True Image 2021 fails backup with BSOD in the last few minutes of the job

Nigel, welcome to these public User Forums.

I have not seen anyone else in these forums reporting ATI 2021 causing BSOD's as far as I can remember, and have never seen this for myself on the various PC's I have it installed on.

Did you uninstall ATI 2015 first before installing ATI 2021, and was the install done from an Administrator account?  Both are required actions.

What security application(s) do you have installed on your PC, and is it possible that you could have had more than one such applications active, along with the new ATI 2021 Protection too?

I would recommend raising this BSOD issue direct with Acronis by opening a Support Case with them and submitting an Acronis System Report plus also saving any Windows Dump files created by the BSOD, so that they can investigate why this is happening?  This will help them to identify what might need to be fixed in the application if they confirm this to be the cause?

In the interim, if you have Acronis rescue media created by ATI 2015, you could use this to take a backup of your PC outside of Windows if needed, or else if you have backups from before installing 2021, you could use this to recover back to how things were at that time.

Thanks for your rapid response. I omitted some information in my previous post - it was late and I was fed up! My issues relate to an HP Pavilion laptop with an i3 processor; 4Gb ram; Windows 10 Home version 2004, OS build 19041.685. I backup to an USB external hard drive.

When I ran the ATI2021 installer it told me to uninstall ATI2015 and then run the installer again, which I did. I ran the installer from my account which has administrator privileges. I did not specifically "run as administrator" given the administrator privileges on my account. The only security application running is Windows Defender.

I did wonder if the problem could be due to ATI trying to write to a protected directory or file given that Microsoft introduced new protection mechanisms (in 2004?) such that I had to give permission for some of my programs to access files, for example, graphics program GIMP was blocked from writing to the usual places until I explicitly gave it permission to do so. I was thinking of switching that protection mechanism off completely and trying again but am concerned about the risk of a crash wrecking the filesystem on the external drive.

I do have ATI 2015 rescue media on CD and USB stick - thank you for that suggestion.

I note what you say about submitting crash dumps etc. I do appreciate the amount of work that goes in to producing software (been there, done that in another life), and that it is just not possible to test for every possible equipment combination. The developers have done a great job getting it as far as they have. The vulnerability scan highlighted that it is about time I updated the Java Runtime Environment - something I would not have thought of.  However software should not just crash out. If it has a problem doing something it should log it and quit gracefully! I suspect there is unhandled exception somewhere...

Postscript: I updated the Java Runtime Environment to the latest version and tried running a vulnerability scan - result is a white x in a red circle and the very useful information, "The vulnerability scan failed". I waited awhile and tried again with the same result. Not looking good!

Nigel, if you have enabled the Controlled folder access feature of Windows Defender, then please click on the option to "Manage Controlled folder access" in Defender, then check the 'Block history' to see if any Acronis processes or services are listed there as being blocked by this feature?  If they are, then these should be allowed access.

If you do find that this feature is causing Acronis to BSOD then please do report this to Acronis by opening a Support Case, as this is something they need to fix urgently!  Plus they should also document the processes that should be allowed to have this access!

The only current documentation referencing the feature is:

KB 62142: How to turn off "Controlled folder access" option on Windows 10 - but this does not apply to ATI 2021 or 2020 and was fixed in Defender not by Acronis.

Hi Steve,

There is nothing showing up for Acronis in the controlled folder access block  history so I guess that's not it.

I did finally manage to get a vulnerability scan to complete but there does seem to be a timeout issue. This from the console log. Failed attempt started at 01:22:34, successful attempt started at 01:28:03.

05/01/2021 01:22:34:174 PM +00:00 13080 I00000000: [VulnerabilityAssessmentManagerImpl] VA database is up to date, version: 1086.0.0.0
05/01/2021 01:24:39:831 PM +00:00 12212 E00000000: [VulnerabilityAssessmentList] Couldn't scan VA: Error 0x2d30006: Vulnerability Assessment task timeout
| line: 0xeaaedb6f2a8c79a2
| file: c:\jenkins_agent\workspace\ati-main-win\1173\products\imager\home\managers\impl\va_manager\va_manager_impl.cpp:336
| function: TrueImage::Managers::VulnerabilityAssessmentManagerImpl::WaitFinishedTask
| line: 0xeaaedb6f2a8c79a2, c:\jenkins_agent\workspace\ati-main-win\1173\products\imager\home\managers\impl\va_manager\va_manager_impl.cpp:336, TrueImage::Managers::VulnerabilityAssessmentManagerImpl::WaitFinishedTask
| $module: ti_managers_vs_35860
05/01/2021 01:28:03:128 PM +00:00 7912 I00000000: [VulnerabilityAssessmentManagerImpl] VA database is up to date, version: 1086.0.0.0

Other failures had similar timeouts. Looks like it is a lottery whether it will run successfully or not.

I also see entries like this:

05/01/2021 01:02:19:642 PM +00:00 12972 E00000000: Unable to get database update state: Error 0x2b00002: Response body: {"domain":"AGENT_CORE","code":"BAD_GATEWAY","debug":{"msg":"revproxy: dial tcp 127.0.0.1:6110: connectex: No connection could be made because the target machine actively refused it."}}. Status: 502
| line: 0xa8eccbf9f52fb357
| file: c:\jenkins_agent\workspace\ati-main-win\1173\home\antimalware\impl\antimalware_manager_impl.cpp:106
| function: Home::`anonymous-namespace'::GetDatabaseUpdateProgress
| line: 0xa8eccbf9f52fb357, c:\jenkins_agent\workspace\ati-main-win\1173\home\antimalware\impl\antimalware_manager_impl.cpp:106, Home::`anonymous-namespace'::GetDatabaseUpdateProgress
| $module: ti_managers_vs_35860
 

"No connection could be made because the target machine actively refused it"?? What is that about? Just for the record, I am on a fast broadband connection.

My bafflement grows!

Nigel, the IP address shown in the above log for the No connection issue is your local loopback address 127.0.0.1 so nothing remote etc.

Personally, for ATI 2021 I have turned off all the Protection features, including the new Vulnerability scan option.  The latter is poorly thought out when it lists every vulnerability for any identified component, i.e. Acrobat Reader listed around 67 CVE's which rendered seeing what applications might need updating almost impossible!

With ATI 2020, I was 'happy' to allow Acronis Active Protection to be turned on but not for 2021 as it brings with it all the other overheads of Cyber Protect without any of the benefits when you have a perpetual / Standard license.  The protection services run continually in the background even when they are all supposed to be 'Turned off permanently!'

For me, I am waiting on Acronis to produce a version of ATI that allows install without these unwanted extra's, as per their internal change request: TI-213392 Allow installation without Antimalware components.  I have seen lots of other users in the forums wanting the same, which essentially is a return to the core function that we bought ATI for - Backup & Recovery!

nigelss,

{"msg":"revproxy: dial tcp 127.0.0.1:6110: connectex: No connection could be made because the target machine actively refused it."}}. Status: 502

In the above "actively refused it" means that the host sent a reset instead of an ack when the connection attempt on port 6110 was made.  This may be due to a firewall blocking the port or the process is not listening on that port or is not running at all (unlikely).

Do you have IIS running on your machine?  If you do try restarting that service.  Also check that port 6110 is not blocked.

Hi Enchantech,

Yes, IIS is running. Yes, I have restarted the laptop again and again which would restart IIS! There are multiple entries for Acronis in the firewall inbound rules including three entries for Acronis System Report:

profile private; enabled yes; action block; override no; protocol tcp; all other options any

profile private; enabled yes; action block; override no; protocol udp; all other options any

profile all; enabled yes; action allow; override no; protocol all; all other options any

all for C:\program files (x86)\acronis\trueimagehome\systemreport.exe

Nothing spotted in the outbound rules.

I did try unblocking the two private entries. No difference, port 6110 still rejecting connections.

I also tried switching off the firewall completely (while not connected to the internet), still no difference.

I also tried telnet to 127.0.0.1 6110 with the firewall off and that failed as well with:

"Connecting to 127.0.0.1... Could not open connection to the host, on port 6110: Connect failed"

I also used Process Explorer to examine ATI's TCP/UDP activity and can see that it is regularly trying to make that connection but it gets rejected every time.

I also looked to see if anything was expecting connections on port 6110 and did not find anything but I'm no expert.

I have reinstated the firewall private profile entries to 'action block' seeing as how completely disabling the firewall didn't make any difference.

Some googling shows that port 6110 is allocated to HP Softbench which is an IDE tool. In a previous post I listed an error message, part of which was:

{"domain":"AGENT_CORE","code":"BAD_GATEWAY","debug":{"msg":"revproxy: dial tcp 127.0.0.1:6110: connectex: No connection could be made because the target machine actively refused it."}}. Status: 502

which contains the word "debug" so I am wondering if this is some leftover from the development process.

Whatever, I give up unless you have something instant for me to check.

Another question: is there any problem with me uninstalling 2021 and trying to reinstall it again (and again)? Also, I am minded to drop back to ATI 2015 and then try again with 2021 when you next issue an update/bugfix. Any problems in me doing that? I just don't have the time for this!

Cheers,

Nigel

nigelss wrote:

Hi Enchantech,

Another question: is there any problem with me uninstalling 2021 and trying to reinstall it again (and again)? Also, I am minded to drop back to ATI 2015 and then try again with 2021 when you next issue an update/bugfix. Any problems in me doing that? I just don't have the time for this!

Cheers,

Nigel 

Yes, you can uninstall ATI 2021 and reinstall it at a later time. Before installing ATI 2015, I would use the Acronis Cleanup tool to avoid possible problems. ATI 2015 will not be able to read any backups created by ATI 2021, if any of them are important, create ATI 2021 Recovery Media before uninstalling ATI 2021.

Ian

nigelss,

I was anticipating you would reset IIS rather than rely on a PC reboot to do the trick.  Follow the instructions in the link below to reset IIS and see if the problem persists.

I think you are right that the 6110 port being still in use from a development project is at fault here.  Once you have that cleared up I think you will have success at using the product.

Reset IIS

Enchantech wrote:

nigelss,

I was anticipating you would reset IIS rather than rely on a PC reboot to do the trick.  Follow the instructions in the link below to reset IIS and see if the problem persists.

I think you are right that the 6110 port being still in use from a development project is at fault here.  Once you have that cleared up I think you will have success at using the product.

Reset IIS

Here is today's update, and probably the last for now given I have spent three days trying to get this thing to fly and it ain't working!

I reset IIS as per the link and observed it being stopped and restarted successfully. I still could not telnet to port 6110. I don't think there is anything on the 'puter trying to service that port so in effect it doesn't exist and that's why attempts to connect to it fail.

I uninstalled ATI 2021 through Windows programs and features. The uninstall claimed success but during the process Windows popped up a box saying "protected memory access blocked". Details were:

App or process blocked: cyber-protect-service.exe

Protected folder: \Device\Harddisk0\DR0

This has not happened before so must have been connected with the uninstallation. Whatever, I gave access permission to stop it happening again the next time I uninstall ATI.

Next, I ran the Acronis cleanup tool to wipe all traces from the 'puter (he said hopefully) and restarted.

I made sure the internet connection was off, disabled all file protection and reinstalled ATI 2021, this time explicitly using "run as administrator". My account has admin privileges so I did not do so last time.

I started up ATI, was not able to activate using my product key (because the internet was off?), switched off active protection permanently, and set up a job for a full single version backup, DO NOT schedule, and added a folder in my user profile to the exclusions.

So, with no internet connection, file protection disabled, I started the job. It took around an hour to get to the point where it started writing data to the external drive. After a further 50 minutes, with 121.38Gb written and 7 minutes to go, ATI crashed with a BSOD.

Straight after the 'puter restarted itself, ATI immediately tried to run the job again, even though I had explicitly selected Do Not Schedule in the job options.

Demon log for crashed job:

06/01/2021 04:45:48:873 PM +00:00 7584 I00000000: -----
06/01/2021 04:45:48:873 PM +00:00 7584 I00000000: ATI Demon started. Version: 25.6.1.35860.
06/01/2021 04:45:49:038 PM +00:00 7584 I00640000: Backup reserve copy attributes: format tib; need_reserve_backup_copy false;
06/01/2021 04:45:49:039 PM +00:00 7584 I00640002: Operation TOWERS-LAPTOP started manually.
06/01/2021 04:45:49:558 PM +00:00 7584 I00640000: Backup reserve copy attributes: format tib; need_reserve_backup_copy false;
06/01/2021 04:45:49:562 PM +00:00 7584 I013C0000: Operation: Backup
06/01/2021 04:45:49:566 PM +00:00 7584 I0064000B: Priority changed to Low.

Demon log for automatically started job after 'puter restart:

06/01/2021 06:56:24:772 PM +00:00 948 I00000000: -----
06/01/2021 06:56:24:772 PM +00:00 948 I00000000: ATI Demon started. Version: 25.6.1.35860.
06/01/2021 06:56:27:522 PM +00:00 948 I00640000: Backup reserve copy attributes: format tib; need_reserve_backup_copy false;
06/01/2021 06:56:27:788 PM +00:00 948 I00640002: Operation TOWERS-LAPTOP started by schedule.
06/01/2021 06:56:33:241 PM +00:00 948 I00640000: Backup reserve copy attributes: format tib; need_reserve_backup_copy false;
06/01/2021 06:56:33:397 PM +00:00 948 I013C0000: Operation: Backup
06/01/2021 06:56:33:866 PM +00:00 948 I0064000B: Priority changed to Low.
06/01/2021 06:56:41:881 PM +00:00 948 E00000000: Can't read slices: Error 0x40011: The specified file does not exist.

Note the line "Operation TOWERS-LAPTOP started by schedule" even though the options say "Do not schedule" and still do. I had to cancel the job to stop it running.

Clearly, all is not well. I am not sure I would have confidence in a backup even if one completed allegedly successfully. I really don't think I have any option but to give up and go back to ATI2015.

I have now come back to this problem again and I have some news...

I tried doing a backup of the RECOVERY(D) partition - (NTFS - 17.2GB of 19.2GB used) - Successful

I tried doing a backup of the WINDOWS(C) partition - (NTFS - 350.5GB of 443.9GB used) - Successful

Note that there are three more partitions which can only be selected if WINDOWS(C) is selected:

Recovery Partition - NTFS - 0.3GB of 0.6GB used.

EFI System Partition - FAT 32 - 0.1GB of 0.3GB used.

Recovery Partition - NTFS - 0.6GB of 1.7GB used.

I did NOT select any of the above three partitions for the WINDOWS(C) partition backup.

I know that trying to do an entire PC backup always crashes in the last few minutes with a BSOD. I am wondering if it is anything to do with these partitions.

Could it be because the EFI system partition is FAT 32 while everything else is NTFS?

Why are there two recovery partitions under WINDOWS(C)? Does it matter?

Historical - The laptop originally ran Windows 8 and was upgraded by Micro$oft to Windows 10.

I would appreciate some feedback before I try again with everything except the FAT 32 partition because it takes so long to run and I don't want to use the 'puter while the backup is running.

I am pleased to report that I was able to mount the WINDOWS(C) archive in Explorer, browse through the directory structure, examine files etc.

Thanks.

Could it be because the EFI system partition is FAT 32 while everything else is NTFS?

No, the System EFI partition is always FAT32 and is required for a successful recovery if you want the OS to be bootable.

Note that there are three more partitions which can only be selected if WINDOWS(C) is selected:

Sorry but not correct. Any individual or combination of source partitions can be selected.

Note: you need to select / click on 'Full partition list' to be able to see & select hidden / system partitions.

Why are there two recovery partitions under WINDOWS(C)? Does it matter?

Historical - The laptop originally ran Windows 8 and was upgraded by Micro$oft to Windows 10.

When there are more than a single recovery / Windows RE tools partitions present this is because the system was upgraded from an earlier version of Windows, i.e. 8 going to 10.

One of these recovery partitions needs to be removed in this situation, so you first need to identify which is the correct one to remove.

You can use the reagentc /info command from an Administrator powershell or command prompt window to identify the active recovery partition.

PS D:\powershell> reagentc /info
Windows Recovery Environment (Windows RE) and system reset configuration
Information:

    Windows RE status:         Enabled
    Windows RE location:       \\?\GLOBALROOT\device\harddisk0\partition6\Recovery\WindowsRE
    Boot Configuration Data (BCD) identifier: bfb80be6-a2b4-11ea-ad10-a2228913a61a
    Recovery image location:
    Recovery image index:      0
    Custom image location:
    Custom image index:        0

REAGENTC.EXE: Operation Successful.

PS D:\powershell>

When the enabled / active recovery partition is identifies i.e. disk 0 partition 6 in my example above, you can further use diskpart to confirm this:

PS D:\powershell> diskpart

Microsoft DiskPart version 10.0.19041.610

Copyright (C) Microsoft Corporation.
On computer: STEVE-9OP3KKF0

DISKPART> list disk

  Disk ###  Status         Size     Free     Dyn  Gpt
  --------  -------------  -------  -------  ---  ---
  Disk 0    Online          465 GB      0 B        *
  Disk 1    Online         1863 GB      0 B        *
  Disk 2    Online         1863 GB      0 B

DISKPART> select disk 0

Disk 0 is now the selected disk.

DISKPART> list partition

  Partition ###  Type              Size     Offset
  -------------  ----------------  -------  -------
  Partition 1    Reserved           128 MB    17 KB
  Partition 2    System             260 MB   129 MB
  Partition 3    Primary            200 GB   389 MB
  Partition 4    Primary            210 GB   201 GB
  Partition 5    Primary             37 MB   411 GB
  Partition 6    Recovery           979 MB   411 GB
  Partition 7    Unknown             53 GB   412 GB

DISKPART>

If you have 2 recovery partitions shown in your listing per above, then the redundant one can be removed using further diskpart commands. (select partition N then delete partition).

See webpage: How to Delete a Windows Recovery Partition - for more detailed steps.

Many thanks for the partition information. It is all above my paygrade although I did look up what the System EFI partition is so that is now clear. Even though there is a redundant recovery partition under WINDOWS(C), it has not caused any problems with ATI  2015.

I have run some more tests and have located the cause of the problem and yes, it is related to the FAT 32 EFI System partition. Here is what I did:

1. Ran a backup for RECOVERY(D), WINDOWS(C) partitions. I DID NOT select the two WINDOWS(C) recovery partitions or the EFI System partition - result SUCCESS.

2. Ran the backup again. I DID NOT select the two WINDOWS(C) recovery partitions but I DID select the EFI System partition - result BSOD CRASH.

3. Had a cup of tea while my 'puter tried to get itself going again after the BSOD.

4. Stopped the backup which ATI 2021 had automatically tried to start again. It seemed to think it had been 'paused'.

5. Ran the backup again. I DID select the two WINDOWS(C) recovery partitions but I DID NOT select the EFI System partition - result SUCCESS.

I also mounted the backup from 5 via Explorer and it offered me the C, D and the two C recovery partitions as expected.

The backup was for a full version, do not schedule.

Looks like an open and shut case to me. For some reason either ATI cannot access the EFI System partition, or it is having a nervous breakdown trying to process it. I know I am.

Is there anything I can check/look for?

Cheers,

Nigel

As a P.S. to the above, I found the bugcheck entry for the crash:

Event Id: 1001

The computer has rebooted from a bugcheck.  The bugcheck was: 0x0000000a (0x000000000000001a, 0x0000000000000002, 0x0000000000000000, 0xfffff80783661598). A dump was saved in: C:\WINDOWS\MEMORY.DMP. Report Id: 04be13ad-b09d-44f3-9c74-dca30667c39d.

Nigel, it is good that you have been able to isolate the issue with the EFI partition, though not good that the issue causes a BSOD.

If you want to confirm more about the BSOD, then a tool that I have used is Who Crashed which can be used with the memory dump file to identify what application caused the crash!

To use Who Crashed, first install it, then launch it, then click on the Analyze button shown in the top left corner.  It will pop up a small message advising you to scroll down the page to see the results of the analysis.  When I use it the message is as per the image below (no dumps!).

If your crash shows an Acronis program as the cause, then I would suggest reporting this to Acronis via opening a support ticket, so that they can investigate and try to prevent partition issues from causing this type of BSOD.  They will probably want you to upload the actual memory dump file via FTP but will provide details of how to do this and credentials needed etc once the ticket is open.

If you don't wish to do the above, then see:

Webpage: How to repair the EFI bootloader on a GPT HDD for Windows 7, 8, 8.1 and 10 on your Dell PC

The instructions are not specific only to Dell PC's and will apply equally to all other makes too!

Note: this assumes that there is not an error with the partition / FAT32 file system it uses.  If there is such an issue, then after assigning a drive letter to the EFI partition in step 7. of the instructions and exiting from diskpart.  You should then do a CHKDSK e: /F (where e: is the drive letter given to the partition) and ensure that any errors are fixed.

Hi Steve, many thanks for your advice once again. I downloaded and ran "Who Crashed". To quote from the report for the full memory dump:

crash dump file: C:\WINDOWS\MEMORY.DMP
This was probably caused by the following module: storport.sys (storport+0x8DC9)
Bugcheck code: 0xA (0x1A, 0x2, 0x0, 0xFFFFF80783661598)
Error: IRQL_NOT_LESS_OR_EQUAL
file path: C:\WINDOWS\system32\drivers\storport.sys
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: Microsoft Storage Port Driver
Bug check description: This indicates that Microsoft Windows or a kernel-mode driver accessed paged memory at DISPATCH_LEVEL or above. This is a software bug.
This bug check belongs to the crash dump test that you have performed with WhoCrashed or other software. It means that a crash dump file was properly written out.
The crash took place in a storage driver or controller driver. Since there is no other responsible driver detected, this could be pointing to a malfunctioning drive or corrupted disk. It's suggested that you run CHKDSK.

or in my kind of language, illegal memory access. Just for the record, I ran Windows Memory Diagnostics Test and got a clean bill of health. There is nothing wrong with the EFI System partition to my knowledge. I have not yet run CHKDSK (yet) but do not expect any issues.

For the same hardware, same operating system, ATI 2015 runs full backups (including the EFI System partition) without a problem, and ATI 2021 crashes with a BSOD when it tries to backup the EFI System partition. The difference is the software application used!

Nigel, interesting that the crash looks to be pointing to a Microsoft Windows storage drive.

Check the version of the driver?  Mine shows as below for Windows 10 build 20H2 (fully up to date).

Another check that you can make is to run SFC /SCANNOW from an Administrator command prompt or Powershell window.

If you haven't already opened a Support case with Acronis, I would recommend doing so in case there is something in ATI 2021 that is involved in the BSOD.

Note: I am not seeing this issue on any of my Windows 10 + ATI 2021 systems, nor seeing reports from any other users about the same.

The fact that the "Who Crashed" report suggests running chkdsk on the drive indicates that disk corruption is the most likely cause of the BSOD.  It is likely that the files stored in the EFI partition are fine however, the underlying MFT metadata for the partition suffers from some corruption.

Note that prior to TI 2020 metadata checks for MFT corruption were not performed by the True Image product.  The fact that TI 2021 performs even stricter integrity checks of disk, filesystem, MFT, and metadata associated therewith is actually a benefit to the user as such corruption unchecked can and does result in corruption to the point of recovery failure.

My advice is to run chkdsk against the EFI partition.  My bet is errors will be found and hopefully corrected. 

I have been unable to get back to this issue for a while but here I am again!

Steve - I have the same version of storport.sys as you. I am still on Windows 10 build 2004. I am not minded to take on build 20H2 at present.

Enchantech - I ran chkdsk against the System EFI partition but only with no parameters. The filesystem came up clean. I tried to run it with /r but to do so I would have to let the test run on the next restart and was not happy about leaving a volume letter assigned to the partition. Also, I have this nightmare vision of chkdsk trashing the disk trying to "fix" something in the system partition when all (except ATI2021) is running fine and the filesystem is clean.

Is it ok to leave a volume letter assigned to the System EFI partition through a restart? Thinks - I suppose it must be, otherwise how would chkdsk know what to check? I do need confirmation on this point from somewhere.

Nigel, one suggestion here might be to try a slightly different approach to see if you can confirm which, if any partition, is causing the issue which leads to the BSOD?

To do this, make a separate backup of each partition on the PC, one by one, including each of the hidden / system partitions such as the EFI one and starting with the smallest (for quickest results).

It is safe to leave the drive letter assigned to the EFI partition temporarily.  The reboot that is being required is because the chkdsk tool with /r option needs to do so with the disk in an offline state ie. not booted.  This is to prevent corruption to the disk.

Chkdsk is a standard MS command line tool and is a standard used to fix disk and file system errors.

Steve - I have already done it partition by partition as reported in one of my earlier posts. The issue as absolutely definitely 1000% (!) down to when ATI2021 tries to access the EFI System partition.

Enchantech - ok, will give it a go later.

Losing will to live...

Opened a command window in administrator mode and went through:

DISKPART> list disk                        listed disk 0, the only one.

DISKPART> select disk 0

DISKPART> list partition                 listed partitions, system is partition 2.

DISKPART> select partition 2

DISKPART> assign letter X            reported assigned to partition 2.

DISKPART> exit

...SYSTEM32> chkdsk X: /r           cannot run straight away, do not force dismount, schedule on restart.

...SYSTEM32> exit

Restart the 'puter; countdown displayed to stop disk scan, ignored. Message displayed "scanning and repairing drive" which went up to 100% complete (twice), no errors.

'Puter boots into Windows. X no longer assigned to partition 2. Removed as part of scan? Chkdsk results only seem to show evidence of filesystem scan. No idea why \??\. The system partition is the only FAT32 partition so it ran on the right one. In case of any doubt, this is the wininit event report, i.e. scan run on start-up.

TimeCreated : 25/01/2021 16:54:22
Message     :

              Checking file system on \??\SystemPartition
              The type of the file system is FAT32.

              A disk check has been scheduled.
              Windows will now check the disk.
              Volume Serial Number is FEA6-20C9
              Windows is verifying free space...
              Free space verification is complete.

              Windows has scanned the file system and found no problems.
              No further action is required.

                  268435456 bytes total disk space.
                     204800 bytes in 9 hidden files.
                     663552 bytes in 159 folders.
                  119361536 bytes in 453 files.
                  148201472 bytes available on disk.

                       4096 bytes in each allocation unit.
                      65536 total allocation units on disk.
                      36182 allocation units available on disk.

So I told it to run with option /r but don't see anything indicating it did anything more than a filesystem check.

I really do give up. Another afternoon out of the window!

Nigel, can you create an Acronis System Report zip file then extract the disks.txt file from this and upload as a file attachment to this topic please.

Ditto Steve here,  the last time an issue somewhat close to this came here it was a OEM partition on the disk which was causing the failure.  That may be the case again.

Steve - disks.txt as requested.

Enchantech - The only partition which crashes the program is the EFI System partition. As previously reported, I ran a series of tests and successfully backed up the other partitions.

Just for fun (cough) I tried running VSS Disk Doctor diagnostics - clean bill of health.

Nigel, thanks for the disks report, this doesn't show any errors being reported for any of the partitions including the EFI partition.

What it does show, in line with Bob's comment about OEM partitions, is that you have a 19GB OEM (factory recovery) partition.

The other factor from the disks report is the presence of two Windows recovery partitions but of significantly different sizes.

          PS         Speed IFace Hs-Bs-Tg Model                     
Num  NT    L9NO  Size FSsize Free FS     Type            Label       ABCHSV Error
---- ----- ---- ----- ----- ----- ------ --------------- ----------- ------ ----------
1-   d(0) GPT   466G SATA  0-0-0    HGST HTS545050A7E680 GG2OAH10
                                  MBR                                ------
                                  GPTpri                             -----v
  -1       ----  650M  650M  389M NTFS   27 Windows RE H WINRE...... --c--V
  -2       ----  260M  260M  141M FAT32  EF EFI          ........... --c--V
                                  MSresr                             -----v
  -4       --CC  444G  444G   97G NTFS   07 NTFS, HPFS   Windows.... --w--V
  -5       ----  1.7G  1.7G  1.1G NTFS   27 Windows RE H ........... --c--V
  -6       --DD   19G   19G  1.9G NTFS   07 NTFS, HPFS   RECOVERY... --c--V
                   5M             unallc                             ------
                                  GPTbck                             ------

All of the above does not really fit with the previous statement by Nigel that the BSOD only occurs when backing up the EFI partition, of which there is only the one!  So doesn't really fit in with the issues seen with OEM partitions or by having duplicate recovery partitions.

Last one of the day - just to repeat that the four NTFS partitions shown in Steve's above post (#27) can be backed up, no problem. Try and include the FAT32 partition and SPLAT with a BSOD.

I am wondering if it is some kind of protection problem as in Windows will not let ATI access that partition for some reason, resulting in the crash. As you know, I did try running the backup with Windows Defender, Firewall and file protection (where you have to give an "app" permission to access certain folders) all switched off. Did not make any difference.

The crash parameters are specific about it being related to illegal memory access.

I am at the point where I have to give up because I need to do a backup, and that means going back to ATI 2015 which is a pain in the backside timewise. I will see if I can get a support issue raised. I don't think there is anything wrong with my 'puter. Acronis cannot be expected to forsee every possible hardware and software combination and I guess I'm just unlucky. That said, no software should just crash out like this. Something ain't getting handled somewhere!

Cheers for today.

Looking back at post #17 I note Steve found that the MS storport.sys driver was reported as cause of the BSOD.  Some research suggests that this could be the result of a corrupted storage controller driver.  That makes sense here as storport.sys works with storage controller drivers and ATI relies on these drivers to perform its work.

Nigel, I know you were encouraged by Steve earlier in this thread to run SFC /scannow on your system, did you do that?  You really should do this as if the storport.sys driver is at fault SFC will replace it with a new instance.  You can run this command from an admin PowerShell prompt or and admin Commanc Prompt

If SFC finds no issues then the next step would be to update the Storage Controller drivers on your PC.  You may have two or more controllers which you should update.  The image below show them in Device Manager.

MS recently upgraded the Storage Spaces Controller so it would be worth rolling back the driver for that if one is available.

You might see other controllers listed under Storage Controller, each will have its own drivers. I recommend downloading the latest drivers from the manufacturers support sites and updating the rest of the controller drivers regardless of where they are shown in Device Manager.

Nigel, taking a lateral approach here:  have you considered trying any alternative competitor applications to backup the problem EFI partition?  If not, then I would recommend trying either Macrium Reflect and/or MiniTool ShadowMaker, both of which offer a free version that could be used for such tests.  This would help show if this is a problem specific only to ATI or whether it is one that would impact any application trying to backup that partition?

Hi Steve,

I don't need to try anything else. ATI 2015 works fine! It backs up the FAT32 system partition as part of the full system backup without crashing in a heap. I can see it when I mount the backup. Same argument goes for the drivers. Seems to me that if I had a driver problem, ATI 2015 would not be able to do the backup because it would not be able to access the system partition.

I did run SFC /scannow and although it reported "Windows Resource Protection found corrupt files and successfully repaired them" there is no sign of any drivers being replaced. The log file shows two non-critical errors relating to 20H2 availability whereas I am on 2004, and one file was repaired:

2021-01-26 02:06:22, Info                  CSI    00000344 [SR] Repairing 1 components
2021-01-26 02:06:22, Info                  CSI    00000345 [SR] Beginning Verify and Repair transaction
2021-01-26 02:06:23, Info                  CSI    00000346 [SR] Repairing file \??\C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\\OneDrive.lnk from store
2021-01-26 02:06:23, Info                  CSI    00000347 CSIPERF - FilePI Queue 322ms
2021-01-26 02:06:23, Info                  CSI    00000348 [SR] Repair complete
(several lines omitted)
2021-01-26 02:06:23, Info                  CSI    0000034e [SR] Verify and Repair Transaction completed. All files and registry keys listed in this transaction  have been successfully repaired

I have uploaded the log file in case you want to take a look. Thanks again for your time - much appreciated - and to Enchantech too.

Cheers,

Nigel

Nigel, if you have a working solution with ATI 2015 that is great!  It is possible that running SFC /SCANNOW has fixed the issue causing the EFI partition to crash the PC when being backed up but that is somewhat academic at this point!  Thanks for the update / feedback.

Hi Steve,

I haven't gone back to ATI 2015 yet but that is what is going to happen next.

Just be be clear, ATI 2015 *always* worked ok as regards the system partition, i.e. it worked fine before I tried ATI 2021. I am going to have to uninstall ATI 2021, run the clean-up tool, make sure registry entries removed, and install ATI 2015 to get a full system backup. I cannot delay any longer. It is almost a month since my last successful backup and that is waaaay too long.

I have a huge backlog of other stuff to deal with at the moment (not least a tax return - eek!), but when I get some time I shall uninstall ATI 2015 and try ATI 2021 again in the full expectation it won't work so that I can submit a support ticket. I have been hoping that something would come up to solve the issue but it has not been the case despite all our efforts. I have spent countless hours trying various things as this thread shows. I must also offer a huge thanks to you for your time spent on this matter. There might be more required in the near future!

As regards the BSOD report, I strongly suspect that for some reason ATI 2021 is doing something different for the system partition and is calling the driver (via storport.sys) when the system is not in the right mode because of something else going on, and it is this that causes the illegal memory access error.

Thanks again,

Nigel

Nigel, two comments.

You can boot your PC from your Acronis Rescue Media (2015 or 2021 - your choice) and make a full backup to give peace of mind / protection.

We are not seeing other users reporting BSOD's with ATI 2021, and not seeing this ourselves, so even if 2021 is doing something different, it is not having any widespread impact that is being reported in the forums.

Hi Steve,

I think this will be my last post for a while. I uninstalled ATI 2021 and then ran the cleanup tool. I checked the registry as per instructions; nothing to do there.

I installed ATI 2015 with no problems and have just successfully run my first full backup since 31st December 2020. I have mounted the FAT32 EFI System Partition in the resulting tib file and was able to have a good look around the folders and files, so all good there.

It is a mystery why ATI 2015 runs fine on my machine, but ATI 2021 crashes in a BSOD heap when it tries to backup the EFI System Partition. Is it because I have IIS running? - or MySQL? The only thing different is the Acronis software, so if it looks like a duck, walks like a duck and quacks like a duck, it's a duck! - Acronis is the guilty party m'lud!

I will stick with ATI 2015 for the time being. I will not try ATI 2021 again on this machine unless I suddenly have lots of spare time on my hands. The only exception to this is I might try running a backup from the ATI 2021 rescue media to see what happens in which case I will post the result here.

I would like to thank you for your time in trying to resolve this problem. All I want is something that will reliably backup and restore my data. ATI 2015 seems to do that fine. I can appreciate the reasons why Acronis want to provide a cloud solution as part of the backup options but I do wish they had stopped there. Maybe a separate product for the extra bits, or supplied as an optional add-on, so you can be sure that you don't have unwanted processes running in the background.

Bye for now,

Nigel