Retention policy killed last working backup

[jrohrauer]

Greetings,

something quite stupid happened to me recently. I have a 2TB external HDD connected to my computer, it backs up all my data onto that drive. This data includes my S: Drive, which holds *all* my photos since the beginning of this century.
This drive failed, and so did the backup jobs. When I discovered what was going on, I didn´t take any further action, because I thought since the backup job is failing, the retention policy doesn´t get applied. Some weeks later I found that the backup job is not failing anymore, and that I cannot recover any files anymore.

Is there any chance I can recover stuff from my backup archive? there was just minimal change since then. I do not know the behaviour of VEB, does it really truncate the backups or does ist just "mark the space as free"?

My last alternative is sending the failed drive to a data recovery lab, which set´s me back around € 800.... (I know, my own fault -.-)

Thanks
Johannes

[Mike Resseler]

Johannes,

This does not look good... When doing a restore, can you look at the OLDEST backup and see what is inside there? (The oldest is most probably not seen in the UI as we show the last 7 or so but if you have a longer retention policy you should be able to see them when selecting the backup). Also, did you ever took a Standalone backup? That is not dependent on any retention policy so unless you deleted it manually it lives "forever"

Mike

[Dima P.]

Hi Johannes,

I thought since the backup job is failing, the retention policy doesn´t get applied

That’s correct. Merge process takes place at the end of backup job only after new restore point is created.

To clarify, you are using the USB device as a backup destination and all backup files were deleted from this USB device?

[jrohrauer]

To clarify things further:
I had the following setup:
c: - approx 350GB used (90% static data)
v: - approx 100GB used (static data)
s: - approx 1.2TB used (photos, just some additions from time to time)

On my usb drive I have the following:

Code: Select all

 Verzeichnis von I:\VeeamEndpointBackup\Backup Job CELSIUS

05.08.2016  20:40    <DIR>          .
05.08.2016  20:40    <DIR>          ..
05.08.2016  20:40           109.763 Backup Job CELSIUS.vbm
06.10.2015  00:30        31.584.256 Backup Job CELSIUS2015-10-06T003029.vib
05.08.2016  20:40 1.635.599.384.576 Backup Job CELSIUS2016-07-29T203140.vbk
05.08.2016  20:40     1.403.171.840 Backup Job CELSIUS2016-07-30T203144.vib
31.07.2016  20:34     2.408.412.672 Backup Job CELSIUS2016-07-31T203035.vib
01.08.2016  20:36     2.277.553.152 Backup Job CELSIUS2016-08-01T203141.vib
02.08.2016  20:34     2.919.256.576 Backup Job CELSIUS2016-08-02T203022.vib
03.08.2016  20:34     2.734.530.048 Backup Job CELSIUS2016-08-03T203021.vib
04.08.2016  20:33     1.855.072.256 Backup Job CELSIUS2016-08-04T203021.vib
05.08.2016  20:34     3.036.214.272 Backup Job CELSIUS2016-08-05T203027.vib
              10 Datei(en), 1.652.265.289.411 Bytes
               2 Verzeichnis(se), 347.937.177.600 Bytes frei

That makes me hope that the data is still there, only invisible in the gui for me. Otherwise the current file should be something around 400GB (taking inline dedup and/or compression into account, if VEB does that).

The .vbk-File has the creation Date of late 2015 (last year), and last modified date of August 5th, 2016 (this year, that was the date where I realized what is going, so I disabled the backup schedule and unplugged the USB drive since then).
So all the files seem to be there, nothing was deleted, I think.
When I open the .vbk I can browse back to 29th July 2016 (this year), no earlier backups where available.

Any further advice is highly appreciated!

Thanks in advance
Johannes

[Mike Resseler]

Johannes,

When you open the file level restore wizard (right-click on the tray icon, choose restore - individual files) and then select the oldest recovery point. The Veeam explorer will open. are you able to see those files from that S-drive?

PS: That S-drive, I might misread it but is that an internal drive in your computer? Because if it is an external drive it isn't protected. Veeam Endpoint Backup cannot protect external USB devices...

Mike

[jrohrauer]

Hi Mike,

tried it - same result. Last Backup from 29th July, where the last full one was obviously made.
BTW: S: was a lokal drive. After I realized that the drive has failed I did a restore, from some files, which was fine at that point.

Johannes

[Dima P.]

Johannes,

Can you open file level recovery wizard (C:\Program Files\Veeam\EndPoint Backup\Veeam.EndPoint.FLR.exe) and go back to the very first step of backup wizard (backup location). Browse for your backup location and go to ‘Restore Point’ step. Can you share the screenshot of this step to compare results with the dir output above?

P.S. Disable backup job and do not copy paste data to this device during investigation.

[jrohrauer]

Dmitry,

the output is as follows:


Seems all equal to me...

[Dima P.]

Thanks. I believe your full backup was transformed according to the retention policy, right? In backup job’s settings, you have a number of restore points to keep. When retention comes in play you latest incremental is merged into full backup. Kindly check the value of the retention in your backup job wizard (destination step).