Backups being Deleted by Acronis 2018 without User Input
Hi - I have a significant issue. I have two PCs with Acronis 2018 running on them. One has a weekly schedule of backups covering C drive [OS and programmes] to two separate locations and single backup of E Drive [User Files].
The other PC runs non-scheduled backups of the C Drive and selected Users Files [again on the E Drive].
In all cases the backups are based on 'Incremental' with an additional full backup set for either every 10 or 20 'runs'. In all cases the Clean-up option is turned-off.
The PC running the scheduled backups displayed failure messages this morning after the scheduled backups. The error message read "The last backup has failed. The specified file does not exist."
On inspection all but four of scheduled backups had been deleted from the relevant folder. It should have contained 47 weekly backups.
The backups deleted covered a period from 11th April 2018 to 4th February 2019. Four 'random' backups remained [11th August, 18th August, 24th August and 1st December]. All of these were Incremental - no full backups exist any more.
On the TI Backup tab - using the drop-down menu top right, some of the original backups are still listed.
Trying to run a recovery - those backups will not load - and I get the message "Cannot Find Version 1".
Going to the backup folder through Windows Explorer shows the backups are not there. It's not an issue with TI not 'seeing them' - they are gone.
On the other PC [without a scheduled back-up] - backups have also been deleted.
To be absolutely clear I have not deleted them deliberately or by accident. The deleted files span 5 different backup schedules/regimes and five separate folder locations spanning 3 separate HDDs.
We also have four other PCs running earlier versions of Acronis TI. There seems to be no issue here.
The two PCs affected so far run Windows 7 Pro 32bit. Both are fully patched. One runs Norton AV - the other Kaspersky. We're not picking-up any Malware or Ransomware.
I'm very concerned. Anyone any thoughts or ideas?
Steve - thanks for a swift reply. It's early in the process of working out what has happened - so still trying to piece together what's going on.
My main PC backs-up two 'clones' of the C drive [OS + Programmes] to two different locations. One on another internal HDD and one to an external HDD. The other PC backs-up to a partition on it's only HDD [it's a laptop] - and very occasionally to an external HDD too.
For my main PC backups on the both the internal and external HDDs have been deleted - and, so far - cannot be recovered. [Tried Recuva and Restorer Pro].
As you say - there's not a lot on the Web about this issue - but recently come across this. https://forum.acronis.com/forum/acronis-true-image-2018-forum/after-updating-ati-2018-build-11530-most-previous-backups-not-seen
It seems that there are some issues with TI 2018 Build 11530. And that's the version I am using. [Not updated because "if it's not broke - why fix it". Although may have got that spectacularly wrong.] I note that you got involved here. My suspicions are still that TI is at fault.
One PC had active protection - one did not. I got no notification that a deletion was in progress. One of the backups did have Cleanup as part of the schedule - the rest did not.
Across all the variations - it's hard to see any common pattern - except that build number. As far as when the issue started - one PC yesterday after a back-up and another today before the scheduled backup had started.
Would be curious to know if you think that there may be a bug lurking in build 11530?
We would need the log files Steve requested earlier. To make more than an assumption, they may provide some details.
If you are cloning, that is one for one and not a backup. A clone always overwrites the data to mirror what is on the drive it cloned from.
If these are all backups then yes, they should not be deleting themselves but may depend on your settings. To date, you're the only one reporting this behavior in the forum so it's likely localized to something configured or that you're doing. It may not be though.
Hopefully, each backup has its own dedicated folder and a unique name too. You don't want to be using the same folder or same backup name as they could cross reference each other between the different systems.
Could you please upload your logs as Steve requested? Maybe some screenshots of your backup tasks and their schedules and cleanup rules too?
Your ATI 2018 Build 11530 is now 2 builds back and you are at risk from all the issues fixed the the later builds 12510 and 15470.
I would strongly recommend updating to the latest 15470 build which was released just last week to resolve further known issues.
Hi Bobbo - thanks for your response.
Below are the logs for two failed backups 'run' from one of the PCs. Assume this is what you are asking for.
I've also included the logs from the same backups last week that were successful [at the bottom]
Also included are some screen shots of the setup for those backups. One has Clean-up enabled - one does not.
[On this PC - Active Protection was enabled - it wasn't on the other].
Also some screen shots of the folder before the backup files were lost - and after.
The MVP Log viewer shows no evidence that I/Acronis has deleted the files. As stated above - all but four of the backups have simply vanished. It's not a change of file name, or letter or an external HDD that's gone bad - the files simply seem to have gone.
[Each backup does have it's own dedicated name and folder.]
I haven't deleted the files; no-one else on the household has deleted the files, we're running two different AVs [on different machines], it's a fully patched Wndows 7 Pro OS, there's a Watchguard Network Security Appliance sitting between us and the internet, etc.
The only new 'software' introduced on to the PCs/Network were the 'Patch Tuesday' MS OS updates.
Happy to send the logs and screen shots from the other PC [the laptop] - but the same vanishing act.
In an attempt to get a stable and trustworthy version of TI running - I have now upgraded to 2018 Build 15470 on both machines.
Hope this helps.I'm still scratching my head. Although I'm looking very hard at that post for Build 11530.
The backup log for PC1 - Users files. Run weekly at 3:30 am. Backed-up to an Internal HDD. [This is the first attempt of five - all with similar logs].
09/02/2019 03:30:02: 00 2832 I00640000: Backup reserve copy attributes: format tib; need_reserve_backup_copy false;
09/02/2019 03:30:02: 00 2832 I00640002: Operation NEW E Drive Weekly Backup to STREAM started by schedule.
09/02/2019 03:30:06: 00 2832 I00640000: Backup reserve copy attributes: format tib; need_reserve_backup_copy false;
09/02/2019 03:30:06: 00 2832 I013C0000: Operation: Backup
09/02/2019 03:30:06: 00 2832 I0064000B: Priority changed to Low.
09/02/2019 03:30:06: 00 2832 W01E50023: Error 0x1e50023: The specified file does not exist: G:\NEW Weekly ACRONIS Backups\Weekly E Drive\NEW E Drive Weekly Backup to STREAM_full_b3_s1_v1.tib.
09/02/2019 03:30:06: 00 2832 E00040011: Error 0x40011: The specified file does not exist.
09/02/2019 03:40:06: 00 2832 E01E50023: Error 0x1e50023: The specified file does not exist: G:\NEW Weekly ACRONIS Backups\Weekly E Drive\NEW E Drive Weekly Backup to STREAM_inc_b3_s18_v1.tib.
09/02/2019 03:40:06: 00 2832 E013C0005: Error 0x13c0005: Operation has completed with errors.
Start: 09/02/2019 03:30:02
Stop: 09/02/2019 03:40:06
Total Time: 00:10:04
The backup log for PC 1 - C Drive [OS and Programmes]. Run Weekly to an External RAID1 HDD.
09/02/2019 08:00:02: 00 924 I00640000: Backup reserve copy attributes: format tib; need_reserve_backup_copy false;
09/02/2019 08:00:02: 00 924 I00640002: Operation NEW C Drive Weekly Backup to WD started by schedule.
09/02/2019 08:00:13: 00 924 I00640000: Backup reserve copy attributes: format tib; need_reserve_backup_copy false;
09/02/2019 08:00:13: 00 924 I013C0000: Operation: Backup
09/02/2019 08:00:13: 00 924 I0064000B: Priority changed to Low.
09/02/2019 08:00:13: 00 924 W01E50023: Error 0x1e50023: The specified file does not exist: H:\NEW Stream C Drive Images\NEW C Drive Weekly Backup to WD_full_b5_s1_v1.tib.
09/02/2019 08:00:13: 00 924 E00040011: Error 0x40011: The specified file does not exist.
09/02/2019 08:10:13: 00 924 E01E50023: Error 0x1e50023: The specified file does not exist: H:\NEW Stream C Drive Images\NEW C Drive Weekly Backup to WD_full_b5_s1_v1.tib.
09/02/2019 08:10:13: 00 924 E013C0005: Error 0x13c0005: Operation has completed with errors.
Start: 09/02/2019 08:00:02
Stop: 09/02/2019 08:10:13
Total Time: 00:10:11
[Same two backups last week - ran perfectly].
02/02/2019 03:30:02: 00 1896 I00640000: Backup reserve copy attributes: format tib; need_reserve_backup_copy false;
02/02/2019 03:30:02: 00 1896 I00640002: Operation NEW E Drive Weekly Backup to STREAM started by schedule.
02/02/2019 03:30:05: 00 1896 I00640000: Backup reserve copy attributes: format tib; need_reserve_backup_copy false;
02/02/2019 03:30:05: 00 1896 I013C0000: Operation: Backup
02/02/2019 03:30:05: 00 1896 I0064000B: Priority changed to Low.
02/02/2019 03:30:06: 00 1896 I000B03F0: Create Backup Archive From: NTFS (E:) To file: G:\NEW Weekly ACRONIS Backups\Weekly E Drive\NEW E Drive Weekly Backup to STREAM.tib Compression: Normal Exclude: Files matching mask Match criterion: hiberfil.sys, pagefile.sys, $Recycle.Bin, swapfile.sys, System Volume Information, *.tib, *.tib.metadata, *.~, *.tmp, C:\Users\My Name\AppData\Local\Temp, C:\Users\My Name\AppData\Local\Microsoft\Windows\Temporary Internet Files, C:\Users\My Name\AppData\Local\Google\Chrome\User Data\Default\Cache, C:\Users\My Name\AppData\Local\Opera Software, C:\Users\My Name\AppData\Local\Mozilla\Firefox\Profiles, C:\Windows\CSC
02/02/2019 03:30:07: 00 1896 I000101F8: Pending operation 173 started: 'Creating partition image'.
02/02/2019 03:30:19: 00 1896 I00100000: Volume Tracker has failed to find changes on volume 'E:'.
02/02/2019 03:30:44: 00 3812 I00640000: Writing incremental version to file: NEW E Drive Weekly Backup to STREAM_inc_b3_s18_v1.tib
02/02/2019 03:31:29: 00 1896 I000101F8: Pending operation 173 started: 'Creating partition image'.
02/02/2019 03:31:29: 00 1896 I00640000: The following backups have been successfully created: G:\NEW Weekly ACRONIS Backups\Weekly E Drive\NEW E Drive Weekly Backup to STREAM_inc_b3_s18_v1.tib
02/02/2019 03:31:30: 00 1896 I013C0006: Operation has succeeded.
Start: 02/02/2019 03:30:02
Stop: 02/02/2019 03:31:30
Total Time: 00:01:28
and
02/02/2019 08:00:02: 00 11836 I00640000: Backup reserve copy attributes: format tib; need_reserve_backup_copy false;
02/02/2019 08:00:02: 00 11836 I00640002: Operation NEW C Drive Weekly Backup to WD started by schedule.
02/02/2019 08:00:05: 00 11836 I00640000: Backup reserve copy attributes: format tib; need_reserve_backup_copy false;
02/02/2019 08:00:05: 00 11836 I013C0000: Operation: Backup
02/02/2019 08:00:05: 00 11836 I0064000B: Priority changed to Low.
02/02/2019 08:00:05: 00 11836 I000B03F0: Create Backup Archive From: System Reserved (1-1), NTFS (C:) To file: H:\NEW Stream C Drive Images\NEW C Drive Weekly Backup to WD.tib Compression: Normal Exclude: Files matching mask Match criterion: hiberfil.sys, pagefile.sys, $Recycle.Bin, swapfile.sys, System Volume Information, *.tib, *.tib.metadata, *.~, *.tmp, C:\Users\My Name\AppData\Local\Temp, C:\Users\My Name\AppData\Local\Microsoft\Windows\Temporary Internet Files, C:\Users\My Name\AppData\Local\Google\Chrome\User Data\Default\Cache, C:\Users\My Name\AppData\Local\Opera Software, C:\Users\My Name\AppData\Local\Mozilla\Firefox\Profiles, C:\Windows\CSC
02/02/2019 08:00:05: 00 11836 I000101F8: Pending operation 173 started: 'Creating partition image'.
02/02/2019 08:00:10: 00 5752 I00640000: Writing full version to file: NEW C Drive Weekly Backup to WD_full_b5_s1_v1.tib
02/02/2019 08:00:12: 00 11836 I000101F8: Pending operation 173 started: 'Creating partition image'.
02/02/2019 08:12:31: 00 11836 I000101F8: Pending operation 173 started: 'Creating partition image'.
02/02/2019 08:12:31: 00 11836 I00640000: The following backups have been successfully created: H:\NEW Stream C Drive Images\NEW C Drive Weekly Backup to WD_full_b5_s1_v1.tib
02/02/2019 08:12:32: 00 11836 I000B0000: Consolidate Backup Archive Location: H:\NEW Stream C Drive Images\NEW C Drive Weekly Backup to WD_full_b5_s1_v1.tib Destination: H:\NEW Stream C Drive Images\NEW C Drive Weekly Backup to WD_full_b5_s1_v1_6C8892A6-11F9-4202-86A3-B6BE9D89A89B.tib
02/02/2019 08:12:32: 00 11836 I013C0006: Operation has succeeded.
Start: 02/02/2019 08:00:02
Stop: 02/02/2019 08:12:32
Total Time: 00:12:30
Sorry but the log data only confirms what we already understand that the files are not being deleted by the action of the backup process, but were missing when that process went to look for them, so again it is impossible to tell you why they were removed?
Glad to read that you have updated to the latest 2018 build 15470 version and hope that all goes well from this point forward.
Yeah, I don't see anything out of the norm either - just that it shows those backups completed successfully. All that comes to mind with what we have at the moment is weather or not anything else might be using those other drive letters (like another portable hard drive when one is attached and the other disconnected)? Could it have been written to another drive that had the same drive letter when it ran? Not likely, but I've never heard of backups just disappearing unless the cleanup schedule criteria was met and the version chain was removed as a result. That would show up in the logs though.