Disaster Avoided -- A Corrupted Microsoft Access Database File

I had a near miss today, almost losing my main address list, which I keep in Microsoft Access. I haven't used it in quite a while, as I have another list of recent address changes, but it's still my most comprehensive list of mailing addresses. When I tried to open it today, I got a message that it was in an "inconsistent state" and Access would try to repair it. Next, an error message that it "can't be repaired" or "isn't a Microsoft Office Access Database File."

I tried using my backup copies, but they had the same problem. It has been very long--4 years!--since I've put backups onto CDs or DVDs, simply because it takes so many of them, and have been relying mainly on one or two levels of medium term backups on an external hard drive.

Of course, this is far better than nothing, but the risk is just what I encountered today: having a file lost or corrupted and not knowing about it until the last "good" backup is gone. The same can happen with a virus. If you are keeping system backups but a virus has silently infected your machine, it could happen that all your backups are infected by the time you discover the problem.

I tried the solutions I found on the Microsoft site and by Googling, but they didn't work. The main thing I learned was that when your Access database is corrupted, there is a good chance that it's not something you can repair on your own. There are professionals who will do it, and some commercial programs. I tried one program, Advanced Access Repair, which quickly showed me that my data was recoverable. I was all ready to pay the $29.99 price of the program to actually recover the data, then noticed that the price is really $299.99. Oops.

Happily for me, the next program I tried was MDB Repair Tool, by Skysof, and it promptly repaired the database without my having to answer any questions or try different options. It just worked. To my surprise, this "trial" version actually recovered all the data for me for free, and I still have 58 more uses before I have to register. What a deal!

Lessons learned:

• If you can't or don't want to save full backups to long-term media (DVD, CD, tape, or online), then you should at least save your most important data that way once in a while. This method is risky because you might miss data you should have backed up, but at least you will have most of what you need. (Be sure to include your email in your backup; it may not be included if you're not careful).
• My address list doesn't need to be kept only in an Access database. I could periodically backup the actual address information so a simple text file. Then, if I lost the Access file, at least I would have the essential data.
• Hopefully I won't ever have to repair another Access database, but if I do, MDB Repair Tool will be the first thing I try.
Technorati Tags: backup,security,data,database,Access,tools,recovery,repair

Don't neglect online backups

A week ago, one of my friends was mugged on his way home from school on a bike path. He was badly beaten and ended up unconscious in the hospital. Though his bike, computer and some other things were stolen, and despite his injuries, I suspect that his most serious loss is much of the work he had done on a masters thesis. Apparently any backups he had were also stolen.

It's one thing to lose your most recent work, and losing your whole email store can be serious. But what if you lose something you've been working on for years--that book you're writing, a carefully compiled bibliography, your research data, a major proposal for your organization? It's almost unthinkable, yet it happens. Data loss is sure to happen if you have no backup strategy, but it can happen even if you do have backups. For example

• Backups may be lost along with your computer in a fire, theft, evacuation and so on
• Backup media may fail or be destroyed. Here in Nigeria, at least, flash drives have a high failure rate. CDs and DVDs can be scratched or damaged by sunlight and heat.
• If your original data becomes corrupted and you don't immediately know it, you may store the corrupted data in the backups.
• When do yo discover that your backup is damaged or corrupted? That's right, you discover it when you need it because your original data is lost.

For these reasons, it is important to have more than one level of backup for any data that is important to you. For any data that is really important, you should have at least two and preferably three backups stored in a way that they cannot be lost simultaneously. For example, you could keep one copy on a hard drive at work, one copy on a flash drive or re-writable CD at home, and one copy online.

In my last post, I briefly mentioned that one use of Dropbox was backing up your data online. Online backup should be more than an afterthought--it should be an important part of your backup strategy. Most of us in Africa do not have the luxury of a low-cost Internet connection that will let us back up all our data, let alone the whole system, but we can back up what is most important. Apart from multimedia files (video, pictures, music), your most important data, what you've actually invested the most time on, is probably a few hundred megabytes at most. You should at least consider saving some or all of it online.

There are many online data storage services, including a fair number of free ones. I like Dropbox--it works for me--but another solution might work better for you. One thing I like about Dropbox is that it keeps previous versions of changed and deleted files. That feature has already saved me a couple of times.

David Bradley's article "Make SkyDrive a Virtual Drive" describes the free Microsoft SkyDrive online service and add-ons that make it more useful and transparent. Some people send their important documents to their own online email addresses (a Gmail account, for example). It's not the simplest or most secure method, but it's a lot better than nothing.

Dropbox: A free, low-bandwidth solution for online file sharing, syncronization and backup

One of my projects is the book AIDS Is Real and It's In Our Church, which I co-authored. The English version has been quite a success, Hausa and Amharic editions are in print, and now we're working on the French version. One of the technical problems we've dealt with is simply how to share the files between authors and editors on different continents, while being sure that corrections and updates are made to the right file. Once, in the Hausa version, I spent quite a few hours making corrections and then discovered that the file I'd been given was not the latest.

There are many approaches to this issue, which after all is a common one whenever people are collaborating on documents. One of the particular constraints for some of us though, is that the solution has to be low-bandwidth, simple, and free (or at least very low cost). It simply isn't practical to be uploading and downloading a 20 MB file every time it is changed.

I've looked briefly at Google Docs, which works fine and would be my first choice for documents that don't have a lot of formatting requirements. Collaborators work (even simultaneously) on a document in Google's own format, stored in cyberspace somewhere, and that document can be exported when necessary to another format. Documents can be text (with pictures), spreadsheets, or presentations. Google Docs is free, doesn't require any setup, and lets users work online or offline (that is, you can edit documents even while not connected to the Internet, and they will be saved again when you are online).

Google Docs won't do what I need at the moment, though, which is to allow people to edit Microsoft Word and Publisher documents. That is where Dropbox has been a real help. I use it to

• Share files with co-workers, automatically keeping everyone's copies synchronized
• Work on files from different computers without having to do anything manually to keep them synchronized
• Keep online backups of projects I'm actively working on, so that the backup is always current.
  

Here's how it works:

1. Download and install the free software (currently a 14 MB file). It creates a special My Dropbox folder on your computer.
2. Register as a user with the service. You get a 2 GB online folder free, and can pay for more storage.
   
3. "Once installed, any file you drop into your Dropbox folder will synchronize and be available on any other computer you've installed Dropbox on, as well as from the web. Also, any changes you make to files in your Dropbox will sync to your other computers, instantly."
4. Dropbox does not transfer the entire file each time it is changed, but only sends the changed portions. This means that when I change one word in the 20 MB file, only a small amount of data has to be sent back and forth over the Internet, not 20 MB. That makes it useable over our low-bandwidth connection.
   

You can use the Dropbox folder like any other folder. Drag files into it, make sub-folders, add and delete files, and so on. All those files and sub-folders will be transparently synchronized with your online folder and with any users sharing those files. That last point is important. People sharing your files do not have to do anything to keep their copies up to date, as Dropbox does that in the background.

Example:

1. I create an "AIDS is Real" folder inside my Dropbox folder and drag my 20 MB aids_is_real.doc file into it.
2. If my collaborator does not already have Dropbox installed, I send her an invitation to install it.
3. I mark the AIDS is Real folder as shared with my collaborator, for reading and updating.
4. The Dropbox software automatically downloads aids_is_real.doc into my collaborator's computer.
5. I open my copy of the document from my local Dropbox folder, make some changes, then save and close the file (changes are not synchronized until the file is closed).
6. Dropbox software automatically saves my changes to the online copy and to my collaborator's local copy. When my collaborator opens her copy, it is always up to date (as of the last time she was connected to the Internet).
   
7. Likewise, when my co-worker changes the file on her computer, those changes will be reflected in my local copy (almost) immediately.

Give it a try! It's well worth the effort if only for the ability to keep 2 GB worth of your important projects safely backed up online. (Of course, how safely depends on the long-term survival, security, and stability of Dropbox; you shouldn't depend on any one service for the backup of your valuable data).

Now you can use Twitter in Nigeria

This is the good news I learned today from Jon's latest blog at Appfrica.net. In case you don't know, Twitter is a "micro-blogging" service that lets you send tiny posts, limited to 140 characters each. The posts appear on your page where (as you choose) others can view them, but they can also be broadcast by mobile phone text messaging (SMS) to anyone subscribed to you. You can choose to let everyone subscribe, or you can let only approved individuals subscribe, depending on your needs.

The problem has been that last year Twitter stopped sending out those SMS messages in most countries of the world, basically because they didn't have any way to fund the service--someone has to pay for all those messages. Now, as Jon describes, you can use a new service called Twe2 which does send text messages around the world. They're financed by attaching a small text advert to each one, which seems to me a reasonable price to pay to receive free text messages by Twitter.

I'm still trying to subscribe ... it's very easy but requires your mobile phone number to be verified, and sometimes here in Jos it takes many hours for SMS messages to be received, so the verification could take a while.

Now, if I can just figure out a good reason to use Twitter ...

Mobile Internet Services in Jos, Nigeria

As I said in the previous post, I've been researching the mobile ISPs that are currently available in Jos. It's a dynamic situation, with several companies entering or about to enter the playing field, and with promises of broadband 3G service to come "soon". Since 3G is already available in some cities in Nigeria, we hope the "soon" is actually in the near future, this year sometime.

As I said in the previous post, I am summarizing all my information as I gather it, on the Mobile ISPs page in the Living in Nigeria wiki. So go there for more details and for more recent news. Add information if you have it!

The summary at this point is:

• Although advertising as high speed, MTN offers low-speed (GPRS) service with a variety of monthly and day plans (from a few hours to a full 24 hours). They plan eventually to have broadband (GSM family, UMTS)
• Multi-links and Zoom offer medium-speed (1x) connections. They plan to have broadband (CDMA family, EVDO). I don't know about actually-observed operating speeds.
  • Multi-links requires you to buy a 21,000 naira phone or 16,000 naira (unavailable) modem.
  • Zoom requires you to buy a 3,000 naira phone or 10,000 naira modem.
  • Multi-links and Zoom both have a variety of plans, but only Multi-links has day plans.
  • Zain and Glo do not offer intermediate range (1x) service and don't seem to have any attractive features at this point.
• My personal experience with MTN on only a few occasions has been that it is not worthwhile (too slow).
• I have heard from one person each for MTN, Zoom, and Multi-links that the service has been fair (MTN, Zoom) to good (Multi-links).

My friend who has been testing Zoom (with the rather bulky 1x/EVDO modem) told me today that it's not tolerable for browsing, as far as he is concerned, with very low speeds at times. However, he pointed out that it's ok for email since that can trickle in at any speed.

It is very important to remember that while the companies advertise a connection speed and while the hardware could in fact support that speed, the actual speed is still limited by how much bandwidth the company chooses to pour into the pipeline. Bandwidth is expensive and so far the companies are not actually giving out as much as they could, or so it appears to the consumer.

Using a Blackberry phone in the bush in Nigeria

I plan to post a couple of blog entries soon about using mobile internet services in Nigeria, specifically in Jos rather than in the big cities. If you're interested, you can see and contribute to the wiki page where I'm gathering and organizing the information I have. Meanwhile, this note came from Tom Crago. He is having better luck with a Blackberry phone in the village than I am having with an MTN modem in Jos.

We are using a Blackberry 8830 World Edition cell phone in Nigeria which we obtained and are paying for in the USA. We are currently in the small village of Kwarhi, on the grounds of EYN's Kulp Bible College. This is about 13 km west of Mubi in Adamawa State. By comparision, Jos is a huge metro service area.

The phone is designed to search for the best available service connection wherever we may be. At different times it has connected to MTN or CelTel (now Zain) while we have been in Nigeria. Here in Kwarhi, and in Jos while we were there, it has connected to CelTel's GPRS system. It took about one minute to download the wiki page you reference in your article.

The phone was purchased in the US for 99 dollars, and we got a 70 dollar rebate. Net cost about 29 dollars. Price probably can't be matched now.

We added the global service to this phone just before leaving the US. I don't recall the sim chip charge--20 dollars or so I think. We are charged 65 dollars a month, on top of our US domestic voice service plan, for unlimited 24/7 email and Internet browsing service in 140 countries with partnership agreements with Verizon Wireless, our US service provider.

We have been very pleased with this service in Abuja, Jos and now in the "bush." It seems to work anywhere there is a CelTel tower.

I don't know the cost of the basic voice service plan Tom refers to, but I'm guessing that the monthly total for that plus the data service must be close to $100, currently about 15,000 naira per month, for GPRS (low-to-medium speed) service.

On the other hand, I've tested the MTN service in the past couple of weeks and it has been unusably slow, both at my home and the office, despite having a strong signal.

Don't Rely on Password Managers to Keep you Safe on Untrusted Computers

In my previous post on password managers, I concluded that they can help you by "remembering" strong, hard-to-guess passwords for your different online accounts (or for other personal information). Actually, though, I started investigating these programs with a specific need in mind: to find a way to use my private accounts on untrusted computers such as public computers (airports, libraries, cybercafes) or your friend's computer if you aren't sure about the security it has.

In my post "Danger Ahead: Using the Cybercafe," I talked about the dangers of public computers, especially the fact that they can capture what you type including your user names, account numbers, and passwords, then pass that information along to cybercriminals. What good is a cybercafe if I can't trust it enough to log into my email account, for example? I looked into the password managers hoping that they would protect my information on public computers, but unfortunately my conclusion is that they do not. There is a ray of hope in another sort of solution, kyps, which I will mention later.

Can Password Managers Keep you Safe on Untrusted Computers?

Short answer: no. You should not use your personal data on an untrusted computer, even by way of a secure password manager. The kyps approach is more promising, but using your own (clean) computer is still the safest.

Long answer: no, though a password manager might reduce the risk somewhat. The problem in a nutshell is that, in principle, an untrusted computer and do anything with the data that goes through it. Theoretically, for example, someone could design a program from scratch that looks and acts just like Windows but also stores and forwards all personal information to the RBN (Russian Business Network) or other cybercrime center. There is simply no way to make an untrusted computer into a secure one.

Passpack is one of the two online password managers I reviewed. When I asked the company about this issue, this is what they said:

Yes, you're absolutely correct. The decrypted pack is used by (thus temporarily stored in) the javascript DOM. So any application that can access that DOM, can access the information stored in the decrypted pack.

As you noted, local memory is an issue with any program, online or off. Unfortunately, for as much as we can do to protect your account, you need to make sure you are on a clean computer. We have written one post to this effect here: http://passpack.wordpress.com/2008/07/23/travelers-check-your-browsers/

If I understand correctly, since Passpack stores your data in a single pack which it decrypts on your local computer, not only the passwords you use in a session but all your data is exposed this way, which would be dangerous on an untrusted machine.

Security expert Keith Bergen says,

In order for the passwords to be transmitted they have to pass through memory unencrypted so after they're sent to the other side the site can run a hash (md5, or what ever) against the plain text password to compare it to the hash that it stores. There are a few pieces of software that will look for passwords in memory as that is one of the best places to lift them from. ...

There are methods of stripping out the local SSL cert that your computer uses to initiate the SSL communication with the server and to copy and decode all SSL traffic that is sent to and from your computer. There are many Linux programs that do this and I have heard of some Windows implementations as well.

Bergen goes on to say that the practical implications of these issues are less clear. Even though methods exist to steal you credentials in these ways, we don't know how widespread they are. One thing is sure, though, and that is that the cybercriminals are sophisticated, motivated and bright. If it becomes cost effective for them to steal your identity in this way, then they will. So, although some of these managers may in some cases be better than nothing, their security is not something to, so to speak, put your money on. (And note that they may be worse than nothing as in the case of Passpack).

The author of kyps, Andreas Pashalidis, also discusses the risks of using password managers as well as other methods of trying to make a public computer safe. He points out that malware on the computer might not only capture your passwords, but also corrupt the data on your flash drive (if that's what you use) or infect the drive with malware making it unsafe to use even on your own computer.

Conclusion

In the end, I would not want to use any password manager on an untrusted computer, that is one that I am not reasonably sure is free of malware. In a situation where I had no alternative but to use an untrusted computer (suppose I was dying and stranded in a Somali village with no cell phones but with a cybercafe), I would either type in the credentials by hand or use a password manager, then change them as soon as possible and watch for any suspicious activity. However, there is a better approach, which is kyps, discussed in the next post (or just go there and have a look).