Introducing AX64 Time Machine - hybrid imaging/snapshot software

Thank you carfal, indeed it took forever to be released!
And thanks for pointing out the problem - will fix it in the upcoming update.

Isso

 

Thank you very much Fad!

PCFAN, Musashi, thank you!

Isso

 

Thank you mike, and sorry about GPT. We'll release a version that supports it in 4-8 weeks. Stay tuned (facebook, twitter available on our main page)

Isso

 

HermitGeek,

TheRollbackFrog already gave an excellent reply. I'll just mention that AX64 TM is internally a backup/imaging program (just like Acronis, Macrium, and others), it's just very heavily optimized for speed and it's operation looks like a snapshot program.

That's why (as for any other backup program) you'll need a storage of at least the same size as the total data size on your main drive, or better twice of it. This is of course not as convenient as RollbackRX, but it's very important, because you will actually have a backup of your data in case your disk fails, or MBR is corrupted, etc. Hope this makes sense.

Isso

 

Cruise,

AXTM only backs up the first sector. Restoring that only sector to initial factory condition makes any virus hiding in other sectors harmless, because in order for them to be invoked, one needs to modify the sector 0.

Isso

 

Marc,

I got another report for it too, sorry about it. Could you let me know if by any chance the Backup Browser was open at the same time? I suspect it may interfere with merging process. Thank you

Isso

 

Just noticed your reply, thank you very much indeed for your help Froggie!

Isso

 

Time to create a separate forum, this thread is becoming really overwhelming...

 

Isso, the backup browser wasn't opened. However, I'm about to put it on a mystery that happened about the time of that failure, but I don't have much to work with. At the same time merging failed, the Windows event viewer also shows the WRSVC service failing and being restarted (that's the Webroot SecureAnywhere service). Not sure what happened, but everyone recovered nicely. WRSVC was restarted and AXTM completed the merge on the next round. No more failures two hours later.

 

That is missing the point. There are many reasons that work has not been backed up yet. Windows could crash;
your power supply could die; your UPS could die and take your system down; it's late, you are tired, and forgot to do a backup; ...
With other backup software you can still boot into a recovery mode and take a snapshot and recover your work that has not been backed up yet.
With AXTM right now you cannot.

Bob

 

Hey guys, LBA 1 - 62 makes a very good hiding place, so while restoring a clean Windows MBR may disable the malware from the restored system-state, I can see where the latent malware would be able to revive itself via a covert trigger! Imho it's best to backup the entire track 0 and then offer options to restore the MBR (LBA 0), the entire 1st track, or neither.

TS

 

Sorry if I missed the point you were making, but I'm afraid I'm still missing it (maybe because I didn't sleep very well last night)!

 

Hi Bob,

Frankly I don't quite understand it either, sorry. So, for example your UPS failed and the system turned off, so you lost your files. How can other software help you to recover it, even if you make a backup of that failed system state?

Do I understand it right that your point is that you can browse your failed file system and recover files from within recovery media? Thank you

Isso

 

Isso,
Sorry for the confusion. The point of my original post https://www.wilderssecurity.com/showpost.php?p=2227208&postcount=1513
is that with other imaging products we can still make a snapshot of the system from within the recovery mode,
and save our work, and I don't see a way to do that with AXTM.

Lets say I've been working for an hour (day?) since my last backup and shutdown my PC without doing a backup.
All my work is saved on the hard drive, but not backed up. The next day I turn on the PC and find that Windows won't boot.
With RollBackRX-type software I can quickly take a snapshot from the pre-boot env, then do a restore
to a previous working snapshot, and be able to mount the last snapshot and save all my work.
With Macrium Reflect or TodoBackup I can boot from the recovery CD/USB and take a snapshot, then do a restore
to a previous working snapshot, and be able to mount the last snapshot and save all my work.

The Shadow seemed to suggest doing a manual backup before shutting down, and that lead to the side discussion of
ways your system could crash before you could do a backup. But in any case, some of my work would be intact on the disk.
With other image products I can make a snapshot from within recovery mode, then do a restore to a previous working snapshot,
and be able to mount the last snapshot to save my work.
And I don't see how I can do that with AXTM.

 

Hello,

What is the proper procedure if you ever want or need to reset your baseline short of doing a fresh install? From my testing it appears that you cannot delete or merge the current baseline or snapshot, only the snapshots in between these... So, Is there a procedure to follow to reset the baseline to current or start fresh? If I renamed the AXTM folder, would that be detected by AX64 and then a new baseline automatically created?

I usually like to start a new baseline once the monthly Windows Updates are done and then the system is defragged. In this case, for example, could I put all the files in the AXTM folder into a new folder named "April-2013" for instance, and then AX64 would automatically start the new baseline when the next hourly backup was scheduled?

Also, for those that may use several different rescue media and/or boot media programs (for back-ups or anti-virus or rescue/troubleshooting software), YUMI works great for this. I installed the AXTM ISO on my multi-boot YUMI USB pendrive, and did a restore and it went flawlessly. YUMI is a great tool for managing all your multi-boots etc. onto a single pendrive. It also give you the option of being able to boot into a live Linux system from the pendrive also.

And, as always, great work Isso and the AXTM team!!!

P.S. Isso, thanks for the PM, you went above and beyond - even when it was not necessary, as it seems you and your team always does!!!

 

Bob,

Now it's absolutely clear, thank you for explaining! Interesting scenario, I didn't think about it. I'll have this feature (implementing backups from Recovery Environment) in mind. Many users asked for it already, so I think we need to add it. Thank you

Isso

 

Hi Kent,

If you want to start a new "baseline" - yes, the easiest is to rename the AXTM folder, and the program will create new full backup. If you need to restore backups from that renamed folder just open Backup Browser and use "Open Other Backups" button.

I agree YUMI seems to be a very nice tool. Thank you!

Isso

 

Hi rjbu,

to be able to recover unsaved data from your non-booting HDD it is not necessary that the AXTM recovery CD or USB stick allows you to make a snapshot of this damaged non-bootable HDD.

All you need is a live CD with a file manager. This could be a live Linux, BartPE or WinPE based CD (I still use the old UBCD4Win CD). Boot from the CD while you have an external HDD conected, copy the new or altered files or folders to the external drive, then boot from the AXTM recovery media and restore to the latest snapshot. After the restore you can easily salvage the data from the external drive.

This method is just as easy, and IMO everyone needs a CD with a live operation system in his toolbox...


Cheers
manolito

 

Hi again Bob,

Now I see I completely misconstrued the issue. I had interpreted your problem to be due to AXTM rolling-up its hourly (incremental) snapshots into the baseline backup, so I suggested manual backups to avoid those roll-ups.

Just as a 'sanity check', am I to now understand that the AXTM recovery media does not allow you to make a backup, or is the issue that the recovery media doesn't allow you to mount that snapshot? Because the recovery media does not support my system configuration (Intel RST), it's unable to boot my system and therefore I'm unaware of any such limitations!

TS

 

Hi manolito,

Thank you, you are absolutely right, however Bobs point is also valid, because not all of the users have live CDs, and it would be nice for them to be able to solve this problem without requiring additional tools. In fact, if AXTM recovery media provided some type of file manager - that would IMHO be even a better solution (compared to taking backup and later mounting it). Bob, folks, what do you think?

Isso

 

The Shadow,

I see your point, thank you. However the only way that malware can revive is by modifying the MBR. And to modify MBR it must be already started and active! And if it's active then it doesn't really matter if you erase the content of track 0 or not.
I can add that feature, I just don't really see a point in it, sorry.


Isso

 

To solve this could be much easier and faster than implementing backups from the Recovery Environment. These backups would have to be full backups, right? Takes a lot of time, while Bob only needs to salvage some files or folders which have changed since the last backup.

Wouldn't it me much easier to add Explorer.exe to the recovery media? Maybe make it accessible directly from the Backup Browser (just like cmd.exe).


Cheers
manolito


//Edit//
Hi Isso, we were just posting in parallel. And it looks we are thinking along the same line...

Cheers

 

I also think it's a preferred method. For backups - yes, they would need to be full and would take a lot of time. So directly accessing the files and copying them seems to be a good alternative.
Adding Explorer is a pain - we already tried it. Maybe we can create some simple file manager instead.

I welcome anyone's opinion on this issue.

Isso

EDIT: manolito, great timing!

 

There are plenty of free rescue disks out there that allow you to explore the file system from a bootable CD/thumbdrive.

 

Yes indeed. Got a same return result from the new laptop sporting GPT. Said to be a norm now on some newer machines. No worry. Looking forward to that compatibility as soon as its ready.

Fantastic program with rapid reflexes.

Congratulations on a fine debut release Isso. Very informative reading here and excellent idea! exchanges.

Regards Easter