RollbackRx How to UNDELETE deleted snapshots

Help !

I ran Norton Virus scanner which detected severl items and automatically deleted them.

Then... very stupdily, I deleted all of the Unlocked snapshots Rollbacl Rx had taken.

When I rebooted I got the dreaded Microsoft stop message of: 0X0000007b (0xF789E524, 0xC000003, 0x00000000, 0x00000000).

The only snapshots remaining were the orogianl one from a month ago and the most recent one.

The only snapshot that recovered from the error was the orignal baseline.

So... is there any way possible to "undelete" the snapshots I deleted to try the one prior to the vius scanner run ?

Or am I out of luck.

I really hate to lose all my emails and other item from the last month.

Thanks for any help.

Tim

 

I don't think there's a way to restore deleted snapshots. They are not visible to Windows, so recovery programs might not be able to recover them. Someone correct me if I'm wrong.

 

Thanks for the responses.

I was hoping that "maybe" Rollback had some sort of hidden utility to get those deleted snapshots back.

But I'm sure if there was such a thing, it would be known to someone here.

I guess I'll just have to accept the consequences of my stupidity as well as accepting the fact that I've lost a month of data and emails.

Tim

 

As a staunch diehard FD-ISR loyal, it still seems to me (maybe not?) a prudent process would be (if possible) to store those Rx images or at the very least LOCK them from being deleted.

I have had some experience with RollBack before, (not good ones at all) but surely they do have some safeguards built into it to prevent the next time this happening to you again and losing valuable data.

EASTER

 

no way you can recover deleted SNAPSHOT....next time protect your snapshot by clicking Lock the snasphot (see attached) whenever you created new snasphot.

 

Just because the current snapshot won't boot doesn't necessarily mean that you can't get at the data. You may well be able to explore the corrupt snapshot while booted into the baseline and recover the files you need (hopefully ).

Robert

 

My problems is that the only snapshot that will boot is the original baseline snapshot done at installation.

With the only other one remaining, which was th eone done when I re-booted, it gives me the Microsoft "Stop" error.

Now... I wonder if I can somehow repair or correct that error and get it to boot up properly. Probelm is.... there are many things that can cause that stop error.

FYI, the actual complete "stop" reference was:

stop: 0x0000007b (0xF789E524, 0xC0000034, 0x00000000, 0x00000000)

I "think" that the anti-virus deleted something I need for the hard drive to boot up properly. Once again, stupidly, I did not pay close attention to what it deleted as it did it automatically. Perhaps it had something to do with the hidden sectors of Rollback, or something else. It's not a hardware failure as I can boot up every time when I Rollback to the original snapshot.

I wonder if I can do some sort of Windows Repair from my WinXP installation disk to re-install whatever is missing ?

And how do I "explore" the corrupt snapshot to look for the files ?

Thanks again to eveyrone for your help.

I can assure you I have learned a lesson and will NOT delete snapshots en-masse again. I did it because it got so frustrating waiting for all of the snapshots to defrag everytime I boot up.

Tim

 

Select the "Recover Files" option in the Rollback main menu. Then select the last option on the page ('I want to explore a snapshot as virtual drives and select files to recover').

Select the snapshot which won't boot and see if it can mount it so that you can explore it. It may be too corrupted for this to work but it's worth trying

Robert

 

Thanks... I'll try it tonight when I get home. I'm not sure that the snapshot was corrupt, or my system..... Hopefully I can at least get the files.

Regards, Tim

 

Indeed.


Image the drive sector for sector and then try http://support.microsoft.com/kb/324103

or Knoppix to recover the files

 

Unfortunate indeed. RollbackRx when it deletes it's snapshots works in similiar fashion as if you had manually used ERASER by Heidi and that's all she wrote, unless you're using DeepFreeze.

Again, the key with Rx like already mentioned is when you make snapshots you want kept, by all means use it's "LOCK" feature that prevents the locked snapshots from deletion untill you change it.

Other then that, sorry you had a bad experience with Rx in this fashion. It uses a totally different method in it's workings and IMO is not the user-friendliest ISR i ever had experience with myself.

Still you might try all advices offered, but i doubt if even TESTDISK could restore your prized possessions but at least anything is worth a try. I've seen totally eliminated entire partitions deleted and vanished and TESTDISK found them and re-wrote them back to disk. But the way Rx works i couldn't say with any certainty at all if it could do anything about it or not.

EASTER

 

Hmmmm.. TestDisk ? Where might I find it ?

I have toyed around on my other system that has Rollback Rx installed on it, and was able to find the Outlook Express .DBX files through the virtual drive.

It even looks like I can restore them from the snapshot too. But I have not looked at my trashed system yet to see if they were somehow on that very last snapshot or not. I knwo the last snapshot is the one that will have the probel which casued the Microsoft stop error, but if the files are there, I have some hope of recovering them.

I am mostly concerned about any lost emails from my July 20th installation of Rollback.

There were a few programs which I downloaded too AND installed, but if I can recover the downloded installation program files, I can re-install them.

I am going to try fooling around with it tonight if It's not too late when I get home.

Ideally, I should use the "Import/Export" feature to move the Outlook Express dbx files around, but Roolback seems to allow me to "recover" the files. If the dbx files are there, I will "recover" them all at once.

Thanks again to everyone for their help.

Tim

 

Latest release of TESTDISK also linked is a Live CD you might try. I say try because if it did happen to surprisingly ressurrect what's been lost/deleted, by all means report back to us with that news. But i no nothing solid on Rx's method it uses to delete, and it may even p00fed it like these virtual systems after a reboot. Others more familiar with it can state your odds on any possible recovery, but this TESTDISK renewed and restored an entire deleted partition of mine and wrote it back again so it showed up finally under My Computer and 99% of it's files were completely workable as before and intact. Only a scant few were distorted beyond repair but at least i could re-download them again from the net. The partition was deleted by a virus i was researching and it totally vanished from view and all my emergency CD's including ERD Commander except one, PARTEDMAGIC CD w/ TESTDISK on it. You can Google for Parted Magic also, i believe they still are developing it and it always had TESTDISK on it like a Bart PE. That CD saved the day for me.

You're dealing with a completely different application though so i can't be sure at this point if it will be of any use, but can't hurt to try, thats what i did right before i was ready to re-format, was at my wits end untill TESTDISK both "found" and "restored" the deleted partition that went AWOL for while.

http://www.cgsecurity.org/wiki/TestDisk_Download

EASTER

 

Do you think I can try a "Repair" Install of Win XP Pro ?

Would that overwrite or destroy the hidden area where Rollback hides along with it's snapshots ?

Maybe a repair would fix whatever happened.

Tim

 

Easter,

Thanks for the link..

This evening I was able to use the "Restore Files" feature on Rollback Rx and I DID recover my emails and the zipped program files I had downloaded and a few music files too.

So I am pretty much good again. But I am very curious to know exactly what happened, because it happened to my work computer yesterday.

But I had already learned a lesson and did not delete any snapshots and it was a very simple matter to rollback to one of the most recent snapshots before my system took a hike.

It was the same scenerio... I ran a virus scan with the Symnatec Client Virus program and I think it deleted something that I needed. But I have no freakin' idea what it deleted so I can't prevent it from happening again.

And it's an automatic deletion on the part of the anti-virus program. Sometimes it gives an optino to delete something or not, but then other items it just goes ahead and deletes it.

I'm still curious to know if a Windows repair install would fix it.

Thanks, Tim

 

Hi Pete,

Thanks for the insight on how Rollback stores the snapshot info. I understand more fully how fragile these things are now.

Thank goodness I was able to retrieve/restore my emails and other files. I'm sure I lost something but I don't think it was anything critical.

As I said earlier... I'll take this as a lesson learned about deleting snapshots.

I have Rollback set to take snapshots hourly as well as at bootup. I think I will lock one of those at the end of each day for safety.

Thanks to all for your help and wisdom.

Tim