Cant boot one of my snapshots ??

Discussion in 'FirstDefense-ISR Forum' started by Longboard, Mar 28, 2013.

Thread Status:
Not open for further replies.
  1. Longboard

    Longboard Registered Member

    Joined:
    Oct 2, 2004
    Posts:
    3,187
    Location:
    Sydney, Australia
    Hello
    Interesting problem...
    Went to do a restart on my primary snapshot and got to 'CTR-ALT-DELETE' box-
    Hit the key combo and -nothing- no response
    Restart...same issue..
    Mouse moving, but stuck on the boot window
    OK: restart in 'Last known good..' same issue...stuck at CTRL-ALT-DEL ??
    Attempted restart in safe mode..goes to 'CTRL-ALT-DEL' box o_O Wot?
    That shouldnt happen afaik
    Google, google, google... many posts but few solutions

    OK: Tried booting into snapshot from 10 days ago: All good!

    Seems I have corrupted that snapshot somehow ??

    I know: should have better FDISR snapshot backup system :oops:
    I have a Full Shadow protect image from yesterday.

    Lots of emails seen/previewed and deleted over last 24/24
    No tricky surfing on that box
    Only new app/install is Webroot Av replaceing prevX.

    Heh: as usual with computers: "never happened before " !!

    WHat happened?
    Why does secondary boot ?
    SHould I restore from S-P?

    Regards :(

    PS: apart from HW problems: motherboard etc, the only info I can glean is that I must have rebooted in the middle of a down load or update of some tool.
    MS autoupdates off.
    Security apps on manual updates except Webroot ??
    DEleted all MS hotfix uninstallers recently: followed instructions: used CCleaner

    REbooted as I thought some simple operations were looking sluggish in explorer
    XPSP3 on that box: fully utd
    6 yr old Lenovo Think Centre: all lenovo tools disabled.
    Currently running Av scans in booted snapshot.

    Have observer impression that currently booted snapshot also feels 'sluggish'

    :eek:
     
    Last edited: Mar 28, 2013
  2. chrome_sturmen

    chrome_sturmen Registered Member

    Joined:
    Apr 29, 2006
    Posts:
    785
    Location:
    Sverige
    one good thing is that you have that shadow protect image from yesterday, so this becomes more of a learning issue than a grievous disaster :D

    maybe it was that change in your security software that did it, i was working on someones laptop the other day, and the simple action of installing the new version of avast rendered her computer unbootable, tested twice.. sometimes things just happen i guess.. which is why you have your fdisr snapshots and shadow protect images :thumb:

    if you can spare the hard disk space, maybe you could make a scheduled daily backup of your primary snapshot (as well as an archive)?
     
  3. Longboard

    Longboard Registered Member

    Joined:
    Oct 2, 2004
    Posts:
    3,187
    Location:
    Sydney, Australia
    Yes and Yes and Yes :)

    The current snapshot also has WSAAV in place :cautious: :doubt:
    Explorer shell seems to be slow in current snapshot.
    Definitely playing up :ouch:

    If I restore from S-P am I just heading down same path ?

    chkdsk ?
    sfc?
     
  4. Peter2150

    Peter2150 Global Moderator

    Joined:
    Sep 20, 2003
    Posts:
    17,054
    Security software can have strange affects as I learned this week. I installed a new version of NVT's ERP and without realizing it I hadn't whitelisted any FDISR stuff. While rebooting I decided to roll back the system so using the F1 interrupt, I switched to the Rollback snapshot.

    Oh goodie... No archives visible and no Primary Snapshot to update. Gulp. Rebooted and used the F1 key, and both snapshots showed so I booted into the primary whitelisted and all was well

    Even more bizarre, I periodically unplug my audio jack clean it and plug it back in. Later that day, I discovered my audio device was non existent. Assuming at first it was somehow software I went to boot to my rollback snapshot, and it bluescreened. Arch. Refreshed the rollback snapshot from it's archive, still bluescreened. Scratched my head a bit, remembered the jack, reseated it and everything worked normally again.

    Longboard, I am not sure exactly what you have going on but the image may be your only choice.

    For the future.

    Imaging. Use SP's continuous incrementals. That way you will have more frequent images to go to.

    FDISR. I use archives. Only two snapshots. Primary and a rollback which is strictly to boot to for refreshing the primary.

    I always a) refresh the primary archive at the end of the day, and also always do it before any software change(Vital).

    Archives and images are kept on an internal 2nd drive, and less frequently on an external drive.

    Pete
     
  5. Longboard

    Longboard Registered Member

    Joined:
    Oct 2, 2004
    Posts:
    3,187
    Location:
    Sydney, Australia
    Thanks for replies lads
    Nice to see this forum still being watched :)

    SO: still interesting: restored SP snapshot from day before problem: still same issue !

    Copied over from secondary FDISR image: still not quite right.

    Went back to SP snapshot from 3 days ago: tested a few incrementals to try and pinpoint time of issue: all good.
    Ipso facto: something happened in previous </= 72/24 :(

    Not sure what: as noted, only change is WSA.
    There have been a few posts re new installs of WSA over PrevX causing slowdowns.

    No real impact other than "ahh fook it", time lost with booting in and out, slight panic, googling, scanning, rejigging, making sure all data recovery in place.

    My SP images are kept on NAS drive: bit slow, only 15mbs, for backups and restores: not really sure where the choke point is: I think read write to the NAS boxes.

    This is the 'home' work box, and as such, heavily protected and streamlined.
    I leave copies of emails on webserver for 1 week: really to cope with situations like this.
    All documents/data stored externally as well.

    That's pretty much what I do.

    I Use SP scheduled jobs to 'back up" FDISR snapshots which are on single internal drive, to raided NAS which is mirrored by second raided NAS.

    FDISR has Clean SP3 snapshot Primary and secondary.
    FDISR has Archives on the mirrored NAS drives.
    When I go away I put one of the NAS drives into secure place.
    No paranoia here !! :shifty: LOL

    One way to look at this is overlapping recovery for SW and HW failure.
    Maybe slightly complex ?

    Really, we have so much digital storage now: photos, videos, legals, company docs, business db etc etc.. Absolutely must have secure back up plans in place.

    I agree, I should do auto snapshots in FDISR : get a little lazy and often turn box off.

    I had three HDs fail in rapid succession about 6 months ago: all less than 2 years old.
    My "system" coped well, but it was an eye opener.

    Office has been migrated to new HW and W7 with automated rotating disc backups. Actually, probably, in some ways not as secure as home setups.

    Current home HW is between 6-10 yrs old.
    Next issue is migrating the 4 XPSP3 boxes here at home to new HW & W7: :blink: about time eh ?.
    Then rejig the w7 to install FDISR asap. :)
    FDISR has been the most remarkable tool.
    SP and FDISR is a nice combo.

    Still have BootIT but using the imaging less now, still the best partition and multi boot manager. Use it a lot on non-work box.

    Have investigated Cloud services, but not sure how best to leverage that at work and home yet. We are a small business and cost leveraging for corporate systems is marginal at best, but, we do have a need for looong term storage of documents and recurrent access to those documents.
    Migrating to 'paperless' and automated as possible. $$$$ :eek:

    OOI: this is a Lenovo OEM box with 'recovery' partition.
    Lenovo because of business support contracts initially, and: good HW.
    I scooped out/disabled most of the Lenovo/IBM cruft that comes preinstalled, never deleted the recovery partition for some reason: suspicious of stuffing up booting and bios settings.

    SP sailed through the partition management setup with image recovery.
    SP had no problem managing the setup.
    No issues with FDISR preboot recovery using SP on the partition setup as is.

    Thanks for advices
    Regards :)
     
  6. pandlouk

    pandlouk Registered Member

    Joined:
    Jul 15, 2007
    Posts:
    2,566
    Hi Longboard,

    from your description it would seem that something got corrupted or is related with your security app or a malware.
    Have you performed a chkdsk?
    Since you also have explorer/shell problems it could be a corruption of you user account and not a problem of the OS. Creating a new user account and logging in that is an easy way to verify.
    In case of file corruptions or malware problems, updating/restoring from another snapshot does not always work since the corrupted/modified files are not replaced (e.g. https://www.wilderssecurity.com/showpost.php?p=2181243&postcount=171 ). In such cases you must delete the snapshot and recreate it.

    Panagiotis
     
  7. Longboard

    Longboard Registered Member

    Joined:
    Oct 2, 2004
    Posts:
    3,187
    Location:
    Sydney, Australia
    Thanks:
    Yes: nil specific
    Ya, Remember that. Corrupted files copy just as well as good ones !! :ouch:

    Was bit sticky there for a few hours: booting back to older snapshot and image restore has gone well so far.
    Thx
     
  8. chrome_sturmen

    chrome_sturmen Registered Member

    Joined:
    Apr 29, 2006
    Posts:
    785
    Location:
    Sverige
    better that "things be a bit sticky for a few hours" than to find yourself awake and at your desk at 4am, installing windows updates on a freshly installed OS :'(

    i didn't know that, about copying/updating from a snapshot not always working when the target snapshot is corrupted. i will keep it in mind that if i ever need to recover, i may need to create a fresh snapshot from the archive/secondary, rather than updating the existing damaged one
     
Thread Status:
Not open for further replies.