 60GB and 2GB - so this adds up to about 62GB. don't worry if the numbers aren't totally what you're expecting, there is a little fudge room in there when aligning to various boundaries). Hit the go button to see the contents of this sector

12. Flip back to the "Bytes" view (View->Bytes) and see what an NTFS Boot Sector looks like

13. See at the beginning you've got NTFS!

14. Hit View->NTFS Boot sector

15. Pay attention here J here in a bit, when you're fixing your disk, you'll use this step to know if you've got the correct boot sector
next to the "Clusters to MFT" button, click "Go"

16. This will jump your to the MFT records, click View->Bytes and look for FILE - if you found it you know that you've found the MFT. This is goodness

Using the below little snippet of code you can scan your disk looking for such signatures.

#include <windows.h>
#include <stdio.h>
#include <conio.h>
int _tmain(int argc, WCHAR* argv[])
{
    HANDLE h = CreateFile(argv[1], GENERIC_READ, FILE_SHARE_READ|FILE_SHARE_WRITE, NULL, OPEN_EXISTING, 0, NULL);
    if(INVALID_HANDLE_VALUE == h)
    {
        wprintf(L"Unable to open %s (GLE:%d)\n", argv[1], GetLastError());
        goto Done;
    }
    // go into a loop reading sectors
    __int64 sectorNumber = 0;
    DWORD dwBytes = 512*2*1024*10;
    BYTE *pTemp = new BYTE[dwBytes];
    DWORD dwRead = 0;
    for(;;)
    {
        LARGE_INTEGER offset;
        offset.QuadPart = (sectorNumber * 512);
        if(INVALID_SET_FILE_POINTER == SetFilePointer(h, offset.LowPart, &offset.HighPart, FILE_BEGIN) && NO_ERROR != GetLastError()) {
            wprintf(L"Error setting file pointer to sector %I64d GLE:%d\n", sectorNumber, GetLastError());
        }
        if(0 == ReadFile(h, pTemp, dwBytes, &dwRead, NULL)) {
            wprintf(L"Error reading sector %I64d GLE:%d\n", sectorNumber, GetLastError());
            goto Done;
        }
        if(dwRead != dwRead) {
            wprintf(L"Short read.\n");
            goto Done;
        }
        int numSectors = (dwBytes/512);
        BYTE *pTemp2 = pTemp;
        for(int i=0; i<numSectors; ++i)
        {
            if(0 == memcmp(pTemp2+3, "NTFS", 4)) {
                wprintf(L"**HIT on Sector %I64d\n\a\a", sectorNumber+i);
            }
            pTemp2 += 512;
        }
        sectorNumber += numSectors;
    }
Done:
    if(INVALID_HANDLE_VALUE != h)
        CloseHandle(h);
    return 0;
}

I know this code is a little murky to those who aren't programmers out there, since the procedure we're doing is risky I'm only including the code figuring this blog is mostly for fun.

You're almost done!
To wrap this project up you'll need to know where NTFS lays on the formatted disk. Run the program above to locate possibilities - use the sleuthing skills in dskprobe and hope that you can find where on disk your old volume used to be situated. You most likely will get multiple hits, you know when you've got a live one on the hook by browsing around seeking out the FILE bytes in the MFT.

To get your disk back, follow the steps from above where we were reading the contents but this time you're going to overwrite the index on the broken disks partition table based on the sector where NTFS was located by the program above. Write the proper sector value to the partition table, reboot (or unplug the disk), and cross your fingers!

Once you're up an running, should the disk show up, don't throw too big of a party - you may have serious data loss remaining. You should treat this disk as spoiled and should copy anything important to another hard disk.

Good luck - I know disk rebuilding is scary. After this drama with my Dad I bought him a Windows Home Server. He's still breaking computers, but with Home Server he can (.and has :)) recover from almost any problem.

A brief description of the balancing algorithms used for disk balancing in Home Servers PP1 Drive Extender

2008-07-04T21:16:00Z

I've been asked by a few folks to describe the Power Pack 1 algorithms for "auto-migration", duplication, and balancing. In short the algorithms are the same with a few minor adjustments made based on customer feedback from our first release and the various Power Pack betas.

For reference there is a document located here with more info on the pre-Power Pack 1

http://download.microsoft.com/download/2/F/C/2FC09C20-587F-4F16-AA33-C6C4C75FB3DD/Windows_Home_Server_Drive_Extender.pdf

The decision of which volume a file will be located is based on one of three questions

Did the file get created for the first time (auto-migration)
Did the user ask for the file to be duplicated (duplication)
Does enough free space one volume allow another volume to offload some files (balancing)

Often caused by:

one of the servers volumes filling up

bunch of files get deleted

new hard disk added or removed

Auto-migration:

When a file is first created it's said to be "auto-migrated" this basically means a volume with sufficient free space was chosen to hold the file. The decision of which volume is designed to keep related files on the same volume in case of disk failure in case the folder was not chosen by the user for duplication. If you imagine a situation where your music isn't duplicated and you have a physical disk failure. You'd probably prefer to have one or two CD's go missing to having one or two songs from several albums go missing.

This is the algorithm Drive Extender uses to decide which volume to place your files

i.Use the volume with the least amount of free space but greater than 10GB
ii.Use the volume with the most amount of free space so long as it has more space than the Primary Volume (D volume)
iii.Use the Primary Volume (D volume)

If you play this out in your head with imaginary file copies I think you'll see how it ends up clustering files together. You'll end up filling up the volume with the least free space first and then moving to the most used filling it up next.

If we would have used a simple "most free" algorithm we'd get into a situation where once all volumes had the same amount of free space we'd interleave every other song/picture across several volumes.

Duplication:

Auto-migration doesn't duplicate your files or balance your files, it just chooses where the file first goes. Duplication occurs (in PP1) every hour with the goal of making sure your chosen files have multiple copies. The algorithm is to inspect every file looking for change since last duplication. If the file has changed or if the file has not yet been duplicated we create a duplicate copy using the below algorithm.

Duplication preferences for destination volumes

i.Most empty non-primary volume
ii.Primary volume

The algorithm here is a little different from auto-migration because it will end up interleaving between volumes. We did this because the problem of locality isn't as important since we're in the process of duplicating.

Balancing:

Balancing solve the problem of how to handle disk space imbalances. Just like duplication, balancing occurs every hour in PP1. The need to balance occurs typically with addition of a new volume or when the user deletes a bunch of files. The goal of balancing is to move files off any volume that contains less than 10GB of free space. If this condition happens we say the volume has reached a "danger" level because it's possible to have a situation where files cannot be extended (imagine your outlook .pst file getting bigger and bigger over time). [EDIT - thanks to Brett Pound at Microsoft for asking me to clarify. I mentioned an Outlook PST file while thinking of running Outlook locally on the Home Server. Brett kindly pointed out that using an Outlook PST file over the network is'nt a good idea. A better example would have been pasting in lots of photos into a Word document or growing a video file by adding in a new video feed.]

The PP1 balancing algorithm starts only when a volume contains less than 10GB of free space. When this occurs the goal is to start moving files to volumes with more space until 20GB is reached. Think of this as mowing your yard. You wait until your significant other tells you the yard is out of hand and you cut back the yard enough so it looks good and so that you don't have to do it again for a while - it's the same idea, in balancing we start moving files when the volume has less than 10GB free and we stop at 20GB so we don't have to come back for a while.

The algorithm for finding free space is the same as in migration with the only difference being we won't push another volume into an unhappy state in order to achieve self happiness. A quick example would be if during balancing a volume with 5 GB of free space we wont push another volume of its comfort range by making it go under 10GB.

Defining these numbers is tough as there are tradeoffs in all directions. If you've got huge hard disks with lots and lots of free space and gigantic files you may prefer bigger numbers (maybe 30GB and 60GB) but if you've got just two drives you may prefer smaller numbers. We used our extensive beta program to measure 10GB and 20GB as good numbers.

[error - apologies but I'm wrong here, these keys did not make the cut for the final release of Power Pack 1. Maybe we can get them into the next update]

~~However if you understand the description above you can reconfigure the 10GB and 20GB lines with the registry keys~~

~~HKLM\Software\Microsoft\DriveExtender (both are DWORDS)~~

~~"SecondaryFreeSpaceDangerLevel" (defaults to 10)~~

~~"SecondaryFreeSpaceWarningLevel" (defaults to 20)~~

~~both values are measured in GB~~

Home Server Recovery (4/4) : you don't want to replace the hardware, you just want your files back

2008-07-04T20:34:00Z

Well, it's been quite a while since I last posted on the four ways to recover files from a Home Server should you have hardware failure. Many apologies, I've been busily working as the Development Lead for the Drive Extender bug fix.

The fourth scenario in the set of four scenarios is simple, your home server hardware failed and you want your files back. You've removed the volumes from your Home Server and have attached the volume to a separate PC.

In this scenario you're not in supported territory, the steps below may modify the state of the Home Servers hard disk causing Drive Extender to no longer recognize the file. If you'd like to be in supported territory please use one of the rebuild steps described in one of the previous postings. This post is mostly for those who like to dig and understand how their server works behind the scenes and understand that they're out of supported territory.

The high-level steps are simple:

1. Gain access to your Home Servers hard disk
2. Locate the 'DE' folder
3. Locate your files & copy them onto a fresh disk

Step 1: Gaining access to your Home Server hard disk

For this step your best bet is to plug the hard disk into a second computer. You can either open up the case and attach the disk directly to the motherboard or you can use a SATA/IDE to USB2 adapter. Personally I like the USB2 adapters, the idea is you hook the hard disk directly to a box that makes the drive work exactly like an external USB disk. Typically these adaptors cost around $25 (and are well worth the cost)

Step 2: Locate the 'DE' folder

This part is easy, once connected to a separate PC using the USB adapter the disk will appear with a drive letter. Open an explorer window and navigate to the volume you want to recover

You'll need to show hidden files load Explorer and

Tools->Folder Options
View / Show hidden files and folders

Now you'll see the 'DE' folder

From this folder you can browse and locate your files just as you'd expect to see them on the WHS.

You can copy any file/folder that you'd like. One thing you may notice is that some files may be missing.

A missing file is most likely because the file is located on another volume on your Home Server. To recover this file follow the same steps given above but look for your file on each volume.

I'm hoping the part about some of your files being on another volume makes sense? Because Drive Extender balances files between volumes it's possible some files will exist on the other volumes in the server. For a nice description of how the balancing and duplication work see my next post :)

Home Server Recovery (3/4) : You’ve built your home server but can’t find identical replacement hardware.

2007-12-23T21:55:00Z

You’ve built your home server but can’t find identical replacement hardware.

This is a similar problem to what Daniel (my brother in law) suffered. After purchasing a copy of Home Server Daniel installed the software on to an old desktop computer. He installed on to a new 500GB disk and later added an older 150GB IDE disk. Long story short the computer was declared unusable when smoke poured out the power supply.

Although much of the hardware was unusable the hard disks seemed fine – he was able to plug both the 500GB and the 150GB disks into a second computer and was able to see his data.

I’ll leave the forensics of how to extract your data to a future post, in this post I’d like to show you how to recover your server if the drives are intact but the motherboard and various components are broken.

Goals:

· Preserve all ‘data’

o Shared Folders

o Backup database

Risks:

· You will lose all installed software, such as addons

· You will lose all user settings (remote access on/off), including user accounts

Steps (I’ll have some pictures below):

1. Remove the disks from your broken server

2. Open the case to your new server

3. Install the old disks into your new server – take care to place the disks in the same order as they were on your original system (make master/slave settings and cable order the same for IDE or port numbers for SATA controllers)

4. Boot and cross your fingers – if this computer reboots and launches Home Server you’re in good shape. Just go step 9

5. Should booting fail your new server differs enough from the hardware in your old server that you need to reinstall Home Server. Do this by placing the Home Server DVD into your DVD player and rebooting.

6. Follow the normal steps involved with Home Server Install. *IT’S VERY IMPORTANT* that you choose the “Server Reinstallation” option as seen in the below figure.

7. Progress along in the Home Server install until it’s complete – then reboot

8. Complete the Out Of Box Experience (OOBE)

9. Install needed drivers – follow the guidance that the hardware manufacture gave for your servers hardware. Typically you’ll just need network and maybe storage if you’ve got a fancy disk controller

The starting place:
I’m first going to create a Home Server install on a server with two SATA disks. One is 300GB, the other 150GB. On this server I’ve performed one backup of my client computer and have created a Shared Folder named ‘Test Share’. This share has a few files for demonstration purposes.

Figure 1: Server Storage before the first server broke

Figure 2: Test share (created before the server broke)

Figure 3: Putting the old disks into the new server - be careful if you're not putting in screws at this point!

Figure 4: Beginning the Home Server install

Figure 5: the all important step - "Server Reinstallation" - you must choose this else you will lose your data!

Figure 6: Install has started

Figure 7: Install Complete

Figure 8: Install Drivers

Figure 9: restored file shares

Figure 10: permissions on the folder - NOTE that we have no users as they were deleted during the recovery, your shares will default to no access (so you'll have to reconfigure their settings)

Figure 11: restored backup database

Figure 12: restored server recovery tab

Home Server Recovery: (2/4) you built your own Home Server and can find identical replacement hardware

2007-12-18T06:38:00Z

If you’ve purchased or built a Home Server and now are having hardware problems *but* can find identical hardware you’ll have a relatively easy time recovering should the hard disks be okay. This scenario is that you’ve banged something inside the computer and fried the motherboard, powersupply, or another major component.

How do you do you recover from this?

First assume that after the hardware failure that you’ve got working hard disks – if you do, just put them into the new computer with identical hardware and boot up, you should be good to go! The idea here is that the hard disks contain all information about hardware devices and configuration. Because the hardware is identical Home Server is unaware of any changes and as such just boots fine.

If you’re hard disks have failed, or if you want to take the primary C: volume back to factory conditions read my next post – how to repair your home server when you’re unable to find identical replacement hardware.

Home Server Recovery (1/4) : You’ve purchased an OEM device and want to go back to factory settings while preserving your data

2007-12-18T06:22:00Z

If you’ve purchased and OEM Windows Home Server, you’re in luck there are two likely scenerios and both result in you keeping your data…. I greatly wish Daniel (my brother in law) had an OEM device… so much so that Daniel is getting one for the holidays :)

If you believe that your old hard disks are in good shape recovery is really simple – buy a new identical Home Server, put your old hard disks in the new server, and then reboot. If all goes well you’ll be in business in just a few minutes.

Should the server not boot there is probably a problem on the primary C: volume. Examples could include the OEM slightly changing the servers hardware from the time you purchased your old one, the old volume has had a software problem that has prevented booting, or perhaps you’ve installed 3’ed party software that has made the server unhappy. In the case where simply replacing the hard disks doesn’t work you’re still okay, recovering from a major problem on an OEM device is simple – Home Server has a technology designed to image (refresh to factory conditions) the primary hard disk from the network. The idea is simple – at time of manufacture the OEM takes a “sysprep”ed image of the C: volume. This image contains a copy of Windows Home Server that has been put into a special mode, the mode will “personalize” itself on first boot. All tech jargon aside the idea is to tweak it’s settings to be customized for you while retaining the fingerprints of your OEM.

The procedure is simple

1. Press a button on the front of the device

2. Drop a DVD into your *client* computer

3. Follow the OEM’s instructions

4. Wait for the C: volume to be brought to its factory new state

Once reimaged your Home Server will ask for new passwords and will require you to recreate users – but it will preserve your backup database and all your files.

By far – this is the simplest route to recovering from a major failure (you dropped the server, installed some really broken software, or just forgot your administrator password)

Recovering from hardware failure on Windows Home Server

2007-12-05T20:00:00Z

Over the weekend I helped my brother in law (Daniel) recover from a destroyed Home Server. His motherboard and power supply had been destroyed by accident (be careful when you're working around an open case) :)

his problems got me thinking - recovering from hardware failure isn't difficult with Home Server, but odds are that you'll be a little panicked and having some tips may be useful

my best guess is that you'll be on one of the following situations

you have an OEM Home Server (like the HP MediaSmart Server)
you built your own Home Server and can find identical replacement hardware
you built your own Home Server but cant find identical replacement hardware
you dont want to replace the hardware, you just want your files back

along the way I'll explain how some of our technologies work so you better understand some of the new ideas in Windows Home Server. if you stumble on this little blog and would like to steer what I'm yapping about feel free to post comments :)

Discovering a nameless device -- kind of an interesting problem

2004-07-30T05:55:00Z

One common problems we've encountered while making home gateways (wireless access points) is how do you discover the silly thing? Most solutions end up shipping a preconfigured IP address or hostname on the device, some people query the DHCP server and I've even heard of people using netmon! :P

Each of these solutions has its own pro's and con's -- with a gateway its okay to have a user manual where 192.168.1.1 is the preconfigured IP address. The user just plugs in and uses their browser to navigate to http://192.168.1.1 for configuration. Other solutions will give a preconfigured hostname so the end user will configure by going to http://hostname. I think querying the DHCP server is totally acceptable, but my mom didnt send me to college to get that kind of answer ;)

Other solutions are to have a value burnt into the ROM/flash -- this either requires each device to be configured before it leaves the factory or for the device name to be built off something like a MAC address. Nothing bad here, but it makes for slightly confusing documentation. “go to http://device_XYZ.. XYZ can be found on a sticker on the back of the device” its not bad, but its clunky and requires printing a little sticker.

My solution to this problem was to make a little discovery utility that uses UPNP's SSDP (service descovery protocol). the idea here is when the device boots up it sends out a little UDP packet that announces its presence to the world. Because both WindowsCE and WindowsXP come with UPNP implementations this wasnt that tricky to setup. I've included a little sample in WindowsCE 5.0 in the directory %_WINCEROOT%\public\servers\oak\samples\upnp\discoverservice. This utility isnt exactally rocket science, in fact its kind of a joke. All it does is broadcast a little GUID that corresponds to the service that it supports with a URL for a configration webpage (known as a presentation page). You can find a little C# util that I wrote to listen for this here http://chrisgray.members.winisp.net/files/discoverapp.zip -- please note that “My Network Places” will also listen for it if you've got UPNP installed on XP.

The idea of this util is that it would be included in a CD or something that would have an autorun.inf to launch it. The user would plug in their totally nameless device, it would DHCP, and then it would begin broadcasting UPNP messages announcing its presence. The XP utility would then pick up the announcment and give the option to configure the device.

First Channel9 Video -- building a lightweight NAS device

2004-07-29T23:25:00Z

Well, this is my first post here -- wonder if I'll get bored of it or what will happen :)

anyway, Mike Hall and I put together a little video that shows the consruction of a lightweight NAS (Network Attached Storage) device running WindowsCE 5.0. You'll see a few technologies that we've added -- the biggest is our CIFS/SMB server. this is the server component that is used when you access a file/print share with \\server\share. Our server doesnt include many of the features that are included in WindowsXP or 2003 server but does have most of what you'll want. Most notibly we dont include DFS (distributed file system), ACL's on a per-file basis, our filesystem is limited to 120GB, and the max file size we can support is 4GB.

In addition to the file server you'll see a nifty little UI that we built -- the idea is that without much effort a 3'ed party can tweak our our UI (for branding etc). You can modify the toolbars, pages -- really anything. I hope to do either a little video or a whitepaper that describes more about this.

You can check out our video on MSDN's Channel9 at http://channel9.msdn.com/ShowPost.aspx?PostID=15298 -- please feel free to post comments here if you want features or something