[SOLVED] WIN7 not creating system restore points manually or automatically

[Jed]

Decided to run chkdsk over both the laptop & external backup HDD in response to above system image (only) backup error (0x80780020).
Results are attached & do not suggest to me that they are contributing to my restore points creation/system image backup problems.

Any suggestion-comment on the backup error code 0x80780020 and associated error message attached ie "Windows Backup cannot find the shadow copy of the source volume".

 

[xilolee]

Did you try the clean boot?

 

[Jed]

Yes tried creating a restore point & backing up only the system image in clean boot - made no difference - restore point creation & backup error remain as per my first posting.

Any suggestion-comment on the backup error code 0x80780020 and associated error message attached ie "Windows Backup cannot find the shadow copy of the source volume" ?

How can I check (ie a log or perhaps a hidden folder) if there are shadow copies being created (backup view progress screen says a shadow copy was created before crashing) ?

Thanks for your assistance in this mystery (& complicated) problem/s

 

[Jed]

Update on my forensics attempt.

Tried this tool System Restore Explorer | Nic's Blog to see if there are shadow copies of the source volume being created (backup view progress screen says a shadow copy was created during system image only backup before crashing)


SystemRestoreExplorer could not find any restore points so I cannot mount anything to explore - sigh

I have now run out of forensic ideas to try to zero in on the no restore points (manual or auto) problem.

I still get successful restore point creation messages but none seen on the system restore points list.

 

[Jed]

Hi All

I would really appreciate some more suggestions about this issue as I cannot backup my data as well as not having any restore points.

Regards
Jed

 

[xilolee]

What antivirus/antispyware/antimalware are you using?

 

[Jed]

What antivirus/antispyware/antimalware are you using?

Trend Micro Titanium Internet Security.
Note my other Toshiba laptop which has an identical software environment does not have a problem with restore points or backups.

 

[xilolee]

You can uninstall it completely, activate Windows defender and see if the problem solves itself.
If yes, you can always re-install Trend Micro Titanium I.S., can't you?

 

[Jed]

What evidence is there that my anti virus is the problem given the results of the clean boot?

I am not convinced that my anti virus is the problem - for various reasons I am unable to uninstall/re-install Trend Micro Titanium IS.
Note my other Toshiba laptop which has an identical software environment does not have a problem with restore points or backups.

I have not had a reply to my question - How can I check (ie a log or perhaps a hidden folder) if there are shadow copies being created (backup view progress screen says a shadow copy was created before crashing) ?

 

[xilolee]

There's no evidence, but often the culprit is AV software.
You can check your partitions through diskpart; example:

Read More:

C:\>diskpart
Microsoft DiskPart version 6.3.9600
Copyright (C) 1999-2013 Microsoft Corporation.
On computer: XILOLEE
DISKPART> select disk 0
Disk 0 is now the selected disk.
DISKPART> list partition
  Partition ###  Type              Size     Offset
  -------------  ----------------  -------  -------
  Partition 1    Recovery           400 MB  1024 KB
  Partition 2    System             300 MB   401 MB
  Partition 3    Reserved           128 MB   701 MB
  Partition 4    Primary            224 GB   829 MB
  Partition 5    Primary            224 GB   224 GB
  Partition 6    Recovery            16 GB   449 GB
DISKPART> list volume
  Volume ###  Ltr  Label        Fs     Type        Size     Status     Info
  ----------  ---  -----------  -----  ----------  -------  ---------  --------
  Volume 0     F                       DVD-ROM         0 B  No Media
  Volume 1     C   Packard Bel  NTFS   Partition    224 GB  Healthy    Boot
  Volume 2     D   DATA         NTFS   Partition    224 GB  Healthy
  Volume 3         RECOVERY     NTFS   Partition    400 MB  Healthy    Hidden
  Volume 4         ESP          FAT32  Partition    300 MB  Healthy    System
  Volume 5         Push Button  NTFS   Partition     16 GB  Healthy    Hidden
DISKPART> exit
Leaving DiskPart...
C:\>

Other diskpart commands can be dangerous, hence be careful and ask before doing anything.

 

[Jed]

Without evidence but mainly due to for various reasons I am unable to uninstall/re-install Trend Micro Titanium IS so I cannot explore this option.

My diskpart log is attached - looks OK to me as status is healthy.
Was there anything in particular that diskpart would/should show that might provide evidence of the source of my zero restore points & unable to do a backup problems?

I would like to check the existence of any shadow copies being created/stored.

How can I check (ie a log or perhaps a hidden folder) if there are shadow copies being created (backup view progress screen says a shadow copy was created before crashing) ?

I am not familiar with the backup process in Win7 (& MS components involved) to know where to look.

 

[Jed]

Oops I forgot to attach this successful restore point creation message but missing on the restore points list ??

Where would restore points be stored after creation?
How can you check other than via restore?

 

[Go The Power]

Hello Jed,

Lets see what we can find out :)

Command query

1. Click on the
   
   button. Inside the search box type in CMD
2. Right click on CMD => Choose Run as Administrator
3. Inside the Command Prompt windows copy and paste the following commands
   vssadmin list writers >r&& sc qc vss >>r&& sc queryex vss >>r &&notepad r
4. Once finished a note pad file called R will open Please post the contents back into this thread.

Event Log Viewer

1. Please download VEW.exe from Here and save it to your desktop.
2. Go to your desktop and right click on VEW.exe and choose Run as Administrator
3. Once open set the following settings
   • 'Select log to query'
     1. Tick Application
     2. Tick System
   • 'Select Type to list'
     1. Tick Critical
     2. Tick Error
     3. Tick Information
     4. Tick Warning
   • 'Number or date events'
     1. Tick Number of Events and set it to 20
4. Click on Run
5. Once completed a notepad file will open. Please copy and paste the contents of VEW.txt back into this thread.

 

[Jed]

Hello Jed,

Lets see what we can find out :)

Command query

1. Click on the
   
   button. Inside the search box type in CMD
2. Right click on CMD => Choose Run as Administrator
3. Inside the Command Prompt windows copy and paste the following commands
   vssadmin list writers >r&& sc qc vss >>r&& sc queryex vss >>r &&notepad r
4. Once finished a note pad file called R will open Please post the contents back into this thread.

Event Log Viewer

1. Please download VEW.exe from Here and save it to your desktop.
2. Go to your desktop and right click on VEW.exe and choose Run as Administrator
3. Once open set the following settings
   • 'Select log to query'
     1. Tick Application
     2. Tick System
   • 'Select Type to list'
     1. Tick Critical
     2. Tick Error
     3. Tick Information
     4. Tick Warning
   • 'Number or date events'
     1. Tick Number of Events and set it to 20
4. Click on Run
5. Once completed a notepad file will open. Please copy and paste the contents of VEW.txt back into this thread.

Hi Alex

r.txt & vew.txt attached as per above

 

[Go The Power]

Hi Jed,

Is this a business computer? There seems to be a call for KMS activation in the event log.

1. Download MGADiag (by Microsoft) from the link found below:
   http://go.microsoft.com/fwlink/?linkid=52012
2. Run the tool by double-clicking on the file. Press Continue when prompted
3. When it has finished, press Copy then Paste (Ctrl+V) this into your next post please

Please also mention what version of windows is mention on your COA sticker (if you have one) but don't post the key.
How to Tell – Hardware

 

[Jed]

Hi Jed,

Is this a business computer? There seems to be a call for KMS activation in the event log.

1. Download MGADiag (by Microsoft) from the link found below:
   http://go.microsoft.com/fwlink/?linkid=52012
2. Run the tool by double-clicking on the file. Press Continue when prompted
3. When it has finished, press Copy then Paste (Ctrl+V) this into your next post please

Please also mention what version of windows is mention on your COA sticker (if you have one) but don't post the key.
How to Tell – Hardware

Hi Alex

This has been my personal Sony VAIO laptop since purchasing it new - what is "a call for KMS activation" & why does this indicate a business computer?

MGADiag ouput is attached.

My COA sticker says
"Windows 7 Ult OA
Sony Corporation"
then at the bottom of the sticker is the Key

 

[Jed]

Hi again Alex

I think the KMS call in the event log might be because I still occasionally login (special access) into my former workplace intranet (the social webpage for news/events/reunions).

But I have not done so for a month or so.

Regards
Jed

 

[Go The Power]

The log looks like fine, it is using the original OEM license.

Click on the start button -> Inside the search field type in Powershell -> Right click on Powershell.exe -> Choose run as admin -> enter in the following command:
Get-ComputerRestorePoint >1
Notepad 1
Post the contents of 1.txt back into this thread.

 

[Jed]

Hi Alex

Did this

Windows PowerShell
Copyright (C) 2009 Microsoft Corporation. All rights reserved.

PS C:\Windows\system32> Get-ComputerRestorePoint >1
PS C:\Windows\system32> Notepad 1
PS C:\Windows\system32>

But 1.txt looks empty - is this what you expected?

I get attached error when trying to upload 1.txt - any ideas why?

 

[Go The Power]

The notepad file is coming back as empty as nothing was found to export.

Do you have any cleanup tools installed that would be deleting these restore points?