Unable To Recover Recent Data.
I had Acronis setup to do a Nightly File by File backup. On 05/11/19, my hard disk crashed. I tried to restore from my last backup. I've discovered that my last two backups are sector by sector. Furthermore, they do not contain any data newer then 02/28/19.
Why don't my backups contain any data newer than 02/28? The last two ran 05/08 and 05/01.
-Julian
Are there missing files or are the recovered files missing changes in them that can be verified somehow? If the dates are older, that is likely the timestamp of the file in that location. A file that was last modified in Feb, but backed up yesterday will still have a timestamp of February. The modified date and creation date timestamps are determined and set by Windows. Acronis backs up whatever version is on the disk at the time the backup is run. Restore dates in Acronis ate based off the date the backup was created. You can pick any date available, but the files in them will reflect whatever timestamps they had in Windows.
Clearly the disk crashed...prior to that it was failing and did a sector by sector backup. This backs up each logical sector on the disk as a 1 or 0 (whatever exists). The results of the backup will be what was there at the time. That said, no software is complete magic either and can't repair data that may have already been compromised or corrupted from degraded failure to complete failure. If you have a failing disk, just because it backs up does not mean the data in it is going to be good. It will only be as good as the files health is when the backup is taken.
Thank you for the replies.
To correct myself, the hardware is fine. Windows 10 crashed. It tried to repair itself, but ended up doing more damage and finally quit booting.
It does appear to be a sector by sector backup.
The drive is an SSD, 1 TB (Samsung SSD 850).
Backups go to an 8TB External USB3 .
Backup is a Differential, 6 backups then a new backup.
No cleanup settings.
ATI did mail me a completion report after each backup. I did not catch any errors.
Missing changes. For instance, my finance program did not have any entries after 02/28, Same with my email.
I will typically save pictures, a youtube video or two, etc, there are no new files after 02/28
The disk ran as normal. It kept popping up the error it needed to do a repair.
I have two 1 TB SSD's I have restored to each drive, with the same result.
As near as I can tell the disks are fine.
-JJ
Missing changes. For instance, my finance program did not have any entries after 02/28, Same with my email.
There are known issues with saving the data from some applications which store that data in their own database containers, such as QuickBooks, Outlook where the applications provide their own backup features.
Acronis will only save data that is physically present on the disk drive, so if the application does not write that data to the disk (or if it locks the data to prevent access etc), then the data may not be saved in the backup image file.
This also applies to data stored in such as OneDrive if using their Files on Demand feature, where only reparse point data is present to point to the actual files stored in the Cloud server.
Given that you are not seeing any new files after 02/28, the question here is whether you have made backups after this date, and are you attempting to recover from those later backup files?
Thank you for responding.
I am running MoneyDance and Thunderbird.
All data is saved to the disk.
I'm not using OneDrive.
As a rule, all programs are closed when I go to bed. Just so there are no problems with the backup.
The backup is run every morning at 0800. As I said above, I got an email saying the backup was complete, showing no errors.
Yes, there were several back-ups made after 02/28. The last full backup was made about 05/08, the previous full backup was made 05/01.
The last error I received was complaining my drive ran out of space, about 3 months ago. I started backing up to the external HD around 03/12
Thank you.
-JJ
Julian, I have never used MoneyDance so do not know how that works, but have been using Thunderbird as my main email client for many years, so there should have been no issues with ATI being able to backup the files in the Thunderbird profile folder.
I would recommend downloading / using the MVP Log Viewer tool (link below) and checking back through the logs for your backup task to back when your files were last available in the backup, then work forwards to see if the logs hold more clues here?
I'm not sure what the docurm is, but here are the last logfiles. There are no log files after 03/02. See attached picture. But there are backups on my backup drive that were created.
As a sidenote, you will see that Windows is being run in a Virtual Machine on a Linux host. This is just while I'm troubleshooting. If need be, I will boot straight into Windows. And all the backups were run while Windows was running as a host, i.e. not in a virtual machine.
03/02/19 09:05:50: -----
03/02/19 09:05:50: ATI Demon started. Version: 23.4.1.14690.
03/02/19 09:05:50: Operation Noise Windows 10 started manually.
03/02/19 09:05:54: Operation: Recovery
03/02/19 09:05:54: Priority changed to Low.
03/02/19 09:05:55: Recover Backup Archive From file: S:\Noise Windows 10_diff_b22_s5_v1.tib Recovery of: Disks
03/02/19 09:05:55: Pending operation 52 started: 'Clearing disk'.
03/02/19 09:05:55: Pending operation 14 started: 'Recovering partition'.
03/02/19 09:05:58: Pending operation 14 started: 'Recovering partition'.
03/02/19 10:11:40: Pending operation 14 started: 'Recovering partition'.
03/02/19 10:11:46: Pending operation 61 started: 'Recovering MBR'.
03/02/19 10:11:47: Bootability restore operation has started.
03/02/19 10:11:47: Error 0x1d0337: Multiple partitions with UUID '12A30D9AB30D9A44' are found.
03/02/19 10:11:47: Error 0x1d0337: Multiple partitions with UUID '3B7D143E8E143E02' are found.
03/02/19 10:11:47: Error 0x1d0337: Multiple partitions with UUID '947623A6BD23A63C' are found.
03/02/19 10:11:47: Error 0x1d0337: Several partitions have an equal UUID. System boot problems may appear.
03/02/19 10:11:47: Error 0x0
03/02/19 10:11:47: Error 0x0
03/02/19 10:11:47: Error 0x0
03/02/19 10:11:47: Error 0x0
03/02/19 10:11:47: Error 0x0
03/02/19 10:11:47: Error 0x0
03/02/19 10:11:47: Error 0x0
03/02/19 10:11:47: Error 0x0
03/02/19 10:11:47: Error 0x0
03/02/19 10:11:47: Error 0x0
03/02/19 10:11:47: Error 0x0
03/02/19 10:11:47: Bootability restore operation has finished.
03/02/19 10:12:38: Operation has succeeded.
Start: 03/02/19 09:05:50
Stop: 03/02/19 10:12:38
Total Time: 01:06:48
Prior to that the file is:
03/02/19 08:46:18: -----
03/02/19 08:46:18: ATI Demon started. Version: 23.4.1.14690.
03/02/19 08:46:18: Backup reserve copy attributes: format tib; need_reserve_backup_copy false;
03/02/19 08:46:18: Operation Noise Windows 10 started by schedule.
03/02/19 08:46:23: Backup reserve copy attributes: format tib; need_reserve_backup_copy false;
03/02/19 08:46:24: Operation: Backup
03/02/19 08:46:24: Priority changed to High.
03/02/19 08:46:25: Create Backup Archive Password Protected From: Disk 4 To file: S:\Noise Windows 10.tib Compression: High Exclude: Files matching mask Match criterion: hiberfil.sys, pagefile.sys, $Recycle.Bin, swapfile.sys, System Volume Information, *.tib, *.tib.metadata, *.~, *.tmp, C:\Users\Julian\AppData\Local\Temp, C:\Users\Julian\AppData\Local\Microsoft\Windows\INetCache, C:\Users\Julian\AppData\Local\Mozilla\Firefox\Profiles\*\cache2, C:\Users\Julian\AppData\Local\Mozilla\Firefox\Profiles\*\OfflineCache, C:\Users\Julian\AppData\Local\Opera Software\Opera Stable\Cache, C:\Users\Julian\AppData\Local\Opera Software\Opera Stable\Media Cache, C:\Users\Julian\AppData\Local\Google\Chrome\User Data\Default\Cache, C:\Windows\CSC
03/02/19 08:46:28: Pending operation 173 started: 'Creating partition image'.
03/02/19 08:46:45: Pending operation 173 started: 'Creating partition image'.
03/02/19 08:48:45: Terminated by user.
Start: 03/02/19 08:46:18
Stop: 03/02/19 08:48:45
Total Time: 00:02:27
And before that:
02/28/19 09:00:00: -----
02/28/19 09:00:00: ATI Demon started. Version: 23.4.1.14690.
02/28/19 09:00:00: Backup reserve copy attributes: format tib; need_reserve_backup_copy false;
02/28/19 09:00:00: Operation Noise Windows 10 started by schedule.
02/28/19 09:00:07: Backup reserve copy attributes: format tib; need_reserve_backup_copy false;
02/28/19 09:00:07: Operation: Backup
02/28/19 09:00:07: Priority changed to High.
02/28/19 09:00:07: Create Backup Archive Password Protected From: Disk 3 To file: S:\Noise Windows 10.tib Compression: High Exclude: Files matching mask Match criterion: hiberfil.sys, pagefile.sys, $Recycle.Bin, swapfile.sys, System Volume Information, *.tib, *.tib.metadata, *.~, *.tmp, C:\Users\Julian\AppData\Local\Temp, C:\Users\Julian\AppData\Local\Microsoft\Windows\INetCache, C:\Users\Julian\AppData\Local\Mozilla\Firefox\Profiles\*\cache2, C:\Users\Julian\AppData\Local\Mozilla\Firefox\Profiles\*\OfflineCache, C:\Users\Julian\AppData\Local\Opera Software\Opera Stable\Cache, C:\Users\Julian\AppData\Local\Opera Software\Opera Stable\Media Cache, C:\Users\Julian\AppData\Local\Google\Chrome\User Data\Default\Cache, C:\Windows\CSC
02/28/19 09:00:09: Pending operation 173 started: 'Creating partition image'.
02/28/19 09:00:16: Pending operation 173 started: 'Creating partition image'.
02/28/19 09:01:52: Writing differential version to file: Noise Windows 10_diff_b22_s5_v1.tib
02/28/19 09:06:14: Pending operation 173 started: 'Creating partition image'.
02/28/19 09:06:21: Pending operation 173 started: 'Creating partition image'.
02/28/19 09:06:21: The following backups have been successfully created: S:\Noise Windows 10_diff_b22_s5_v1.tib
02/28/19 09:06:21: Consolidate Backup Archive Location: S:\Noise Windows 10_diff_b22_s5_v1.tib Destination: S:\Noise Windows 10_diff_b22_s5_v1_3477B53B-F3BE-4564-A2DE-59CF67875F4A.tib
02/28/19 09:06:22: Deleting backup file with path S:\Noise Windows 10_diff_b21_s3_v1.tib.
02/28/19 09:06:22: Operation has succeeded.
Start: 02/28/19 09:00:00
Stop: 02/28/19 09:06:22
Total Time: 00:06:22
Julian, the key messages from your log data are:
03/02/19 10:11:47: Error 0x1d0337: Multiple partitions with UUID '12A30D9AB30D9A44' are found.
03/02/19 10:11:47: Error 0x1d0337: Multiple partitions with UUID '3B7D143E8E143E02' are found.
03/02/19 10:11:47: Error 0x1d0337: Multiple partitions with UUID '947623A6BD23A63C' are found.
03/02/19 10:11:47: Error 0x1d0337: Several partitions have an equal UUID. System boot problems may appear.
These would appear to show that you have signature collisions going on for 3 of your partitions being included in your backup image hence the UUID duplication.
Whether this has any bearing with the fact you are running Windows from a VM is a question I cannot answer but the above error will prevent the ATI backup from running until resolved.
See webpage: https://askubuntu.com/questions/901290/is-it-a-problem-to-temporarily-have-the-same-uuid-for-two-partitions
Was an OS recovery or clone completed around that date? Seems like there are multiple "like" disks (at least partitions) attached at the same time that are represented as being the exact same. This normally happens after a clone or restore where MBR track 0 is left in place. In these cases, it is not recommended to boot into Windows with both disks attached internally. It would not be a problem if one was attached via USB and an adapter though.
Why would there be any signature collisions? This was a brand new blank SSD from Amazon. And when I did the restore, I answered yes to the question of did I want to remove all existing data.
I received Emails saying Acronis successfully completed it's backup.
As attached at the bottom.
To clarify, Windows was not being run as a Virtual Machine
Around the end of Feb I purchased a new Samsung SSD. I disabled all drives except the Samsung, my DVD drive and the EXT 8GB USB drive. I ran the Acronis Rescue. I booted the system and all was good. In May, Windows suffered a catastrophic crash. As before, I disconnected all but the Samsung SDD and the EXT 8GB USB drive; and did a restore.
I had a couple of instances where Windows complained it needed to check it's drive. I pressed the any key within the 8-second countdown. When I didn't it would run chkdsk, crash saying it was not able to recover, followed by being unable to boot. I would restore as I previously did.
The backup configured to backup only the Windows C: drive. None of the other drives were part of the Windows Backup.
I use UUID's all the time in Linux. :)
If I do a complete restore, that wipes out the destination disk, how did I end up with duplicate UUID's? And why do they not show up ion my backup logs?
Last backup log:
2019-05-08T09:00:00:095-07:00 1648 I00000000: -----
2019-05-08T09:00:00:095-07:00 1648 I00000000: ATI Demon started. Version: 23.5.1.17750.
2019-05-08T09:00:00:151-07:00 1648 I00640000: Backup reserve copy attributes: format tib; need_reserve_backup_copy false;
2019-05-08T09:00:00:152-07:00 1648 I00640002: Operation Noise Windows 10 started by schedule.
2019-05-08T09:00:23:550-07:00 1648 I00640000: Backup reserve copy attributes: format tib; need_reserve_backup_copy false;
2019-05-08T09:00:23:553-07:00 1648 I013C0000: Operation: Backup
2019-05-08T09:00:23:553-07:00 1648 I0064000B: Priority changed to High.
2019-05-08T09:00:23:734-07:00 1648 I000B03F0: Create Backup Archive Password Protected From: Disk 4 To file: "Z:\Noise Windows 10.tib" Compression: High Exclude: Files matching mask Match criterion: hiberfil.sys, pagefile.sys, $Recycle.Bin, swapfile.sys, System Volume Information, *.tib, *.tib.metadata, *.~, *.tmp, C:\Users\Julian\AppData\Local\Temp, C:\Users\Julian\AppData\Local\Microsoft\Windows\INetCache, C:\Users\Julian\AppData\Local\Mozilla\Firefox\Profiles\*\cache2, C:\Users\Julian\AppData\Local\Mozilla\Firefox\Profiles\*\OfflineCache, C:\Users\Julian\AppData\Local\Opera Software\Opera Stable\Cache, C:\Users\Julian\AppData\Local\Opera Software\Opera Stable\Media Cache, C:\Users\Julian\AppData\Local\Google\Chrome\User Data\Default\Cache, C:\Windows\CSC
2019-05-08T09:00:25:379-07:00 1648 I000101F8: Pending operation 173 started: 'Creating partition image'.
2019-05-08T09:00:29:976-07:00 1648 I000101F8: Pending operation 173 started: 'Creating partition image'.
2019-05-08T09:44:21:521-07:00 1648 I00640000: Writing differential version to file: Noise Windows 10_diff_b31_s2_v1.tib
2019-05-08T09:44:22:294-07:00 1648 I000101F8: Pending operation 173 started: 'Creating partition image'.
2019-05-08T09:44:33:275-07:00 1648 I000101F8: Pending operation 173 started: 'Creating partition image'.
2019-05-08T09:44:33:355-07:00 1648 I00640000: The following backups have been successfully created: "Z:\Noise Windows 10_diff_b31_s2_v1.tib"
2019-05-08T09:44:33:575-07:00 1648 I000B0000: Consolidate Backup Archive Location: "Z:\Noise Windows 10_diff_b31_s2_v1.tib" Destination: "Z:\Noise Windows 10_diff_b31_s2_v1_8704DF0A-A9E2-4692-B536-2C746813402B.tib"
2019-05-08T09:44:33:717-07:00 1648 I000B0000: Deleting backup file with path Z:\Noise Windows 10_diff_b27_s5_v1.tib.
2019-05-08T09:44:33:810-07:00 1648 I013C0006: Operation has succeeded.
Julian, sorry but I can only tell you what I see in the log data, i.e. that 'Multiple partitions with UUID xxx' were identified by ATI for 3 different partitions in the log data you posted.
Personally, I have never come across this particular issue previously but obviously these identifiers have to be unique to a single partition.
If you have tried the recovery again to a completely clean target drive and still see this error, then please open a Support Case with Acronis to get them to investigate it further.