Restore deleted .tibx files
Yesterday, in Windows File Explorer I mistakenly deleted the folder with my Acronis backups. Acronis prompted if this was ok and I granted permission. When I realized my mistake, I checked the drive and the folder was gone. Thinking all was lost as I knew the files were too large for the recycle bin, I deleted the tasks in Acronis. As I had no backups, I created a new folder, task, and a new full backup. Otherwise, the drive is untouched.
I suspect that the tibx files are intact on the drive but only marked as deleted. I tried using Microsoft’s Windows File Recovery app but it only found one of the tibx files and couldn’t recover it as it said it was corrupted.
Has anyone successfully recovered a tibx file. If so, how?
Thinking all was lost as I knew the files were too large for the recycle bin, I deleted the tasks in Acronis. As I had no backups, I created a new folder, task, and a new full backup.
Sorry but if the drive had been left untouched after the accidental deletion you may have had a chance, but by making a new full backup to the same drive, you are most likely to have overwritten any deleted file data.
Fortunately, I'm using a 6TB HHD and not a TRIM enabled SDD as my J: backup drive. It was nearly full of tibx backup files, each of which is a little over 300MB. I intended to get more space by deleting a folder with a few unneeded backups but mistakenly deleted the wrong folder that had about 10 backups. This freed up about 3TB. I then created a new full backup.
The new full backup could have written into the original free space as well as into the deleted file space. I probably overwrote some of the deleted files but I wouldn't expect it to have hit all of them as I only needed 10% of the free space. This was a new drive so it wasn't fragmented.
I have recovered flash card photos many times as well as files from my HHD but the software I used is not compatible with Windows 10. Unless things have changed, deleting a file just hides the file name but leaves all the data. The data area is available to be written into. I think I just need better recovery software. However, I don't know if Acronis uses Windows deletion or their own procedure that may be more destructive to the data or file structure. If so, it could be hopeless.
SSD TRIM Data Recovery | How to Recover Data If Trim Is Enabled on SSD - EaseUS
Ray wrote:................................
However, I don't know if Acronis uses Windows deletion or their own procedure that may be more destructive to the data or file structure. If so, it could be hopeless.
SSD TRIM Data Recovery | How to Recover Data If Trim Is Enabled on SSD - EaseUS
If deleted from within Explorer, it would use usual deletion method. If the backup task uses *.tibx architecture, the usual file dependency applies, so you need all of the prior files in order to recover from a particular file. With *.tib architecture you need all of the prior files in the particular set (ie full backup + incrementals).
I am not hopeful that you will be able to recover much, as you have written to the drive.
I use UFS Explorer Standard Recovery when I have problems such as this. It works quite well, but sometimes gets file name wrong. Potentially a big problem with backup files. There is a "shareware" version that you can test it to see if it will help - it is rather expensive about 60 Euro.
Ian
Does it restore files as large as my 300GB? The Trial limitations says, "The software copies files with the size under 256 KB only." so it appears I have to purchase it which is about $73.
Ray, I know nothing about this method, but maybe it is worth checking out...
I used MS File Recovery initially. It uses command line. It only found one file and said it was corrupted.
I just finished trying EaseUS. "Files found - 30 minutes" show it found the files but said it'd take 15 hours to complete the search. Recovery is size limited on the free version so I purchased it for $70. I let it run overnight and in the morning it still said it needed 15 hours.
I tried restoring three different tibx files to another drive. The first attempt only restore 2GB of the file. My second attempt appeared froze at 7%. My third attempt took around an hour to create the file. But when I attempted to open the file, Windows popped up an error message. I rebooting the computer in case the file was in use but the error appeared again. Maybe it can't recover large files or Acronis did something to the files.
I'm reluctant to spend more money on UFS Explorer unless I know it will work.
Unless you have an ongoing need for such a utility the likely outcome from any attempted recovery is likely to be disappointing due to subsequent backup made to the HDD. This is compounded by the dependencies with *.tibx.
Recovery scans take a long time, particularly on larger drives. In the past I have had them run for in excess of 24 hours, with not all that much to show for it. I have had much more success with recovering from Linux drives; NTFS has been less successful.
Ian
The restored file seems like it should be good. Normally, I can open the tibx either with Acronis or Windows. However, I searched the Acronis Knowledge Base for "move backup file tibx" and found these
- 63425 Acronis True Image: Limitations of tibx backups | Knowledge Base
- 63227 Acronis True Image: Do not delete .TIB or .TIBX files outside of Acronis True Image | Knowledge Base
I didn't find anything on moving (or copying) the tibx file but these articles say the tibx file is severely limited. I don't understand why Acronis has a design with such convoluted interdependencies.
I had a long discussion with Acronis support this morning about this. The net is that you have do do everything within the Acronis program. Recovering my deleted backups is hopeless; especially since I deleted them outside of Acronis that is specifically addresses by "63227: Acronis True Image: Do not delete .TIB or .TIBX files outside of Acronis True Image"
In the Acronis drop down list for each backup, it has Rename, Move, and Delete but no equivalent of copy. In the tabs for backups on a local drive, there is Replica so you can replicate the backup to the cloud. There is no Replica tab on a cloud backup to replicate to a local drive.
There's no obvious way to make a copy of a tibx file. BUT I thought of a work around that support thinks will work. If you want a copy, you can use Acronis to backup your backup file. Then you can use Acronis to restore the backup file to another location. For example, you want a copy of D:\Backup A.tibx on drive E: First backup D:\Backup A.tibx then restore it to drive E: or as many locations as you like. Just be sure to work within Acronis.
The advice you got is not completely accurate. It is possible to copy and move backups using you preferred file manager, however if you move it will break the backup - you need to first temporarily remove the backup task from ATI then import the backup once it has been moved.
They are correct is saying that deleting the backup will probably be terminal, but the same is true if you delete it from within ATI (as apposed to merely removing the backup). With the *.tibx architecture, you need all the files comprising the backup to be able to access it, unlike the *.tib architecture. So if you had *.tib rather than *.tibx the chances of a successful recovery will be greater, but still problematic.
Abundant prudence dictates that you have multiple backups, in different locations. I backup to an internal drive on the PC, to my NAS and to the Acronis cloud. For some "data" I have separate, daily and weekly backups.
Ian
Just a point of clarification here:
You can copy or move .tibx files but....
Acronis Active Protection needs to be turned off if doing this outside of ATI.
If moving files, then ALL .tibx files using the same root name must be moved together and the owning task should be removed from the ATI GUI Backup list.
If copying files, then the same initial rule applies, copy them ALL but ensure that the copy destination is kept well away from any Acronis scan for backup files, i.e. on updates & installs to avoid other issues by having duplicate destinations for the same named files!
Any deleting of .tibx files should only be done using the 'Clean up versions' tool if the creating task is shown in the GUI backup list. If there is no associated task, then if it is intended to use any remaining files in the future, then first use the 'Add existing backup' option to all the files to the GUI then again use the 'Clean up versions' tool to remove any unwanted files safely.
If deleting all files for a task no longer shown in the GUI, then no problem provided AAP is turned off first!
There's no obvious way to make a copy of a tibx file. BUT I thought of a work around that support thinks will work. If you want a copy, you can use Acronis to backup your backup file. Then you can use Acronis to restore the backup file to another location. For example, you want a copy of D:\Backup A.tibx on drive E: First backup D:\Backup A.tibx then restore it to drive E: or as many locations as you like. Just be sure to work within Acronis.
Sorry but the above won't work - .tib & .tibx files are excluded from backups by default and you are not addressing the issue of having duplicate named files in different locations!
The simplest and best method of having copies is to setup another task with the same source but with a unique name and run this task separately whenever a copy is needed. Doing this will let you schedule copies and also manage all files within the normal ATI options.
Thanks for this additional information. The backups I deleted were single tasks. Each task creates a full backup on the first Sunday of the month followed by an incremental of the following Sundays in that month. For April, I would name it "Ray-PC3_2021-04" that would have incrementals on 4/11, 18, and 25. If I understand your information, I should be able to copy such a file to another location.
If this is true, I could open either file outside Acronis using Windows File Explorer.
(If Acronis tried to add it, it would conflict with the original so I shouldn't adding it. Could I rename it?)
If the above is true, then it would seem that I could delete and restore the copy without issue. Acronis wouldn't intervene in the deletion as it wouldn't know the file existed. So I'd conclude either Acronis' intervention when I delete my files on May 7 or EaseUS didn't succeed in restoring it.
Ray, if you are making incremental backups then you also have metadata involved in the backup files which complicates issues with renaming them.
One issue with using Explorer to open / view file contents, is that it may also cause Acronis to add an entry in the 'Other' section of the main GUI based on the files opened from another location than expected due to being copied.
The above isn't a problem if the original task has been removed from the GUI.
Acronis will only 'intervene' with deletions of .tib / .tibx files if you have Active Protection enabled and active, where the purpose of AAP is to prevent such actions to protect from malware etc.
I'd expect each backup to be self-sufficient and Acronis to manage their creation and recovery. Instead, Acronis' files are interdependent. I was reading
63425 Acronis True Image: Limitations of tibx backups | Knowledge Base and it has
- Restoration from a manually moved .tibx (via Windows Explorer or other file management tools) is not possible, if all other .tibx - parts of the backup archive - were not moved too into the same folder, even if the moved .tibx contained a full backup (the term "full backup" here refers to the "full" backup type, as opposed to "incremental" and "differential" backup types)
Do you know what these "parts" are? If so, do you think copying the files to the drive with the restored backup would allow Windows to open it? Is this too dangerous to try? (I delete the task in Acronis so it might have deleted something needed in these files too.)
Ray, short answer with respect to full disk backups only... using name disk_back as an example:
First backup file name will be disk_back.tibx.
Second backup will be named disk_back-0001.tibx. The original disk_back.tibx will be linked to the new backup.
Third will be disk_back-0002.tibx and disk_back-0001.tibx will be linked. You can see what's happening by looking at the last file modification dates.
With automatic cleanup rules, older backups will be deleted. But at the time disk_back.tibx is to be deleted, the file will actually be changed to a 12KB file which must not be deleted.
So, let's say with automatic cleanup you want to keep only the last three backups. When you create the fourth backup, disk_back.tibx will be 12KB in size so it is no longer the first backup, but the file must be kept.
disk_back.tibx
disk_back-0001.tibx
disk_back-0002.tibx
disk_back-0003.tibx
All four of these files must be kept together.
Next backup would produce disk_back-0004.tibx and disk_back-0001.tibx would be removed, but disk_back.tibx will always remain.
What you describe is exactly what happens with my daily task. It creates a full BU followed by 6 incrementals for a week of daily backups. The task keep up to three in a K drive folder, K:\Ray-PC3 Daily. You can see them as you described in the attached screen shot.
In Windows File Explorer, if I double-click any of these four files, it shows all the dally BU. So these files are definitely connected and likely interdependent.
The files I erased are single files that create one month of weekly BU. The first Sunday of the month it creates a full BU followed by an incremental on subsequent Sundays. But instead of having the task clean up, I manually disable it at the end of the month and create a new task for the following month.
So when Acronis says "all other .tibx - parts of the backup archive" I don't know if there are other files attached to the file RAY-PC3_2021-05.tibx that are necessary to make the recovered file work.
Ray, in the case of incremental disk backups, the increments are kept in the same .tibx files with the full backup. So a full and all six increments for a week will be in one .tibx file. The dates on the .tibx files in your screen shot are about a week apart so that looks as expected.
When you open a .tibx file in Windows File Explorer, the opening of the file is actually handled by the True Image program. Regardless of which file you open, True Image will actually open the entire backup task and thus show you all the backups of the task.
I'm not sure why you are manually creating a new backup task each month. I don't really understand what you are trying to do with that.
Under what condition does Acronis say "all other .tibx - parts of the backup archive"?
edited by moderator
[Off topic]
@Suzanne Shanks These links are VERY suspicous. I'd advise everyone against checking them(in the post and signature) out. Apparently Fortigate is the only provider who classifies it as Phishing/Malicious, but at best it's still just spam.
-- Peter
Susanne Shanks & Peter Szatmari - I think you are posting to the wrong topic.
Bruno, In response to, "Under what condition does Acronis say "all other .tibx - parts of the backup archive"?" I am not getting this message.
I think I successfully restored a deleted file to a different location. When I double-click it I get the attached error message. Is this error because
- after deleting the file, I ran a backup that wrote into the file space and corrupted the file?
- the file was not corrupted, but because the undelete program wasn't successful?
- because I'm missing parts? (https://kb.acronis.com/content/63425 "Restoration from a manually moved .tibx (via Windows Explorer or other file management tools) is not possible, if all other .tibx - parts of the backup archive - were not moved too into the same folder, even if the moved .tibx contained a full backup (the term "full backup" here refers to the "full" backup type, as opposed to "incremental" and "differential" backup types)"
If it missing parts, what are they?
Ray, all Acronis archive files (.tib or .tibx) contain stored checksum values created as the file is being created and which are used to detect corruption when using validation or doing a restore. If any of these checksum values do not match when Acronis recalculates them from the current version of the file, then the file is deemed to be corrupt. There is no published method of determining where in the file any corruption may lay or of manually validating the checksum values individually etc.
Undelete tools may be able to recover the file segments from the disk where it was deleted but it may not reconstitute the file exactly as it was originally as will never be 'aware' of the embedded checksum values or how they were calculated.
I guess that my deleted files are not recoverable although I don't know why. The old undelete tools I've used would simply unmark the file as deleted so it would instantly reappear. If some of the data was overwritten, opening it would fail. Current tools, at least the EaseUS one that I'm using, require it to be undeleted to a different drive that not only takes much longer to copy all the data but can create errors.
I could run some experiments to see if a freshly deleted tibx can be restored to a different drive successfully but I don't want to spend more time.
Thanks for all your helpful comments.
Ray, just removing the delete flag from the deleted file used to work but only when there had been no further disk activity on that drive. With large files that get deleted, the chances of all the deleted data not being overwritten by subsequent drive activity such as saving a new backup to it, are probably less than zero.
Best practice would have you creating multiple backups of the same source data to different destination locations, where at least one copy of the backup is stored offline to give the best probability of being able to do a successful recovery and avoid issues such as accidental deletion of files etc.
In the past, even with subsequent files being written, I've been able to recover most files. It's statistical if a new file will write over the deleted data. In my case, there were 10 files plus a little free space before they were deleted. Even though I wrote another file, it would only need 10% of the space. From past experience, it's highly unlikely that it would write into a portion of every delete file.
Attached are 3 screenshots from EaseUSA file recovery software and one of the Windows error message.
- "Files found - 30 minutes"
- "Preview Files"
- "Recovery #1 failed"
- "Recovery #2 froze"
- "Recovery #3 corrupted"
- "Error message opening RAY-PC_2021-02 (tibx)"
#1 show the deleted files in chronological order. I'm confused about the names of the first 3. File 2021-01 says MB instead of GB so it's probably corrupted. My guess is the some of the other files are ok.
I tried restoring three different tibx files to another drive. The first attempt only restore 2GB of the file. My second attempt appeared froze at 7%.(Based on how long it took to recover my third attempt, I didn't wait long enough.) My third attempt took around an hour to restore the file to another drive. This is reasonable to copy a 500 GB file.
When I attempted to open this third file, Windows popped up an error message #6. I rebooting the computer in case the file was in use but the error appeared again.
I think it's hopeless to recover any file or even figure out why.
I had a long discussion with Acronis tech support. A tibx backup file can only be moved by Acronis by selecting Move in the drop down list. You cannot move or copy a tibx with Windows.
Ray, while I understand the comment from Acronis I have to state that they are not correct in the wider sense of handling .tibx files!
If you have a backup task in the main GUI creating .tibx files and you want to move the Destination for that task, then using the Move option is the recommended method to use, and will move all the files from their current location to a new one.
If you remove the backup task from the GUI list of backups, then you can move the associated .tibx file to another location outside of ATI, then use the 'Add existing backup' option to create a new backup task in the GUI for the files in their new location. The key warning about moving any .tibx files is to move ALL the files for the task! This is because of metadata dependencies with .tibx files.
Further, if you create .tibx files when booted from Acronis Rescue Media, you can move those files as needed (subject to the same warning if you have created incremental / differential slices for the backup).
The other caveat when moving or copying any .tibx or .tib files outside of ATI is the requirement to turn off Active Protection which will prevent such actions otherwise.
I concur with Steve Smith on this.
One oddity of moving from within ATI is that the dates stamps for all the files is changed to the date they were "moved" - looks like it could be a copy followed by deleting the files in the old location. This date problem may have been fixed but I was in early builds of ATI 2021; have not tried a move some time.
Ian