Skip to main content

BSOD when True Image (Build: 5551) backup kicks off

Thread needs solution

Hello,

My machine has been crashing when the daily incremental job I set up kicks off. There have been a number of different errors but they always occurred at the time of the backup. The backup was a 3 AM so I moved it to 4 AM a couple of days ago.

This was the crash I got this morning at 4 AM:

DEFAULT_BUCKET_ID: LIST_ENTRY_CORRUPT
BUGCHECK_STR: 0x139
PROCESS_NAME: TrueImageHomeS
CURRENT_IRQL: 2
ERROR_CODE: (NTSTATUS) 0xc0000409 - The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application.
EXCEPTION_CODE: (NTSTATUS) 0xc0000409 - The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application.
EXCEPTION_PARAMETER1: 0000000000000003
LAST_CONTROL_TRANSFER: from fffff80103aed369 to fffff80103aee040

I'm attaching the Acronis System Report. I'm running Win8 Pro x64.

I was going to report the problem to Acronis but they want $10 for me to tell them about the error.

I'm sure this is a bug of some kind which makes me less than comfortable about using the product for backups.

Anyone have any experience with this? Is there a workaround? Or do I need to look elsewhere for a backup solution?

Thanks,

Ray

Attachment Size
acronissystemreport.zip 3.87 MB
0 Users found this helpful

Ray,
Software exceptions do not neccessarily occur because of a bug in a particular application. They can occur as a result of the environment, problems with a piece of hardware, memory, etc.

We will need a chance to look at your system report, but in the meantime, can you tell us if you have been validating your back ups regularly? You stated your errors occur on an incremental task. What happens if you initiate a full back up manually?

Software development has been my full-time gig since 1981 (assembler, C++, and now mostly C#) so I think I understand what you're talking about, but I could be mistaken.

I wouldn't have reported this if the dump didn't point at True Image as the culprit. I'm not proficient with WinDbg but can get around.

My jobs aren't set up to run the backup validation part of the True Image task if that's what you're referring to but I regularly use the backups for one reason or another and have successfully recovered data. Do you think I should turn validation on? I'm not sure if this will help since the BSODs have been occurring right when the job starts so I haven't been getting the automatic backup on these days. That is, the job wouldn't make it to the validation phase anyway.

I have two jobs set up. An incremental backup that takes a full backup ever 7 days and a full backup, written to a different location, that runs every Saturday morning. The full backup ran automatically last Saturday and was successful. I have run the jobs manually after one of the BSODs just to see if they would complete and they did. The errors only seem to occur when the job task kicks off automatically. It might have something to do with waking the machine from a sleep state.

I'm running an Asus P9X79 Deluxe with an i7 processor and 32GB of memory. I verified that I have the latest BIOS and drivers a week or two ago just to rule that out. I also ran a full memory check overnight without any errors reported.

I upgraded my two machines to True Image 2013 back in December; I ran a full backup when I did the upgrade. The other machine is running Win7 Ultimate x64. I have the same backup scheme setup on it and haven't had any problems so I'm guessing that it has something to do with Win8.

I'm running both of the jobs manually right now and will let you know how it goes.

Ray,
Sorry.. stepped into a movie right about the time you replied. The additional information you provided earlier was extremely helpful.... and, knowing that tasks run manually complete successfully is also valuable information. I was able to review your Acronis Report:

1- d(?) MBR 932G 1K SATA 0-0-0 WDC WD1001FALS-00E8B0
-1 p(1) --EG 932G 932G 0b NTFS 07 NTFS, HPFS ........... -EE--V Block bitmap corrupted

Disk 1 has an error. Looks like the MBR. It's probably file system so run chkdsk /r and see if you can get it to clear.

I have another hunch though since tasks can run manually. This error has to do with a back up script.

event id="2" level="3" module="1" code="100" time="1361350801" message="Failed to process pair script:DEB327B3-81FD-4E49-BDFF-613337243FB4." /
event id="3" level="4" module="316" code="5" time="1361350802" message="Operation has completed with errors." line_tag="0x9F2C53C72E8BCD30"

The problem could have to do with the task or .xml file that keeps track of your back ups and tasks (configuration). I wouldn't bother trying to debug.

You have a few options. Start by running chkdsk and see if you can get the MBR repaired. Then....

Recreate one of the scheduled tasks that failed previously. It can be identical to your old taks but schedule them to run at a different time. Ultimately you can delete the old tasks, and it might even be prudent to do so for the test. I suspect your new tasks will run successfully on the schedule you specify.

The downside to this is that you do lose synchonization between existing back ups and the newly created tasks going forward, but the old back ups are still viable and can be restored at anytime if needed.

If a back up didn't appear in the restore from... dialog. Browsing to it, closing then reopening the application is usually all that is needed for the back ups to appear. I cannot say for sure if the error is being caused by the file system error on the MBR or because of a problem with the scheduled tasks, but am leaning more towards the latter. I'd attempt to resolve both. Let us know what you decide to try and what the results are. I have a feeling this issue will not reoccur once the tasks are recreated.

No problem. Perfectly fine for you to have a life outside of this forum.

My boot drive is a 2 month old Samsung 830 SSD (512GB). I ran chkdsk /r against it and there were no errors or problems found. I'm attaching the event log entry.

I recently created those jobs after installing the True Image 2013 so not quite sure why they would be corrupt. I will recreate them this weekend.

There haven't been any crashes in the past couple of days and the jobs have completed successfully. I'm running the validation now to ensure they're OK before I delete and recreate the jobs.

Thanks for your help. I will post the results of the changes next week after things have run for a few days.

Attachment Size
126224-106726.txt 5.66 KB

Ray,
Thanks for your follow up. I am really feeling less concerned with the disk error now. The chkdsk log in your last post shows that chkdsk cleaned up unused security descriptors it found. Something that happens frequently with chkdsk and is not a cause for alarm given the numbet of entries (2). The number of indexes is not relevant. These are access control entries on files that have had their permissions changed or which cannot be interpreted correctly by chkdsk. A slew of these entries might indicate corruption due to a physical failure of the drive, but not so if only a few files.

I also read that AF drives can show block bitmap corrupt based on the way the disks file structure is interpreted by various diagnostic software. So once again, not something I would be concerned about.

Good to hear that your tasks have been running successfully. I think you are on the road to recovery... no pun intended.