Backups & *.tib files disappeared
Hi,
I recently upgraded an older version of Acronis to Acronis True Image 2020. For several weeks my backups (which were setup on the older version) have ran without any issues. The majority of the backups run on a Monday (yesterday) and I could tell from the .TIB file (size and date) that all 5 backups ran without any issues.
However, after switching on my PC this morning (to trigger the last remaining backup) I noticed that all 6 backups are not present in Acronis True Image 2020 and also the .TIB files are also missing from my hard drive! (they were there yesterday).
Has anyone experienced this issue and is there any way that I can recover the backups that were previously setup and/or recover the .TIB files? Note: my recycle bin is empty!
What puzzles me is that "Active Protection" is/was turned on within Acronis True Image 2020 and therefore it is not possible to delete a .TIB file from explorer without first turning this feature "off" -- therefore this makes me think that it was Acronis True Image 2020 that removed both the backups and .TIB files.
I'm not happy with the situation I find myself in - especially as I had no issues with the previous (older) version and so I'm questioning why I paid money to just get more hassle :-(.
Any hints, tips or guidance would be greatly appreciated.
Kind Regards
Mr S
Hi Steve, thanks for your prompt reply/post and additional information.
As requested I have hopefully provided all the required information below (in Bold below - under the respective section Sorry, couldn't see how to change the colour of the font):
For background, what older version of ATI did you upgrade from, and how did you perform that upgrade? Did you just install ATI 2020 right over the top of the older version, or did you uninstall the old version first then install ATI 2020? Although I installed ATI 2020 quite recently (5th January it was – but everything had been fine until yesterday 4th Feb) I’m actually struggling to exactly remember what the previous version was. I do have an email from Acronis dated 5th March 2015 (providing the Serial Number following registration of the product) and so I assume this to be ATI 2015 (or equivalent) – not sure if there would have been a free upgrade installed since then though. I had therefore been running this previous version for a number of years and didn’t have any issues with the backups/scheduled jobs i.e. they created my weekly or twice-weekly backups without any issues. In terms of the steps followed to install ATI 2020, I recall installing over the top of the older version as I was worried that my backups (which were setup in the previous version) would be deleted if I deinstalled this first. However, I do recall that once I installed ATI 2020 it wouldn’t open, therefore I had to perform a re-install (over the top) which allowed me to open ATI 2020. At that stage my backups were visible – although I had to re-enter where the backup should be saved to and also enter the backup details (e.g. frequency, type of backup etc).
Please download the MVP Log Viewer tool (link in my signature below) and use this to review the log files for your backup operations. This should provide more information on what has been happening here? This is a nifty bit of S/W – I like it 😊. The earliest log file is dated 5th Jan 2020 11:58 – so this ties in with post-installation of ATI 2020. Actually I can see it states “ATI Demon started. Version 24.5.1.22510”. As covered in my original forum post the logs confirm the successful completion of all 4 scheduled backups (for C, E, H and F drives) on Monday 3rd Feb. The next scheduled backup (for D drive) was scheduled for Tuesday 4th Feb @ 9.15am (UK time) however later that day I noticed that the M drive did not contain any *.TIB files (for D drive or any of the previous backups including those from the day before!) and when I opened ATI2020 all the backup scheduled jobs (name, what, when etc) were missing ☹. Unfortunately the MVP Log viewer tool doesn’t show any trace of the backups after 3rd Feb i.e. those up-to 3rd Jan all worked fine (before the corresponding .TIB files disappeared) – unless there is somewhere else I can locate this info from the tool.
What type of backup tasks are involved here? Disks & Partitions / Files & Folders / mix of both types? The backups were full copies (mainly Disks I think) – basically I had a weekly backup setup for each the following drives C, E, H, F and D. Backups for these drives, except D, would run on a Monday spaced throughout the day. Backup of the D drive runs on a Tuesday. I have an additional backup which runs on a Friday for drives F and G (which are partitions of a single drive – which means that the F drive backup on a Monday must be a partition backup). All backups were single full backups (I did previously test the C drive using incremental backups but reverted back to single full backups from 13th Jan 2020 onwards) and I only retain 1 version with the exception of my C drive (boot) which I allow for 2 versions – the 2nd full backup runs on a Thursday.
Where are the backup files being stored? Local drive, external drive, NAS ? All backups were written/saved to my M Drive (which is an internal 6TB WDC Black disk).
An Acronis System Report (zip file) may help with our understanding if you would collect one - the forum has a size limit of 8MB for file attachments so if the file is larger, you would need to use a sharing service such as OneDrive, Dropbox etc. You can send me a private message with a link if you prefer not to upload the file to the forum. Ok, I’ve ran the Acronis System Report and the zip file is 12MB+, therefore I’ll post this to OneDrive or Dropbox – but I’ll send you a private message with a link (once I work out how to do that 😊).
In terms of recovery of the missing files, it will depend on what else is happening here and how much activity is taking place on the storage drive used? You can try free tools such as Piriform Recuva to see if this can find the deleted files, but you would need to perform a validation for any recovered files to ensure that there has been no corruption of the data due to any areas of the disk being overwritten by new data etc. I’m likely best to just re-create the backups – but want to try understand how this has happened and more importantly so that it doesn’t happen again.
Thanks in advance
Mr S
Just an expansion on one of Steve's points. Be careful if you backups are on a NAS. AAP does not protect .tib and .tibx files from being renamed or deleted on a NAS drive. In addition, if you have multiple computers taking backups to the same NAS drive, I think you can add another computer's backups by performing an "Add backup" in ATI and then have the local ATI delete the file.
Note that the above comment probably does not apply to your case because your backup tasks would still be present. In your case, it sounds like something caused ATI to do a deletion of those backup tasks and associated files. (When done from the ATI GUI, this would not provoke action from AAP.) This is certainly a major problem if you (or someone else) did not purposefully do that deletion.
Thanks Patrick. I have already replied to Steve's post -- think it's with the admin's to be approved. However, just to confirm that I am not using a NAS drive. Also, all backups are from a single PC and the saved backups are to an internal local drive on that PC.
Yes it is a concern as I am the sole user of this PC (my wife and daughter would not even know how to turn it on!!!) and I would not have purposefully delete the backups from within ATI.
Hope this information and the zip file link I've sent to Steve is helpful to identify what has happened etc.
Thanks
Mr S
mmm - strange that this reply has appeared before my previous reply!! I have my reply saved so I'll wait for a short time before trying to re-post.
David, thanks for the System Report zip file, the last backups that I am seeing in the logs were all done on Feb 4th and from the normal ti_demon logs appear to have run successfully with new backup files being created and the oldest files being deleted.
However, looking in the pcs.0.log is telling a different story about corruption / CRC errors!
03/02/2020 09:31:03 :768 The following backups have been successfully created: M:\Acronis Backups\Samsung_970_EVO_SSD_NVMe_(C)_full_b57_s1_v1.tib
03/02/2020 09:31:03 :802 Consolidate Backup Archive Location: M:\Acronis Backups\Samsung_970_EVO_SSD_NVMe_(C)_full_b57_s1_v1.tib Destination: M:\Acronis Backups\Samsung_970_EVO_SSD_NVMe_(C)_full_b57_s1_v1_618FA41B-D512-4559-BFF3-16780C683F13.tib
03/02/2020 09:31:03 :856 Deleting backup file with path M:\Acronis Backups\Samsung_970_EVO_SSD_NVMe_(C)_full_b55_s1_v1.tib.
03/02/2020 09:31:03 :924 Operation has succeeded.
02/03/2020 09:31:03 ar#1: opening archive path="\\?\M:\Acronis Backups\/Samsung_970_EVO_SSD_NVMe_(C)_full_b57_s1_v1.tib" in readonly mode
02/03/2020 09:31:03 ar#1: failed to open the archive: corrupted page is found at 0x23573e0000
02/03/2020 09:31:03 ar#1: failed to open archive path="\\?\M:\Acronis Backups\/Samsung_970_EVO_SSD_NVMe_(C)_full_b57_s1_v1.tib" mode=readonly uuid=00000000000000000000000000000000, err=-5003 (Data is corrupted: CRC mismatch or internal data structures mismatch)
02/03/2020 09:31:03 ar#2: opening archive path="\\?\M:\Acronis Backups\/Samsung_970_EVO_SSD_NVMe_(C)_full_b55_s1_v1.tib" in readonly mode
02/03/2020 09:31:03 ar#2: failed to open the archive: corrupted page is found at 0x2335280000
02/03/2020 09:31:03 ar#2: failed to open archive path="\\?\M:\Acronis Backups\/Samsung_970_EVO_SSD_NVMe_(C)_full_b55_s1_v1.tib" mode=readonly uuid=00000000000000000000000000000000, err=-5003 (Data is corrupted: CRC mismatch or internal data structures mismatch)
I do not see any errors indicated in the disk report for your WD 5.5TB M: drive but would recommend running a CHKDSK /F against that drive.
The above is the only indication of errors that I can see from the logs - the later backup tasks show similar to the 9:15 one in the ti_demon log contents with no errors shown in the pcs.0.log.
This doesn't explain why all the backup files have just disappeared, but does suggest that there is an issue with the destination drive that could be a factor!
Thanks for this latest review/update Steve -- I will perform a CHKDSK /F as requested -- it's late here so this will be tomorrow now.
I also see that my initial reply/post earlier this evening has not appeared (maybe it was too long). So, I am going to repost now so that you have more info.
Repost (Part 1 of 2):
----
Hi Steve, thanks for your prompt reply/post and additional information.
As requested I have hopefully provided all the required information below (in Bold below - under the respective section Sorry, couldn't see how to change the colour of the font):
For background, what older version of ATI did you upgrade from, and how did you perform that upgrade? Did you just install ATI 2020 right over the top of the older version, or did you uninstall the old version first then install ATI 2020? Although I installed ATI 2020 quite recently (5th January it was – but everything had been fine until yesterday 4th Feb) I’m actually struggling to exactly remember what the previous version was. I do have an email from Acronis dated 5th March 2015 (providing the Serial Number following registration of the product) and so I assume this to be ATI 2015 (or equivalent) – not sure if there would have been a free upgrade installed since then though. I had therefore been running this previous version for a number of years and didn’t have any issues with the backups/scheduled jobs i.e. they created my weekly or twice-weekly backups without any issues. In terms of the steps followed to install ATI 2020, I recall installing over the top of the older version as I was worried that my backups (which were setup in the previous version) would be deleted if I deinstalled this first. However, I do recall that once I installed ATI 2020 it wouldn’t open, therefore I had to perform a re-install (over the top) which allowed me to open ATI 2020. At that stage my backups were visible – although I had to re-enter where the backup should be saved to and also enter the backup details (e.g. frequency, type of backup etc).
Please download the MVP Log Viewer tool (link in my signature below) and use this to review the log files for your backup operations. This should provide more information on what has been happening here? The earliest log file is dated 5th Jan 2020 11:58 – so this ties in with post-installation of ATI 2020. Actually I can see it states “ATI Demon started. Version 24.5.1.22510”. As covered in my original forum post the logs confirm the successful completion of all 4 scheduled backups (for C, E, H and F drives) on Monday 3rd Feb. The next scheduled backup (for D drive) was scheduled for Tuesday 4th Feb @ 9.15am (UK time) however later that day I noticed that the M drive did not contain any *.TIB files (for D drive or any of the previous backups including those from the day before!) and when I opened ATI2020 all the backup scheduled jobs (name, what, when etc) were missing ☹. Unfortunately the MVP Log viewer tool doesn’t show any trace of the backups after 3rd Feb i.e. those up-to 3rd Jan all worked fine (before the corresponding .TIB files disappeared) – unless there is somewhere else I can locate this info from the tool.
Repost (Part 2 of 2):
---
What type of backup tasks are involved here? Disks & Partitions / Files & Folders / mix of both types? The backups were full copies (mainly Disks I think) – basically I had a weekly backup setup for each the following drives C, E, H, F and D. Backups for these drives, except D, would run on a Monday spaced throughout the day. Backup of the D drive runs on a Tuesday. I have an additional backup which runs on a Friday for drives F and G (which are partitions of a single drive – which means that the F drive backup on a Monday must be a partition backup). All backups were single full backups (I did previously test the C drive using incremental backups but reverted back to single full backups from 13th Jan 2020 onwards) and I only retain 1 version with the exception of my C drive (boot) which I allow for 2 versions – the 2nd full backup runs on a Thursday.
Where are the backup files being stored? Local drive, external drive, NAS ? All backups were written/saved to my M Drive (which is an internal 6TB WDC Black disk).
An Acronis System Report (zip file) may help with our understanding if you would collect one - the forum has a size limit of 8MB for file attachments so if the file is larger, you would need to use a sharing service such as OneDrive, Dropbox etc. You can send me a private message with a link if you prefer not to upload the file to the forum. Ok, I’ve ran the Acronis System Report and the zip file is 12MB+, therefore I’ve sent you a link to my OneDrive (which you know already since you've responded above!).
In terms of recovery of the missing files, it will depend on what else is happening here and how much activity is taking place on the storage drive used? You can try free tools such as Piriform Recuva to see if this can find the deleted files, but you would need to perform a validation for any recovered files to ensure that there has been no corruption of the data due to any areas of the disk being overwritten by new data etc. I’m likely best to just re-create the backups – but want to try understand how this has happened and more importantly so that it doesn’t happen again.
Thanks in advance
Mr S
I note that the missing backups were directed to M: drive...
M:\Acronis Backups\/Samsung_970_EVO_SSD_NVMe_(C)_full_b57_s1_v1.ti
My understanding is that Acronis designates M: to mobile backups for iOS and Android. Have you recently setup a mobile backup? Or perhaps, it's a conflict from the upgrade to 2020 where it wanted to use M: but it was in use.
I'm wondering if the backups actually still exist, but Windows may now be using a different volume letter? Are you able to determine that the original hard drive "free space" reflects that the backups were deleted? It's possible that they are still there, but may have been reassigned to another drive letter or to an unmounted volume (no drive letter) where you just can't see them
Also curious... what happens if you type in M:\ in windows file explorer and press enter? I've got a cloogey scenario on one of my systems where I can't get to a G: drive (doesn't show up in explorer, even though I see it in disk management, unless I manually type it in).
Thanks Bobbo_3C0X1 for your additional thoughts -- let me first reply to Steve's post.
Steve - yeah, it's all strange since I definitely recall and confirm that the 4 x backups run successfully on Mon 3rd Feb -- well I base this on the fact that *.TIB files were saved to the M drive with the date of 3th Feb and the filesizes were as expected, so it's strange to see these errors on that day. I wasn't aware that the 4th Feb backup had completed successfully -- even though it didn't appear. I ran CHKDSK M: /F as you recommend and strange that the first run encountered an error but the 2nd run (done immediately after the 1st) ran OK. Results are below (I'm not sure what I'm looking for). Maybe there is/was a l lock on the first run.
C:\WINDOWS\system32>CHKDSK m: /F
The type of the file system is NTFS.
Volume label is WDC Black 6TB.
Stage 1: Examining basic file system structure ...
12544 file records processed.
File verification completed.
1 large file records processed.
0 bad file records processed.
Stage 2: Examining file name linkage ...
3 reparse records processed.
An unspecified error occurred (696e647863686b2e 532).
An unspecified error occurred (6e74667363686b2e 1729).
C:\WINDOWS\system32>CHKDSK m: /F
The type of the file system is NTFS.
Volume label is WDC Black 6TB.
Stage 1: Examining basic file system structure ...
12544 file records processed.
File verification completed.
1 large file records processed.
0 bad file records processed.
Stage 2: Examining file name linkage ...
3 reparse records processed.
12590 index entries processed.
Index verification completed.
0 unindexed files scanned.
0 unindexed files recovered to lost and found.
3 reparse records processed.
Stage 3: Examining security descriptors ...
Security descriptor verification completed.
24 data files processed.
CHKDSK is verifying Usn Journal...
177485440 USN bytes processed.
Usn Journal verification completed.
Windows has scanned the file system and found no problems.
No further action is required.
5723164 MB total disk space.
147910272 KB in 17 files.
128 KB in 25 indexes.
0 KB in bad sectors.
342280 KB in use by the system.
65536 KB occupied by the log file.
5578386 MB available on disk.
8192 bytes in each allocation unit.
732565119 total allocation units on disk.
714033534 allocation units available on disk.
C:\WINDOWS\system32>
I'll see what Disk tools I have (in Win10) to check for additional issues. I only use the 6TB drive to store these backups, therefore the Disk has not been used as a powerhouse. Maybe I need to defrag also.
More to follow.....
Hi Bobbo_3C0X1,
Yes, the destination of all 7 backups i.e. *.TIB files (performed each week) was the M: Drive (not sure why I chose M, but could rename this if you think ATI could be getting confused). No, I don't have any mobile backups running so as you say could be an issue/conflict from the upgrade.
When you mention above whether the backups actually still exist. I assume you mean the backup files (*.TIB) in which case the M drive is currently showing as 5.31 TB free of 5.45 TB -- this is because there remains 1 *.TIB for my C: drive which ran (or is dated) as 30th Jan and this is ~ 148 MB (which has no corresponding backup file in ATI). If you are meaning the backup settings for each backup -- do you know where I would locate this? Somewhere on my C drive I guess.
When I type in M:\ in windows file explorer (and press Enter) -- it opens the M drive as normal/expected.
Do you think it would be safer for me to uninstall ATI 2020, reboot and then reinstall it again? Then, perform a Defrag on the M drive before setting up the backups again?
Thanks in advance.
Mr S
Oh, I see there is a folder named "Acronis Mobile Backup Data" in the ProgramData folder on my Drive. However this folder only contains one folder i.e. no other files. So, whether ATI 2020 got confused with the M drive.....or maybe this folder is routinely created for everyone.
Hi David,
At this point, I wouldn't format or defrag or do anything if you can help it if you have an open case with Acronis to trouble shoot. If you do want to start "fresh", I'd probably just try a "repair" install, using the latest installer, re-run it and be sure to right-click it and "run as administrator" even if you are using an admin account. That is a critical component in Windows these days to install software as you need to do this to fully elevate an admin account in UAC by doing this.
After that, I'd rename the volume from M: to something else, reboot, and then start with a NEW backup job using a unique backup name and test it and keep an eye on things.
Yeah, I was wondering if perhaps one of the drives was showing more used space than expected, perhaps pointing to a hidden file/folder or maybe even in disk management an unassigned volume that just needs to have a new drive letter assigned to it so it would be available in Windows Explorer where your old backup files would exist.
I'm not really familiar with the undertakings of the M: drive usage in True Image, just that I've read other forum threads where it conflicts because True Image took over M: for mobile backups (and apparently is also used for archives too: https://forum.acronis.com/comment/446152#comment-446152).
For all of the backups to just disappear though, yeah that is extremely scary and can't think of why or how that would happen so the hope is that maybe the volume just got reassigned or unassigned, but the data is/was still there! Personally, if you're not tied to the volume letter M:, then yeah, you might want to change it to something else, to be on the safe side down the road. And definitely keep working with Acronis if they have gone missing - if it is possible for them to somehow be wiped out because the backup volume was M:, boy that needs to be addressed!
Were you able to check disk management to see if you have any unassigned volumes / partitions on the drive that has the 5TB volume? I'm assuming it's a 5TB drive, but checking disk manager would confirm the size and partition layout. Maybe there is a large partition that no longer has a volume letter or something like that?
Hi Bobbo_3C0X1,
I'll try a "repair" install later today and will also rename the M drive to something else (it is a 6TB drive). I've had a look at Disk Management and don't see any unassigned volumes (see attached screenshot) -- so looks like the backup setups and their corresponding *.TIB files have disappeared.
Then I'll try setup another backup for the C drive (different name though) and see how I get on before setting up backups for other drives. My worry is -- will it happen again! Not good really.
I'll see how I get on doing the above and will report back.
Cheers
Mr S
Meant to also add that I performed a sector scan on the M drive using Hard Disk Sentinel v5.4 and after 9 or 10 hrs it reported no bad sectors. So, I'm assuming the Disk drive is fine as well.
Yup, your drive appears to be fine. I note that the drive says it is 97% free as well, no unmounted or hidden partitions, or anything like that. The data that was there, definitely seems to be gone. How, or why, I have no idea. I really hope it's not something that happened in the background due to using M:\ as the volume. I can't see how/why it would delete anything, just that it might have caused a conflict that changed the drive letter or something like that.