Can no longer delete old image backups - 7.1.2697


Author
Message
cyberreina2
cyberreina2
New Member
New Member (10 reputation)New Member (10 reputation)New Member (10 reputation)New Member (10 reputation)New Member (10 reputation)New Member (10 reputation)New Member (10 reputation)New Member (10 reputation)New Member (10 reputation)
Group: Forum Members
Posts: 4, Visits: 18
I create a full image once a month on my desktop computer running Windows 7 Pro 64-bit.  Last night, I tried to delete the two oldest images from my external hard drive using my Directory Opus file manager (as always). This time, I received a message saying I couldn't do this.It said that I couldn't delete the file because of "Error 0x80070510: The requested file operation failed because the storage policy blocks that type of file.  For more information, contact your system administrator."  The message went on to identify the file, mentioned Macrium Reflect Image Backup, identified the backup method as full, the compression as medium, and that it was not password protected.  The fact that I had just installed an update to Macrium, coupled with this mention of Macrium details, makes me think that this may be caused by the update.  I'm not sure.  I only know that in the past, I've always been able to delete older image backups. I'd be asked whether I want to send them to the recycle bin, and then I'd be told that they were too big for that and did I want to just delete them permanently. I always said yes, and they always were deleted.  I never encountered such an error message before.  I tried searching for info about the error message, but I found nothing useful, perhaps because I'm not all that technically knowledgeable.  I have no system administrator I can ask.  I'm hoping someone on this forum can shed some light on this issue that a non-technical person can understand.

I should mention that Macrium lists only the 4 most recent images (After encountering the error message, I changed my setting so that only the last 4 full images are saved).  But when I looked at the contects of my external harddrive using my file manager, all six images were shown.  I'm assuming they wouldn't appear unless they were still there.

Thanks in advance for your help. 

jphughan
jphughan
Macrium Evangelist
Macrium Evangelist (5.1K reputation)Macrium Evangelist (5.1K reputation)Macrium Evangelist (5.1K reputation)Macrium Evangelist (5.1K reputation)Macrium Evangelist (5.1K reputation)Macrium Evangelist (5.1K reputation)Macrium Evangelist (5.1K reputation)Macrium Evangelist (5.1K reputation)Macrium Evangelist (5.1K reputation)
Group: Forum Members
Posts: 3.5K, Visits: 26K
It's part of Macrium Image Guardian, a new anti-ransomware feature introduced for 7.1.  You should have gotten a dialog prompt about it the first time you launched Reflect after updating to a 7.1 release.  You can learn more about it here: https://knowledgebase.macrium.com/display/KNOW7/Macrium+Image+Guardian

To delete backups, the recommended way is to do so within Reflect, under the Restore tab; the Delete option is under the Other Actions menu of a given backup.  Or you can temporarily disable Macrium Image Guardian entirely, which will allow you to delete backups within Windows Explorer, although that method is technically riskier if you have any Inc/Diff backups since there's nothing to stop you from accidentally deleting a parent backup that a child backup you wanted to retain depends on.  Deleting backups within Reflect doesn't allow that to happen, nor does it allow old backups made useless by parent deletions to stick around, which is another possible outcome of deleting within Windows Explorer.  Finally, note that the moment, there is a bug whereby if you choose to turn off Macrium Image Guardian and keep the "Restart service on reboot" option checked, it will not actually turn off; you have to uncheck that option.  Macrium is aware of the issue and has said it will be fixed in an update shortly.

Edited 20 November 2017 8:56 PM by jphughan
Philip Campbell
Philip Campbell
New Member
New Member (24 reputation)New Member (24 reputation)New Member (24 reputation)New Member (24 reputation)New Member (24 reputation)New Member (24 reputation)New Member (24 reputation)New Member (24 reputation)New Member (24 reputation)
Group: Forum Members
Posts: 13, Visits: 2.7K
cyberreina2:

I think that you are encountering "resistance" from MIG (Macrium Image Guardian).  It is a new module in version 7 that protects Macrium backup files from being modified or deleted by any application other than Macrium itself.  This is protection against ransomware.  You can disable MIG, but my approach is simply to go to the Restore tab, find the backup you want to delete, and have Macrium delete it.  That works for me.

Please let us know how you make out.  Have a great day, and welcome to the Macrium Forums.

Have a great day.

Regards,
-Phil

Beeping Computer Malware Response Instructor
Member of the Unified Network of Instructors and Trusted Eliminators (U.N.I.T.E.)

jphughan
jphughan
Macrium Evangelist
Macrium Evangelist (5.1K reputation)Macrium Evangelist (5.1K reputation)Macrium Evangelist (5.1K reputation)Macrium Evangelist (5.1K reputation)Macrium Evangelist (5.1K reputation)Macrium Evangelist (5.1K reputation)Macrium Evangelist (5.1K reputation)Macrium Evangelist (5.1K reputation)Macrium Evangelist (5.1K reputation)
Group: Forum Members
Posts: 3.5K, Visits: 26K
In addition to my earlier post, in terms of Reflect showing 4 images but seeing 6 in Windows Explorer, under the Restore tab in Reflect, click the "Folders to search" link and make sure that all folders that contain backups are listed there. Also note that the Restore tab is split into Image and File & Folder "sub-tabs", so if you capture both types of backups, you'll have to make sure you're viewing the correct tab. Finally, even if you changed your retention policy to keep only 4 backups, it's possible that old backups can stick around if they're not considered a "matching set". That can happen even without any direct changes on your end if you recently updated to a new release of Windows 10 because of something that can happen during that process, which you can read more about here: https://forum.macrium.com/Topic3262.aspx

Edited 20 November 2017 6:24 PM by jphughan
jphughan
jphughan
Macrium Evangelist
Macrium Evangelist (5.1K reputation)Macrium Evangelist (5.1K reputation)Macrium Evangelist (5.1K reputation)Macrium Evangelist (5.1K reputation)Macrium Evangelist (5.1K reputation)Macrium Evangelist (5.1K reputation)Macrium Evangelist (5.1K reputation)Macrium Evangelist (5.1K reputation)Macrium Evangelist (5.1K reputation)
Group: Forum Members
Posts: 3.5K, Visits: 26K
UPDATE: Looks like the new 7.1.2718 update is worse; on my system and another user's it's now impossible to turn off MIG without removing the component entirely; see this thread.  I'd recommend holding off on updating until this is resolved.  In the meantime, if you're running Build 2697, the above tips still apply.

cyberreina2
cyberreina2
New Member
New Member (10 reputation)New Member (10 reputation)New Member (10 reputation)New Member (10 reputation)New Member (10 reputation)New Member (10 reputation)New Member (10 reputation)New Member (10 reputation)New Member (10 reputation)
Group: Forum Members
Posts: 4, Visits: 18
Thanks VERY much, jphughan and Phil Campbell, for your prompt and helpful responses!  And thanks especially, jphughan, for all the useful detail.  I don't recall seeing anything about Macrium's Image Guardian when I upgraded to version 7.1, though it's possible I simply saw "anti-ransomeware,"  assumed it was a good idea, and didn't read any further.  I think I'll take the advice that both of you have offered about deleting through Macrium rather than through my file manager, though I very much appreciate the instructions for how to disable Image Guardian if necessary.  Actually, I'm not sure how useful Image Guardian will be for me, since my images are stored on an external hard drive that is not connected to the Internet except when I make an image.  Also, if I ever upgrade version 2 of Malwarebytes (which I use every day) to version 3, version 3 includes anti-ransomware. 

Anyway, I'm delighted to have this problem solved, and most grateful to the two of you for your help.

jphughan
jphughan
Macrium Evangelist
Macrium Evangelist (5.1K reputation)Macrium Evangelist (5.1K reputation)Macrium Evangelist (5.1K reputation)Macrium Evangelist (5.1K reputation)Macrium Evangelist (5.1K reputation)Macrium Evangelist (5.1K reputation)Macrium Evangelist (5.1K reputation)Macrium Evangelist (5.1K reputation)Macrium Evangelist (5.1K reputation)
Group: Forum Members
Posts: 3.5K, Visits: 26K
cyberreina2 - 20 November 2017 9:10 PM
Thanks VERY much, jphughan and Phil Campbell, for your prompt and helpful responses!  And thanks especially, jphughan, for all the useful detail.  I don't recall seeing anything about Macrium's Image Guardian when I upgraded to version 7.1, though it's possible I simply saw "anti-ransomeware,"  assumed it was a good idea, and didn't read any further.  I think I'll take the advice that both of you have offered about deleting through Macrium rather than through my file manager, though I very much appreciate the instructions for how to disable Image Guardian if necessary.  Actually, I'm not sure how useful Image Guardian will be for me, since my images are stored on an external hard drive that is not connected to the Internet except when I make an image.  Also, if I ever upgrade version 2 of Malwarebytes (which I use every day) to version 3, version 3 includes anti-ransomware. 

Anyway, I'm delighted to have this problem solved, and most grateful to the two of you for your help.

You're welcome!  I'm confused when you say that your external hard drive isn't connected to the Internet except when you make an image, though.  External hard drives don't directly connect to the Internet anyway, unless maybe you have a NAS appliance that has built-in apps?  Anyhow, the threat model isn't so much that something will get onto the hard drive directly.  Instead, it's that something might get onto your PC in the course of regular browsing (sometimes hackers compromise legitimate sites to have them start distributing malware, or malware can be distributed through ad networks that place ads all over the Internet), and once the ransomware gets onto your PC, it can start encrypting all of the files it finds on any drives it has access to.  Before MIG, if the ransomware got to your backup files because you didn't have a backup drive offline at the time, you'd have lost all of your current data and your backups.  With MIG, the idea is that ransomware will be blocked from modifying Reflect backup files, so even if all of your current data gets encrypted, your backup files will be intact.  If you meant your external hard drive isn't even connected to the network or your PC except when making a backup, then that's the best anti-ransomware protection of all, but that isn't practical for everyone, which is why MIG exists. Smile

I'll also add that one of the benefits of MIG's anti-ransomware design compared to other technologies like Malwarebytes or the new Controlled Folder Access feature in Win10 1709 is that the latter options employ a "black list" approach.  Basically, they use heuristics and definition files to identify and block "known malicious" applications, but they otherwise default to allowing activity.  That keeps them from being so obtrusive that users are driven to disable them, but it also means they can fail to block certain malware.  MIG takes the opposite and much more hard-line approach, called a "white list".  It operates on the premise that Macrium's applications are trusted, and everything else is categorically not trusted.  That obviously makes it less flexible (as you saw, even you couldn't just delete backup files), which is why the white list design is typically considered impractical for solutions that are designed to protect multiple file types that might need to be edited by multiple applications -- but MIG is only focused on protecting backup files, and those are typically only modified by Macrium applications, so it can "afford" to use this design, and as a result it is both simpler and more secure than the other solutions' black list-based designs can ever be.

Edited 20 November 2017 10:25 PM by jphughan
cyberreina2
cyberreina2
New Member
New Member (10 reputation)New Member (10 reputation)New Member (10 reputation)New Member (10 reputation)New Member (10 reputation)New Member (10 reputation)New Member (10 reputation)New Member (10 reputation)New Member (10 reputation)
Group: Forum Members
Posts: 4, Visits: 18
Many thanks, jphughan, for this useful added information about MIG.  I sounds as if I might be able to run both Malwarebytes' anti-ransomeware component and MIG, since MIG's focus is narrow enough that the two programs are unlikely to interfere with each other. On the other hand, since my external hard drive is not connected either to the network or to my PC except when I make images, perhaps I may not really need MIG.  I'll give this more thought.


JamieW
JamieW
Macrium Representative
Macrium Representative (156 reputation)Macrium Representative (156 reputation)Macrium Representative (156 reputation)Macrium Representative (156 reputation)Macrium Representative (156 reputation)Macrium Representative (156 reputation)Macrium Representative (156 reputation)Macrium Representative (156 reputation)Macrium Representative (156 reputation)
Group: Moderators
Posts: 102, Visits: 1.2K
Firstly, we would like to apologise for the inconvenience caused by this complex issue and the repeated updates that unfortunately failed to fix it.

Unfortunately, we have found that on some systems, certain kernel stack values caused MIG to fail to turn off.

We have now corrected this problem, and we are certain that this issue has been resolved in the latest update.

Once again, apologies for any inconvenience caused.

Kind Regards,

Macrium Support
Philip Campbell
Philip Campbell
New Member
New Member (24 reputation)New Member (24 reputation)New Member (24 reputation)New Member (24 reputation)New Member (24 reputation)New Member (24 reputation)New Member (24 reputation)New Member (24 reputation)New Member (24 reputation)
Group: Forum Members
Posts: 13, Visits: 2.7K
cyberreina2:

I use Malwarebytes Premium 3.3.1, and there is no conflict with MIG.  From a security perspective, I would not disable MIG even on an external hard drive that is only connected to make backups.  A ransomware attack could potentially occur during that time period, although I would agree with you that it is highly unlikely.  I just use Macrium to delete its old backups and I keep MIG enabled.  I have had no issues.

Just my two cents.  Have a great day.

Regards,
-Phil

Beeping Computer Malware Response Instructor
Member of the Unified Network of Instructors and Trusted Eliminators (U.N.I.T.E.)

GO

Merge Selected

Merge into selected topic...



Merge into merge target...



Merge into a specific topic ID...




Similar Topics

Reading This Topic

Login

Explore
Messages
Mentions
Search