NTBackup / VSS Problem, not backing up everything

[marios]

Hi. I've found that ntbackup isn't backing up everything I want it to.

In particular, it's not backing up various (but not all) files i
\Windows, \Windows\System32, etc. The files it's missing are, for th
most part, DLLs and EXEs.

My suspicion is that it's open files that are being missed (although
don't understand why, for example, notepad.exe should be open while I'
not running it, so maybe "open files" isn't a complete analysis).

There's no error from ntbackup itself, or in the ntbackup lo
files/reports. If I try to do a backup of just one of these files
backup runs through fine but reports zero files backed up (and, indeed
it's not in the .bkf).

However, I am getting the following application event:

Event Type: Error
Event Source: VSS
Event Category: None
Event ID: 12289
Date: 19/07/06
Time: 20:52:08
User: N/A
Computer: MARIOS-DT
Description:
Volume Shadow Copy Service error: Unexpected erro
CreateFileW(\\?\Volume{d8f77345-06e3-11db-af80-806d6172696f},0xc0000000,0x00000003,...)
hr = 0x80070005.

For more information, see Help and Support Center a
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 49 4e 43 49 43 48 4c 48 INCICHLH
0008: 32 30 35 00 00 00 00 00 205.....
0010: 53 50 52 44 49 46 46 43 SPRDIFFC
0018: 39 36 00 00 00 00 00 00 96......

MOUNTVOL reports that the id in the above error is my A: drive (th
floppy). Needless to say, I'm not backing up to or from the floppy a
all, so I don't know why it's trying to do anything with it.

I've tried clearing out ntbackup's exclusion list (by renaming th
FilesNotToBackup registry entry), but that didn't make any difference.

If I turn on "Disabled Volume Shadow Copy" in ntbackup I no longer ge
the above VSS event, but it still doesn't backup the files.

I'm running XP pro SP2, fully up to date with Windows Updates. All m
hard drives are NTFS. Other than missing out saving chunks of files
backup seems to be working ok (if you can call that ok).

Any help would be much appreciated.

Regards
Mario

 

[POP]

I'm not sure how much help I can be, but I can add at least a
little bit of info for you.

"Shadow Copy" is what enables you to back up files that are "in
use". So in theory at least, as long as Shadow Copy is enabled,
there should be no pro blems due to files that are in use.

Have you tried clicking the MS link that's offered? Occasionally
those will lead you to solutions to problems but it's not a sure
thing.

That's about all I can suggest; maybe someone else will still
come along with better input based on the info you gave.

HTH
Pop`

 

[thecreator]

Hi marios,

Open Services located in Administrative Tools in the Control Panel.
Scroll down until you see Volume Shadow Copy. Start the service. Close
Services and try NTBackup again.

 

[marios]

Dear Pop,

Thanks for the reply. Yes, I was aware of the function of the service,
and I had already tried the link; it gives the usual "no further info"
that the vast majority of event links seem to give :-(

Dear thecreator,

The service (along with MS Software Shadow Copy Provider) is configured
for manual start, and both start ok by themselves when I run ntbackup --
at least, by start ok I mean the system event log has the usual "was
sent a start control" & "entered the running state" pairs of entries.

I tried your suggestion of starting the service(s) myself before
running ntbackup, but unfortunately that doesn't help.

I did note though that the VSS error in the application log doesn't
occur until I actually try and backup some files, i.e. it's not
occuring as part of just having the service started and running.

Thinks: as the event message seems to indicate that VSS and/or ntbackup
are trying to do something with the floppy (for some unknown reason), is
there any way of configuring them not to? I can't find any obvious
parameters....

Regards
Marios

 

[thecreator]

Hi Marios,

When you go to Backup, it asks you where to Backup to. The selection
highlighted is the 3 ½" Floppy Drive. Click Browse and click Cancel to
insert a disk into the floppy drive. Now you can use where to Back Up to,
including a CD-RW Disk or even a DVD -RW Disk that is formatted to act as a
Floppy Disk to accept information. You can also back up to a different
partition and hard drive.

 

[frodo]

fwiw, there is a reg key that defines files that should not be backed up;
it is used by _BOTH_ ntbackup and System Restore. it's name is:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\BackupRestore\FilesNotToBackup

you might want to check it to see if it maight be the cause. the contents
of this key are available via the GUI Options | Excluded Files dialog.

as for Shadow Copy, the service needs to be available for ntbackup to use;
when you click Start Backup and the Progress dialog comes up, the first
thing displayed in the status line should be "preparing to backup via
shadow copy..." (or something to that effect); if you don't see that then
it isn't trying to use Shadow Copy; check the options under Advanced
(click Start Backup once, then click "Advanced..." on the Backup Job
Information dialog _BEFORE_ clicking the second Start Backup button);
inspect the "disable shadow copy" option, is should be UNCHECKED;
depending on the backup type it may be dimmed (system state requires it to
be unchecked).

good luck.

 

[marios]

Eh? Where does it do that? It always wants to write the .bkf to my
third hard drive by default (probably 'cos that's where I always do my
backups to).

I regularly (well, fairly) do Normal backups of my entire C drive and
have Differentials scheduled to run every evening on a weekly cycle
(i.e. one for Monday, another to a different .bkf for Tuesday, etc).
All of these go to my third drive, and the Normal backup also gets
split with a file splitter and copied onto DVDs.

So, if needed I can restore the system using the Normal + last
Differential, or roll back to the state of any day up to a week ago.
If the whole system blows up I can go back to the DVDs.

That's the theory at least. My discovery that the Shadow Copy isn't
working and not all of my files are getting backed up rather
compromises the idea.

Oh, thinks, you're probably talking about Wizard mode....no, haven't
used that in years, always go straight in under (so called)
Advanced....

Cheers
Marios

 

[marios]

Dear Frodo,

Thanks for the reply, but I've covered that already. As mentioned in
my original post, I tried clearing out FilesNotToBackup (by temporarily
renaming it) -- and then checked that the exclusion list was indeed
empty in the backup dialog -- and it didn't make any difference.

Disable Shadow Copy is unchecked, and it does say Preparing to backup
via shadow copy. Both the Volume Shadow Copy and MS Software Shadow
Copy Provider services start BUT I get the VSS event in the original
post, and lots of files don't get backed up.

Sigh....

Marios

 

[marios]

Small update....

I removed the floppy drive from the system (using the BIOS), and n
longer get the VSS event related to that. However, ntbackup stil
doesn't backup any open files.

So, in summary:

NTBackup fails to save various files, that I suspect are open. I
says, both in the GUI and in the report, that it is using Shadow Copy.
It gives no errors, either in the GUI or reports, and there are (now) n
error or warning events listed.

The Volume Shadow Copy service starts ok, as do the MS Software Shado
Copy Provider, COM+, and Removable Storage services.

It isn't anything to do with FilesNotToBackup, as I've tried clearin
that out.

If I try to backup just one of the files it misses (e.g
\Windows\explorer.exe) it runs through fine, with no errors reporte
(at least anywhere I can find), but doesn't save the file. If I make
copy of the file it backs up the copy ok.

So...it looks like the Volume Shadow Copy service isn't working, bu
not giving any errors or reasons why not.

I assume other people are successfully backing up open files wit
NTBackup (would somebody like to check please?), so I'm stuck.....

Anyone got any ideas?

Thanks
Marios

(XP pro SP2 with all updates)

 

[thecreator]

Hi marios,

Are you trying to do an image of the operating system partition, using
NTBackup?

I have an icon of NTBackup on my Desktop. I did it and opens up to
"Welcome to the Backup Advanced Mode".
At the top, it shows Job Edit View Tools Help. Under Tools there is Options.
Clicking Options, shows Exclude Files which you click on. It has a lists of
Excluded Files shown.It is listed under "Files excluded for all users:"

If you look between Filename and Application there is a vertical line.
If you move the mouse over that line, the pointer turns into a plus sign.
Left click it and drag it over to the right, then you can read the entire
filename or folder. when you run out of space just keep going, until you can
read it all.

Are these the files you want to back up?

 

[POP]

In

Small update....

I removed the floppy drive from the system (using the BIOS),
and no
longer get the VSS event related to that. However, ntbackup
still
doesn't backup any open files.

So, in summary:

NTBackup fails to save various files, that I suspect are open.
It
says, both in the GUI and in the report, that it is using
Shadow Copy.
It gives no errors, either in the GUI or reports, and there are
(now)
no error or warning events listed.

The Volume Shadow Copy service starts ok, as do the MS Software
Shadow
Copy Provider, COM+, and Removable Storage services.

It isn't anything to do with FilesNotToBackup, as I've tried
clearing
that out.

If I try to backup just one of the files it misses (e.g.
\Windows\explorer.exe) it runs through fine, with no errors
reported
(at least anywhere I can find), but doesn't save the file. If
I make
a copy of the file it backs up the copy ok.

So...it looks like the Volume Shadow Copy service isn't
working, but
not giving any errors or reasons why not.

I assume other people are successfully backing up open files
with
NTBackup (would somebody like to check please?), so I'm
stuck.....

Anyone got any ideas?

Thanks
Marios

(XP pro SP2 with all updates).

I just tried it. Frist I backed up the Themes folder and then
grabbed the /windows folder and backup it up. All worked fine,
files are there, the Report in backup lists the correct files,
times, etc., as expected.

I lost the Report that backed up the in-use files, which I
verified at least some of them were in use by trying to rename
them, but here's the Report from doing the themes backup:
IF you really need to see it, ask and I'll repeat it for the
in-use files and post the Report here; I'm short on time and
rushing right now<g>

HTH
Pop`
=============

Backup Status
Operation: Backup
Active backup destination: File
Media name: "2006-05-27 C and D Drives WITH SYSTEM STATE.bkf
created 7/22/2006 at 2:08 PM"

Backup (via shadow copy) of "C: SYSTEM"
Backup set #1 on media #1
Backup description: "Set created 7/22/2006 at 2:08 PM"
Media name: "2006-05-27 C and D Drives WITH SUSTEM STATE.bkf
created 7/22/2006 at 2:08 PM"

Backup Type: Normal

Backup started on 7/22/2006 at 2:08 PM.
Folder C:\WINDOWS\Resources\Themes
Luna.theme 1222 9/3/2002
9:00 AM
Windows Classic.theme 3025 9/3/2002
9:00 AM
Folder C:\WINDOWS\Resources\Themes\Luna
Folder C:\WINDOWS\Resources\Themes\Luna\Shell
Folder C:\WINDOWS\Resources\Themes\Luna\Shell\Homestead
Folder C:\WINDOWS\Resources\Themes\Luna\Shell\Metallic
Folder C:\WINDOWS\Resources\Themes\Luna\Shell\NormalColor
Backup completed on 7/22/2006 at 2:08 PM.
Directories: 9
Files: 2
Bytes: 6,103
Time: 1 second

----------------------

 

[marios]

Dear thecreator,

I'm trying to backup my entire C disk, which includes the OS, and most
other things in fact. The files in the exclude list I don't care about
(no point in backing up the pagefile, etc, anyway). DLLs, EXEs, etc, in
\Windows, Windows\System32, etc I do care about and it's some of these,
amongst others, than are not getting backed up. None of them are in
the exclude list which, anyway, as I said, I've tried totally
clearing.

Dear Pop,

Are you sure it backed up everything you wanted? The report you posted
doesn't list the .DLLs in the Homestead, Metallic, & NormalColor
subfolders of Luna\Shell. At least on my system, there's a
shellstyle.dll in each of those. See if you can backup those (I
can't).

Regards
Marios

 

[thecreator]

Hi marios,

Have you tried a different backup program? Have you enquired about doing
an Image of the partition? Norton Ghost program. Nero which now includes
Nero BackItUp and there is always BootItNG found here:
http://www.terabyteunlimited.com/bootitng.html

 

[marios]

Dear thecreator,

No, I haven't. I figure NTBackup has been around for long time and so
the problem is almost certainly something to do with my configuration,
rather than anything wrong with NTBackup itself. So I'd prefer to try
and figure out what's happening, rather than splashing out on other
backup software, although it may come to that yet....

It's encouraging (if that's the right word here) to see that, on the
evidence posted, Pop may also be having the same problem. Can you (or
anyone else) backup the DLLs mentioned with ntbackup? Or
c:\windows\explorer.exe for that matter....

Regards
Marios

 

[marios]

Dear Pop,

Are you sure it backed up everything you wanted? The report you posted
doesn't list the .DLLs in the Homestead, Metallic, & NormalColor
subfolders of Luna\Shell. At least on my system, there's a
shellstyle.dll in each of those. See if you can backup those (I
can't).

Regards
Marios

(Sorry for the re-post; as I originally included this in a reply to
another post, I'm not sure if Pop got notified about it or not...)

 

[Guest]

Marios,

From the other posts on this page it looks like I am the only person who has
experienced your problem. And I have exactly your problem so I don't think
its anything unique to your setup.

I only figured out that some files weren't getting backed up when I checked
my backup in detail as I am about to swap out the hard disk on my laptop.
(Like they say. You don't really have a backup until you have checked that
you can actually restore from that backup. I'm afraid I'm guilty of not
actually checking that until now.)

And so I have even been doing the same as you, i.e. backing up just one file
that I know isn't being backed up. e.g. \windows\system32\cscui.dll. No joy.

One thing I noticed at first was that you need to have at least one NTFS
drive on your machine to use the VSS. But I assume you have otherwise you
would be getting something "Can't use shadow copy reverting to normal mode"
which is what I noticed I was getting before I added an NTFS partition. Doh!

I thought that might fix my problem but it does still seem that a heap of
files aren't getting backed.

So the search goes on. Be nice if someone from microsoft got on here and
cleared this up. Maybe we aren't using the right forum here. Keep you posted
if I come across anything.

Mike

 

[marios]

Dear Mike,

Thank you very much for your post -- it's so nice to know one is no
alone! (Although I suspect Pop is having the same problem, from th
info in his post). That's one of the files I can't backup too.

All of my disks are NTFS, however, I have a new theory, well
observation at least....

All of the files not being backed up appear to have a correspondin
copy in \windows\system32\dllcache.

I haven't verified this exhaustively (as you say, there's a heap o
files not getting backed up) but it's certainly true of every one I'v
looked at, and I haven't found a counter example yet.

If this is indeed the case, then I wonder if the behaviour is b
design. The files in \dllcache ARE getting saved, so possibly NTBacku
is figuring that there's no point in also saving the "live" copie
outside of \dllcache, as the Windows File Protection system wil
restore them from \dllcache if they're missing.

I can't find any references to this behaviour anywhere, and I'm no
willing to zap my system disk and restore from backups to test th
theory, however, it sounds like you are in a position to do so (I'
assuming by "swap out" you mean you'll still have the original har
disk, which you can put back in if it all goes belly up....)

Cheers
Marios

 

[Guest]

Mario,

If its any consolation, I am having exactly the same problem. You are not
alone.

I even did the same thing as you, tried to back up one file that i could see
was not being backed up but should be (a .dll in the system32 dir). Nothing.

I did get excited when I found a KB article that pointed to a registry bug
that might be causing the problem. (v. dodgy)

http://support.microsoft.com/kb/883357/en-us

But apparently that got patched already in SP2. (so says the installer) So
back to the drawing board.

I don't think I could be bothered spending too much time on it. I have to
swap a disk out asap so think I'll just run with Symantec Ghost. Probably a
safer option anyways.

Good luck and do post if you get a resoltion. (as will I of course)

And I must say you have some patience responding to all the people who have
replied (I suppose they are trying to helpful)

Shame there are no MS experts on reading this group.

Mike

 

[marios]

Dear Mike,

Yeah, I'd already found that KB article and, like you, determined that
that wasn't the problem (and I didn't trust what the installer said, I
went and checked the registry key in question).

There really shouldn't be any safer option than NTBackup for backing up
an NT based system, as XP is.

Ok, I know, "failure isn't an option -- it's bundled with every
Microsoft product", but let's face it, if NTBackup did regularly screw
up in saving/restoring files (especially operating system files, as the
ones we've been looking at), then surely we'd have found the screams.
I've done pretty extensive searches on the matter, and not found much
of anything.

The lack of noise on the subject makes me suspect that either it's
something specific to our (and Pop's) configurations, or it's by design
re my \dllcache theory in my previous post, and when you restore the
backup the Windows File Protection system sorts it all out
automagically.

Far be it for me to wish grief and hassle on you, but if you do have
the time (and assuming you will still have the original hard disk of
course, should things not work), it would be worth trying NTBackup when
swapping your disk to (hopefully) put all our minds at rest.

Regards
Marios

 

[Guest]

Marios,

Actually, I just found the answer. (and I'm a bit embarrased)

Turns out all those system files are stored in the system state backup that
get's created when you do a backup on C: Try restoring that part of the
backup to an alternate location and shazam... there they all are.

So I think I'll go ahead with the new disk and try to restore using ntback
and see how I go. Always got the ghost in case I need it.

Mike