Introducing AX64 Time Machine - hybrid imaging/snapshot software

I have a dumb question. This for those of you who have made the jump from FD-ISR to this new and promising program.

Thanks to Panagiotis (Pandlouk) I was able, as were many others, to continue to use FD-ISR on Win7 even though the program died and was no longer supported. Panagiotis provided us all with a hack that replaced the Win7 boot sector with the Vista boot sector (someone correct me if that is not quite right).

After 12 years FD-ISR is starting to act kind of funky. Recovery still works but creating new Archives has me jumping thru hoops. My dump question: for those of you who used the hack to replace the boot sector, after you made the jump to AX64 does everything work OK? Does having the Vista boot sector on Win7 make no difference with AX64.

Thanks a bunch,
Acadia

 

Hi Acadia

I do not use FD-ISR but I can advise that AXTM does not touch or depend on the Boot sector as far as I know.

 

Just insert a windows 7 dvd and run from the command prompt (as admin):
X:\boot\bootsect.exe /nt60 SYS

X= the drive letter of your dvd drive

Panagiotis

 

when i was using comodo time machine, i like tree view screen.
It is usefull and clean for user. Maybe Dev's can add same ability to ax64

 

That option is planned I believe.

 

Does the AXTM installer allow for silent installs where you can specify the install directory?

I'd be interested in the installer switches that can be used for an unattended install.

Al

 

I've been encounter very strange problem, and hard to say if it is connected with AX64, but even if it isn't, perhaps someone could enlighten me what to do with it.
Today morning I recovered a snapshot (made yesterday), and when Windows was starting there was an information that Explorter.exe doesn't response... so I wait for a while, but nothing changed. Tried to restart it, find solution online, but it didn't work. Tried to restore another snapshot (made 2 days age), and even another one made few days ago - nothing changed. What is the strangest, I do remember, that this one made few days ago worked very well when I had recovered it just after I made it... but not today - I get Explorer doesn't response over and over again.

Any suggestion what can it be?

 

Isso,
It is not clear to me which updates require a new CD to be burned. Could you mention if this is necessary in the update notes on your website (for all new updates)?
This would be very helpful.

 

Tip of the Day keeps popping up when opening the browser. I can't turn it off by unchecking 'Show tips on Startup'. AXTM keeps turning it on or never turns it off even though the check-mark disappears after unselecting it and closing the tip window. Anyone else see this?

Edit:
Nevermind, the browser has unstuck itself. Seems to be keeping quiet for now.

Al from the check-box

 

After successfully restoring a snapshot and AXTM rebooting the system, I see the following entry in my Win7 eventlog:

Code:

Log Name:      System
Source:        Microsoft-Windows-Kernel-Power
Date:          7/15/2013 14:27:36
Event ID:      41
Task Category: (63)
Level:         Critical
Keywords:      (2)
User:          SYSTEM
Computer:      2082-52G
Description:
The system has rebooted without cleanly shutting down first. This error could be caused if the system stopped responding, crashed, or lost power unexpectedly.

Seems like this is a problem caused by AXTM.

Al

 

Actually, now that you mention it Tip of the Day hasn't appeared since I upgraded to the latest version. That's OK though.

 

Does this apply to Windows 8 also?

 

Hi MB

A new feature suggestion has been over at www.ax64.com for a warning to be provided via the GUI after a new version has been installed. YOu may want to mosy on over and add a vote to that feature request.

 

Hi Adric

I can confirm that this does occur on my system too. I did a test restore this afternoon and get the same Event Log entry. However, it is not surprising that Windows reports this as this if effectively what AXTM does. I believe that RB Rx caused the same 'issue' when a restore was undertaken (at least to the best of my recollection) but to be honest I am fairly certain that whilst it is flagged as 'critical' it does not impact Windows' integrity.

But perhaps the more knowledgeable brethren could comment?

 

has this been tested yet against the usual nasties like TDL4, Sinowal etc?? I would really like to see a test against sophisticated malware because so far only Sandboxie managed to defeat them all.

 

Hi Baldrick and Adric

Indeed, the event viewer report is normal. I also had noticed this event in the early Alpha stage testing of AX64TM.

The reason is that AX64TM performs a hard reset to prevent Windows from re-writing to the disk that was just restored from within windows. Isso and team may change this behavior at some point, but it is harmless and windows is just reporting the shut down event due to a hard reset.

Sometimes a similar message may be reported when one performs a drive image from within windows or a "hot" image from most disk imaging programs, and upon restore of that image, windows may show a critical event stating windows was "improperly shutdown", which it sees this because it was a hot image and technically, there is no record of a normal shutdown when that hot image is restored, because it was created from within a running Windows OS as opposed to a "cold" image outside the operating system, although it too is harmless.

So in the case of AX64TM, the message is proper but harmless due to how the reset is handled to avoid allowing windows to write to the restored disk.

Hope that helps!

Jim

 

Hi Acadia,

As Baldrick mentioned AX64 doesn't make any modifications to the MBR, and it doesn't depend on the MBR, so it makes no difference.

Isso

 

Yes, twl845 is right - this option is planned.

Isso

 

Sorry, there is no such option yet, I'll add it to the list.

Isso

 

artoor,

I replied via PM

Isso

 

Arcanez,

I did a test with TDL4. After installing TDL4 it broke something in the file system, so AX64 didn't see the drives to restore, that's why online restore wasn't possible. However offline restore completely eliminated the rootkit (which is quite expected, because no malware can survive restoring an image).

Isso

 

Hi Jim,

Thank you very much for your perfect answer!

Isso

 

Hi Jim

It does indeed...many thanks.

Balders

 

Arcanez, I have tested this against variants of some of the worst rootkits, and as long as Windows is left functional following the rootkit installation, both Windows-based restores and RECOVERY MEDIA restores have eliminated the active components of the rootkit. This is only insured when using the ADVANCED option of MBR restore in AX64 TM. This way the MBR and PBR (Volume Boot Record) are completely restored from the backup. One of the more advanced rootkits installs a hidden partition on your hard disk and runs its nasties from there. AX64 TM does not eliminate that partition but does eliminate the mechanisms that utilize that hidden partition... it's basically left abandoned.