RollbackRx How to UNDELETE deleted snapshots

Discussion in 'backup, imaging & disk mgmt' started by pratzert, Aug 17, 2008.

Thread Status:
Not open for further replies.
  1. pratzert

    pratzert Registered Member

    Joined:
    Jun 25, 2008
    Posts:
    409
    Help !

    I ran Norton Virus scanner which detected severl items and automatically deleted them.

    Then... very stupdily, I deleted all of the Unlocked snapshots Rollbacl Rx had taken.

    When I rebooted I got the dreaded Microsoft stop message of: 0X0000007b (0xF789E524, 0xC000003, 0x00000000, 0x00000000).

    The only snapshots remaining were the orogianl one from a month ago and the most recent one.

    The only snapshot that recovered from the error was the orignal baseline.

    So... is there any way possible to "undelete" the snapshots I deleted to try the one prior to the vius scanner run ?

    Or am I out of luck.

    I really hate to lose all my emails and other item from the last month.

    Thanks for any help.

    Tim
     
  2. ambient_88

    ambient_88 Registered Member

    Joined:
    Jun 23, 2008
    Posts:
    854
    I don't think there's a way to restore deleted snapshots. They are not visible to Windows, so recovery programs might not be able to recover them. Someone correct me if I'm wrong.
     
    Last edited: Aug 18, 2008
  3. Peter2150

    Peter2150 Global Moderator

    Joined:
    Sep 20, 2003
    Posts:
    17,047
    I think you are indeed out of luck. You deleted the table pointing to the sectors that had the data.

    Pete
     
  4. pratzert

    pratzert Registered Member

    Joined:
    Jun 25, 2008
    Posts:
    409
    Thanks for the responses.

    I was hoping that "maybe" Rollback had some sort of hidden utility to get those deleted snapshots back.

    But I'm sure if there was such a thing, it would be known to someone here.

    I guess I'll just have to accept the consequences of my stupidity as well as accepting the fact that I've lost a month of data and emails.

    Tim
     
  5. EASTER

    EASTER Registered Member

    Joined:
    Jul 28, 2007
    Posts:
    5,633
    Location:
    U.S.A. (South)
    As a staunch diehard FD-ISR loyal, it still seems to me (maybe not?) a prudent process would be (if possible) to store those Rx images or at the very least LOCK them from being deleted.

    I have had some experience with RollBack before, (not good ones at all) but surely they do have some safeguards built into it to prevent the next time this happening to you again and losing valuable data.

    EASTER
     
  6. fce

    fce Registered Member

    Joined:
    May 20, 2007
    Posts:
    758
    no way you can recover deleted SNAPSHOT....next time protect your snapshot by clicking Lock the snasphot (see attached) whenever you created new snasphot.
     

    Attached Files:

  7. rwatts

    rwatts Registered Member

    Joined:
    Aug 17, 2008
    Posts:
    5
    Just because the current snapshot won't boot doesn't necessarily mean that you can't get at the data. You may well be able to explore the corrupt snapshot while booted into the baseline and recover the files you need (hopefully:) ).

    Robert
     
  8. pratzert

    pratzert Registered Member

    Joined:
    Jun 25, 2008
    Posts:
    409
    My problems is that the only snapshot that will boot is the original baseline snapshot done at installation.

    With the only other one remaining, which was th eone done when I re-booted, it gives me the Microsoft "Stop" error.

    Now... I wonder if I can somehow repair or correct that error and get it to boot up properly. Probelm is.... there are many things that can cause that stop error.

    FYI, the actual complete "stop" reference was:

    stop: 0x0000007b (0xF789E524, 0xC0000034, 0x00000000, 0x00000000)

    I "think" that the anti-virus deleted something I need for the hard drive to boot up properly. Once again, stupidly, I did not pay close attention to what it deleted as it did it automatically. Perhaps it had something to do with the hidden sectors of Rollback, or something else. It's not a hardware failure as I can boot up every time when I Rollback to the original snapshot.

    I wonder if I can do some sort of Windows Repair from my WinXP installation disk to re-install whatever is missing ?

    And how do I "explore" the corrupt snapshot to look for the files ?

    Thanks again to eveyrone for your help.

    I can assure you I have learned a lesson and will NOT delete snapshots en-masse again. I did it because it got so frustrating waiting for all of the snapshots to defrag everytime I boot up.

    Tim
     
  9. rwatts

    rwatts Registered Member

    Joined:
    Aug 17, 2008
    Posts:
    5
    Select the "Recover Files" option in the Rollback main menu. Then select the last option on the page ('I want to explore a snapshot as virtual drives and select files to recover').

    Select the snapshot which won't boot and see if it can mount it so that you can explore it. It may be too corrupted for this to work but it's worth trying :)

    Robert
     
  10. pratzert

    pratzert Registered Member

    Joined:
    Jun 25, 2008
    Posts:
    409
    Thanks... I'll try it tonight when I get home. I'm not sure that the snapshot was corrupt, or my system..... Hopefully I can at least get the files.

    Regards, Tim
     
    Last edited: Aug 18, 2008
  11. starfish_001

    starfish_001 Registered Member

    Joined:
    Jan 31, 2005
    Posts:
    1,041

    Indeed.


    Image the drive sector for sector and then try http://support.microsoft.com/kb/324103

    or Knoppix to recover the files
     
  12. Peter2150

    Peter2150 Global Moderator

    Joined:
    Sep 20, 2003
    Posts:
    17,047
    Those tools probably won't help, as they were never in the windows file system. The sectors were only identified by Rollback's file table, and if that is gone, it's probably game over.
     
  13. EASTER

    EASTER Registered Member

    Joined:
    Jul 28, 2007
    Posts:
    5,633
    Location:
    U.S.A. (South)
    Unfortunate indeed. RollbackRx when it deletes it's snapshots works in similiar fashion as if you had manually used ERASER by Heidi and that's all she wrote, unless you're using DeepFreeze.

    Again, the key with Rx like already mentioned is when you make snapshots you want kept, by all means use it's "LOCK" feature that prevents the locked snapshots from deletion untill you change it.

    Other then that, sorry you had a bad experience with Rx in this fashion. It uses a totally different method in it's workings and IMO is not the user-friendliest ISR i ever had experience with myself.

    Still you might try all advices offered, but i doubt if even TESTDISK could restore your prized possessions but at least anything is worth a try. I've seen totally eliminated entire partitions deleted and vanished and TESTDISK found them and re-wrote them back to disk. But the way Rx works i couldn't say with any certainty at all if it could do anything about it or not.

    EASTER
     
  14. pratzert

    pratzert Registered Member

    Joined:
    Jun 25, 2008
    Posts:
    409
    Hmmmm.. TestDisk ? Where might I find it ?

    I have toyed around on my other system that has Rollback Rx installed on it, and was able to find the Outlook Express .DBX files through the virtual drive.

    It even looks like I can restore them from the snapshot too. But I have not looked at my trashed system yet to see if they were somehow on that very last snapshot or not. I knwo the last snapshot is the one that will have the probel which casued the Microsoft stop error, but if the files are there, I have some hope of recovering them.

    I am mostly concerned about any lost emails from my July 20th installation of Rollback.

    There were a few programs which I downloaded too AND installed, but if I can recover the downloded installation program files, I can re-install them.

    I am going to try fooling around with it tonight if It's not too late when I get home.

    Ideally, I should use the "Import/Export" feature to move the Outlook Express dbx files around, but Roolback seems to allow me to "recover" the files. If the dbx files are there, I will "recover" them all at once.

    Thanks again to everyone for their help.

    Tim
     
  15. EASTER

    EASTER Registered Member

    Joined:
    Jul 28, 2007
    Posts:
    5,633
    Location:
    U.S.A. (South)
    Latest release of TESTDISK also linked is a Live CD you might try. I say try because if it did happen to surprisingly ressurrect what's been lost/deleted, by all means report back to us with that news. But i no nothing solid on Rx's method it uses to delete, and it may even p00fed it like these virtual systems after a reboot. Others more familiar with it can state your odds on any possible recovery, but this TESTDISK renewed and restored an entire deleted partition of mine and wrote it back again so it showed up finally under My Computer and 99% of it's files were completely workable as before and intact. Only a scant few were distorted beyond repair but at least i could re-download them again from the net. The partition was deleted by a virus i was researching and it totally vanished from view and all my emergency CD's including ERD Commander except one, PARTEDMAGIC CD w/ TESTDISK on it. You can Google for Parted Magic also, i believe they still are developing it and it always had TESTDISK on it like a Bart PE. That CD saved the day for me.

    You're dealing with a completely different application though so i can't be sure at this point if it will be of any use, but can't hurt to try, thats what i did right before i was ready to re-format, was at my wits end untill TESTDISK both "found" and "restored" the deleted partition that went AWOL for while.

    http://www.cgsecurity.org/wiki/TestDisk_Download

    EASTER
     
  16. pratzert

    pratzert Registered Member

    Joined:
    Jun 25, 2008
    Posts:
    409
    Do you think I can try a "Repair" Install of Win XP Pro ?

    Would that overwrite or destroy the hidden area where Rollback hides along with it's snapshots ?

    Maybe a repair would fix whatever happened.

    Tim
     
  17. Peter2150

    Peter2150 Global Moderator

    Joined:
    Sep 20, 2003
    Posts:
    17,047
    Hi Pratzert

    You have to understand how Rollback works. It doesn't hide stuff anywhere. When you create a snapshot of your system all you've done is create a sector table. Then as windows writes a file, it is passed to Rollback via a driver and the sectors are written to the disk. The location and what they belong to are stored in that table. If you boot to another snapshot, windows knows nothing about those files/sectors. When you delete a snapshot, all you are doing is deleting the table. But all reference to the files in that snapshot are gone.

    I doubt seriously if any windows utility would be able to see anything, as windows itself didn't see them. And no a repair install will do nothing to help.

    If the corrupt snapshot, is corrupt in the sense files were damaged, but the Rollback table is intact you might recover some data from that snapshot, but i think the deleted ones are gone.

    Pete
     
  18. pratzert

    pratzert Registered Member

    Joined:
    Jun 25, 2008
    Posts:
    409
    Easter,

    Thanks for the link..

    This evening I was able to use the "Restore Files" feature on Rollback Rx and I DID recover my emails and the zipped program files I had downloaded and a few music files too.

    So I am pretty much good again. But I am very curious to know exactly what happened, because it happened to my work computer yesterday.

    But I had already learned a lesson and did not delete any snapshots and it was a very simple matter to rollback to one of the most recent snapshots before my system took a hike.

    It was the same scenerio... I ran a virus scan with the Symnatec Client Virus program and I think it deleted something that I needed. But I have no freakin' idea what it deleted so I can't prevent it from happening again.

    And it's an automatic deletion on the part of the anti-virus program. Sometimes it gives an optino to delete something or not, but then other items it just goes ahead and deletes it.

    I'm still curious to know if a Windows repair install would fix it.

    Thanks, Tim
     
  19. pratzert

    pratzert Registered Member

    Joined:
    Jun 25, 2008
    Posts:
    409
    Hi Pete,

    Thanks for the insight on how Rollback stores the snapshot info. I understand more fully how fragile these things are now.

    Thank goodness I was able to retrieve/restore my emails and other files. I'm sure I lost something but I don't think it was anything critical.

    As I said earlier... I'll take this as a lesson learned about deleting snapshots.

    I have Rollback set to take snapshots hourly as well as at bootup. I think I will lock one of those at the end of each day for safety.

    Thanks to all for your help and wisdom.

    Tim
     
Loading...
Thread Status:
Not open for further replies.