Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Backing up restore points


  • This topic is locked This topic is locked
16 replies to this topic

#1 vdotmatrix

vdotmatrix

  • Members
  • 50 posts
  • OFFLINE
  •  
  • Local time:06:42 PM

Posted 27 October 2011 - 05:33 AM

So a big hello!

All of a sudden I had an issue that prompted me to simply restore to an earlier date but guess what?

ALL OF MY RESTORE points before a certain date had been WIPED off or deleted. The work of a trojan or something worse.


QUESTION: Is there a way to back up these restore points elsewhere on the computer or offsite? Where are these files located?

thanks in advance!

BC AdBot (Login to Remove)

 


#2 noknojon

noknojon

  • Banned
  • 10,871 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Local time:09:42 AM

Posted 27 October 2011 - 05:54 AM

QUESTION: Is there a way to back up these restore points elsewhere on the computer or offsite?

Hi -
As far as I know the answer to this is generally no. This sounds like you, or another program deleted these points.
My Antivirus automatically creates a new point every time it performs an update.

How far back do the current Restore points go, or is there a section in the middle of these points missing ?

As a general rule I delete my restore points after about a month, providing my computer is OK, and then start again for the next month.
""I had an issue that prompted me to simply restore to an earlier date""< Can you please describe the issue for us ?

Thank You -

#3 vdotmatrix

vdotmatrix
  • Topic Starter

  • Members
  • 50 posts
  • OFFLINE
  •  
  • Local time:06:42 PM

Posted 27 October 2011 - 06:00 AM

we i posted here my issue

when i starrted to see issues with redirects i simply thought i could go and restore and life would be OK.

ALL RESTORE POINTS were GONE and it is the end of the month when I should have at least a dozen or more points on the calendar.

so that prompted me to see if I could back up my backup points.

:(

#4 vdotmatrix

vdotmatrix
  • Topic Starter

  • Members
  • 50 posts
  • OFFLINE
  •  
  • Local time:06:42 PM

Posted 27 October 2011 - 08:14 AM

QUESTION: Is there a way to back up these restore points elsewhere on the computer or offsite?

Hi -
As far as I know the answer to this is generally no. This sounds like you, or another program deleted these points.
My Antivirus automatically creates a new point every time it performs an update.

How far back do the current Restore points go, or is there a section in the middle of these points missing ?

As a general rule I delete my restore points after about a month, providing my computer is OK, and then start again for the next month.
""I had an issue that prompted me to simply restore to an earlier date""< Can you please describe the issue for us ?

Thank You -

I never ever delete restore points. Everything before October 24th is GONE...EVERYTHING..... so this trojan jazz is bad news

#5 Allan

Allan

  • BC Advisor
  • 8,611 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New Jersey
  • Local time:07:42 PM

Posted 27 October 2011 - 08:20 AM

Instead of System Restore, which is great when it works but seems to fail just when you need it the most, I always suggest the use of Disk Imaging Software on a regular basis. Create images to a second hard drive and you'll always have a safe haven to which you can return.

#6 vdotmatrix

vdotmatrix
  • Topic Starter

  • Members
  • 50 posts
  • OFFLINE
  •  
  • Local time:06:42 PM

Posted 27 October 2011 - 08:56 AM

Instead of System Restore, which is great when it works but seems to fail just when you need it the most, I always suggest the use of Disk Imaging Software on a regular basis. Create images to a second hard drive and you'll always have a safe haven to which you can return.

I am so sick of this trying to outsmart these b*st*rds who write this malicious software.

Can you suggest a disk imaging software you like?

#7 Allan

Allan

  • BC Advisor
  • 8,611 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New Jersey
  • Local time:07:42 PM

Posted 27 October 2011 - 09:11 AM

Here's something I put together a while ago - hope it helps. Feel free to follow up with any questions you may have.

Disk Imaging software takes a "snapshot" of your drive as it exists at the time you create the image. You can then restore the entire image or any file(s) or folder(s) you choose. It is a virtually foolproof way of backing up your system and providing a safe haven in the event of a catastrophe that requires you to blow away your system partition and restore it to a previous state. It also allows you to "test" various software and be confident that you have a the ability to return to the prior state any time you choose.
I use Acronis True Image. It is the best of breed, but it isn't free. The best free alternative is Macrium Reflect.

1) I create an image of my system partition once a week to a second hard drive and keep the 2 or 3 most recent images. I also image my other partitions about once a month. I always enable "verify image" in the options. It takes a little longer, but insures a valid image.
2) I also create an image before performing any drive level function (ie, changing the size of a partition) or making any significant change to the OS (installing a service pack, upgrading IE, etc). Also sometimes before installing new software.
3) Images may be created on any medium (cd, dvd, external drive, etc). For obvious reasons they should not be stored on the same drive you are imaging. The best option is a second internal hd if you have one.
4) Images may be created "in the background" within the OS. If you need to restore the system partition, that will need to be done before the OS loads. You can start the process within the application in the OS and it will then tell you it needs to reboot to finish the process. Alternatively, you can boot to a "recovery disk" which you can create when you first install the software (or to the application disk itself if you have one). Other partitions can be restored without a reboot.

#8 vdotmatrix

vdotmatrix
  • Topic Starter

  • Members
  • 50 posts
  • OFFLINE
  •  
  • Local time:06:42 PM

Posted 27 October 2011 - 03:26 PM


QUESTION: Is there a way to back up these restore points elsewhere on the computer or offsite?

Hi -
As far as I know the answer to this is generally no. This sounds like you, or another program deleted these points.
My Antivirus automatically creates a new point every time it performs an update.

How far back do the current Restore points go, or is there a section in the middle of these points missing ?

As a general rule I delete my restore points after about a month, providing my computer is OK, and then start again for the next month.
""I had an issue that prompted me to simply restore to an earlier date""< Can you please describe the issue for us ?

Thank You -

I never ever delete restore points. Everything before October 24th is GONE...EVERYTHING..... so this trojan jazz is bad news

well I found this info about restore points and where they were located. I had to add myself to the security list that was allowed accesss to these files...and sure enough the second i was infucted, all the restore points disappeared before Sunday October 23rd. JUST LIKE THAT. So in theory I can copy these little R folders to another location and have them there in waiting for a ripe time. they seem to be less than a MG each. What a hassle. here is a bit more to this for anyone else who just has to be able to think they can take a proactive posture:

"The Restore Point files are in the System Volume
Information\_Restore{GUID} folder. Because System Restore will purge the
Restore Point files Automat ally, it appears that it is not necessary to
clean out the file periodically. If needed, you may refer to the following
MS KB article to get access the System Volume Information folder if the
file system is NTFS.

309531 How to Gain Access to the System Volume Information Folder
http://support.microsoft.com/?id=309531

After opening the System Volume Information\_restore{GUID} folder, you may
notice that there may be one or more folders starting with RP<x> under this
folder. These are the restore points. From the Modified Date of each
folder, you will know the date the Restore Points were created. You can
then delete the Restore Points which you think that it is too old "

I backed up these 12 restore points on another HD and i guess I can just move them over to this folder if it ever hits the fan again.

Edited by vdotmatrix, 27 October 2011 - 03:34 PM.


#9 noknojon

noknojon

  • Banned
  • 10,871 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Local time:09:42 AM

Posted 27 October 2011 - 03:27 PM

Hello again -

As you now have a topic running in the Malware Removal area of the forum it is not a good idea for us to put up ideas in this area of the forum.

Please stay with your Malware Removal topic and try not to make too many alterations to your system at this time.
Please click on Watch Topic in that post and you will get notified as replies are posted there.

Extra changes can make it harder for the experts to diagnose your posted problem.
So we should wait for their response first, and if you still have problems, then this thread could continue -

Thank You -
EDIT -
If you think your Malware Related problem is now solved, Please add a few lines there that you no longer need their help.

Edited by noknojon, 27 October 2011 - 03:31 PM.


#10 vdotmatrix

vdotmatrix
  • Topic Starter

  • Members
  • 50 posts
  • OFFLINE
  •  
  • Local time:06:42 PM

Posted 27 October 2011 - 03:44 PM

Hello again -

As you now have a topic running in the Malware Removal area of the forum it is not a good idea for us to put up ideas in this area of the forum.

Please stay with your Malware Removal topic and try not to make too many alterations to your system at this time.
Please click on Watch Topic in that post and you will get notified as replies are posted there.

Extra changes can make it harder for the experts to diagnose your posted problem.
So we should wait for their response first, and if you still have problems, then this thread could continue -

Thank You -
EDIT -
If you think your Malware Related problem is now solved, Please add a few lines there that you no longer need their help.


I apologize, but I don't quit follow what you mean about "putting ideas" in this area of the forum. I have not made any modifications except try to find answers why ALL my restore points disappeared. I also was looking for answers to many things I have no idea about which apparently no one else knew right off hand either.

I was able to COPY my restore points which are folders offsite.

I am following or trying to follow all the preparations for help that led to BSOD using DDS FGER so in the meantime of days for a response I am trying to learn something here.

I will be waiting and not monkeying around with anything except possibly browsing with firefox in firefox safe mode.

I have asked all sorts of questions on this marvelous compute forum and there are a lot of very very knowledgeful people here, I am so glad i found this forum. thank you for rsponding!!!

#11 Eyesee

Eyesee

    Bleepin Teck Shop


  • BC Advisor
  • 3,545 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:In the middle of Kansas
  • Local time:06:42 PM

Posted 27 October 2011 - 03:57 PM

Viruses and malware love to hide in restore points.
The makers know that the first thing someone will try is a system restore which, as Allan said, fails more often than it works.

System restore points also can take up an incedible amount of hard drive space.
As a rule, I delete all but the last restore point before I work on an infected system to prevent the user from reinfecting the machine.

Being able to copy your restore points to another drive is one thing.
Being able to sucessfully restore them if needed is another.

Restore points to me become dated and a moot point within a weeks time. To me it is not worth the time to keep more than the past two or so.
In the beginning there was the command line.

#12 Allan

Allan

  • BC Advisor
  • 8,611 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New Jersey
  • Local time:07:42 PM

Posted 27 October 2011 - 03:59 PM

Restore points do not become "dated" - the purpose of restore point is to return to the date it was created. However, they are cumulative in nature. Regardless, I agree with the above statement that they should not be copied to secondary media.

#13 noknojon

noknojon

  • Banned
  • 10,871 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Local time:09:42 AM

Posted 27 October 2011 - 04:00 PM

I apologize, but I don't quit follow what you mean about "putting ideas" in this area of the forum

Hi -
Any changes we ask you to make here will change the way your "logs" show up to a malware removal expert.
Once you make a request for help in the Malware Removal area, it is best not to request help in the XP section of the forum, as we can give conflicting ideas.
In this area we are not Malware experts, we are only "general helpers" that may give incorrect advice without fully reading your DDS and other logs.

Those logs are never analysed in this area of the forum, only in the Malware removal section of the forum.

The people there are trained experts in those things, we are not. Please stay only with your other post for now -

Thank You -

#14 vdotmatrix

vdotmatrix
  • Topic Starter

  • Members
  • 50 posts
  • OFFLINE
  •  
  • Local time:06:42 PM

Posted 27 October 2011 - 04:11 PM

I think I understand, I think I was offering just a little bit of background as to why would even have to know were my backup points for located. Do you think that if I had backup points still around from a month ago that it would help my infection today? I have seen this before my computer When something went south. it seems like all the restore points disappear. it's like being stranded in a small dinghy in the middle of the ocean. at least now I know that I have some restore point sitting safely somewhere. I like that backup program they were talking about above. at any rate this is a great discussion thank you very much.

#15 vdotmatrix

vdotmatrix
  • Topic Starter

  • Members
  • 50 posts
  • OFFLINE
  •  
  • Local time:06:42 PM

Posted 27 October 2011 - 04:13 PM

I apologize I am responding from my android Text to speech And I didn't edit The garble.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users