New system will not restore..Unspecified error during system restore 0x80070005

[weare one]

Unspecified error during system restore 0x80070005


New system will not restore


I have been having a little trouble with my mail client Thunderbird, which has worked perfectly until the other day. Works ok now btw.

Being lazy I thought the easiest way to correct this was to do a system restore to when I knew Thunderbird was working ok.

This is only a 3 week old system and all that I have running besides Windows Defender is Malwarebytes and I have installed PhotoShop 7, Office 20000 (yes word works 99% of the time) and cpuz.....nothing else.

I did a little research (but I'm no expert) and even chkdsk will not run (see photo) although running "Windows checking" via properties on drive c finds no errors.

Andy ideas

 

[Rakk]

I did a little research (but I'm no expert) and even chkdsk will not run (see photo) although running "Windows checking" via properties on drive c finds no errors.

Chkdsk is complaining that it can't lock the drive and this is because Windows is using it
If you'd pressed Y to get it to run when you next restarted the machine then it would have more than likely worked - it would do it before Windows was booted.

 

[weare one]

Chkdsk is complaining that it can't lock the drive and this is because Windows is using it
If you'd pressed Y to get it to run when you next restarted the machine then it would have more than likely worked - it would do it before Windows was booted.

Ok so I ran chkdsk after pressing y immediately after powering on and I got a quick flash of a dos screen/box which immediately disappeared.

This was the second time I followed these instructions the first time I continuously pressed y while powering on and this disabled my internet connection.....as I say bit of a newbie

 

[ubuysa]

The reason your first chkdsk attempts failed is because of a syntax error, you forgot the colon after the C - It should be 'chkdsk C:'.

As Rakk says the disk is locked because Windows has files open on it, which is why you have to reboot. I'm a bit surprised it just flashed on the screen, though that SSD you have is fast and it won't take long to check it, especially if you don't have much on there. Incidentally, the /R switch is redundant on an SSD. On an HDD it tells chkdsk to find and fix bad sectors and this can't be done on an SSD. The /F switch tells chkdsk to check the NTFS filesystem for errors, as I said, if you don't have a very big filesystem it won't take long to check on a fast SSD.

Regarding the System Restore issue, can you see any restore points in the System protection dialog? If you manually take a restore point now, can you restore to that?

It might be wise to manually backup your user data before messing with System Restore - just in case.

 

[weare one]

The reason your first chkdsk attempts failed is because of a syntax error, you forgot the colon after the C - It should be 'chkdsk C:'.

As Rakk says the disk is locked because Windows has files open on it, which is why you have to reboot. I'm a bit surprised it just flashed on the screen, though that SSD you have is fast and it won't take long to check it, especially if you don't have much on there. Incidentally, the /R switch is redundant on an SSD. On an HDD it tells chkdsk to find and fix bad sectors and this can't be done on an SSD. The /F switch tells chkdsk to check the NTFS filesystem for errors, as I said, if you don't have a very big filesystem it won't take long to check on a fast SSD.

Regarding the System Restore issue, can you see any restore points in the System protection dialog? If you manually take a restore point now, can you restore to that?

It might be wise to manually backup your user data before messing with System Restore - just in case.

Hi ubuysa

I actually tried several combinations including the colon after the c and yes my fast ssd with very very little on might be the explanation.

As for restore no luck I’m afraid. I was able to set a new restore point for today but when I tried to go back to say 21st I got the same error message "Unspecified error during system restore 0x80070005"

 

[ubuysa]

Hi ubuysa

I actually tried several combinations including the colon after the c and yes my fast ssd with very very little on might be the explanation.

As for restore no luck I’m afraid. I was able to set a new restore point for today but when I tried to go back to say 21st I got the same error message "Unspecified error during system restore 0x80070005"

It sounds as though that restore point is corrupted somehow. I would suggest you delete it.

 

[weare one]

It sounds as though that restore point is corrupted somehow. I would suggest you delete it.

That’s the thing I used 2 different restore points [FONT=&quot]and considering how new this system is and how little I have on my ssd drive its all rather worrying[/FONT]

 

[ubuysa]

That’s the thing I used 2 different restore points [FONT="]and considering how new this system is and how little I have on my ssd drive its all rather worrying[/FONT]

Well before you install too much additional stuff, try restoring to the restore point you manually created yesterday.

 

[fnf]

That’s the thing I used 2 different restore points [FONT="]and considering how new this system is and how little I have on my ssd drive its all rather worrying[/FONT]

In my experience the Volume Shadow Copy feature (which is what the System Restore is based upon) can corrupt spontaneously with a perfectly good drive. This is one such bug: https://support.microsoft.com/en-gb...rupted-when-the-volume-shadow-copy-service-vs .

VSS, whilst convenient as it lets you make a live system backup, is inherently flawed: it relies on the data providers i.e., the applications to:
* Make a snapshot of their data in a timely manner
* Make a correct snapshot of their data

The 2nd point is important. Consider these scenarios:
* You're copying a directory and a VSS snapshot is made: the system will create a snapshot with half the directory copied.
* You're working on a document/photo/whatever with unsaved changed: the system will create a snapshot without the unsaved changes. Worse yet (up to the application), the snapshot will most likely contain temporary files for that editing session. If you restore from backup, the next time you open that file you might find that application will suggest restoring the unsaved changed as if it crashed, or the data was corrupted.

The only safe time to backup an application or system data is when the application/system is not running. In all other cases, the application/system will need to support live backing up, however the scenarios I presented above will cause it to back up half-written data. There is no way around it. Keep in mind that you might not be copying/updating data yourself but the rest of the system will always be doing something in the background. Effectively the restored system will be in a half-broken state.

For these reasons, I'd recommend disabling System Restore completely and use an offline system-wide backup solution. I'm using Acronis True Image with good effects but any tools that could backup an entire drive sector-by-sector would do just fine.

It is also worth noting that chkdsk does not validate VSS snapshots e.g., System Restore points. There are no tools to do so AFAIK.

 

[ubuysa]

I'd certainly agree that imaging the system drive on a regular basis is a much safer way to recover from problems than system restore. For those who don't image their system then system restore is better than nothing however, it does at least give you a fighting chance at getting back to where you were. My advice would be to seriously consider a disk imaging tool but if you don't (or can't) go down that route then system restore is worth turning on.

BTW the problem to which you linked was for Windows 7 and dates from 2009, also a hotfix was issued by Microsoft and that functionality is almost certainly included in Windows 10 which is what the OP is using.

 

[fnf]

I'd certainly agree that imaging the system drive on a regular basis is a much safer way to recover from problems than system restore. For those who don't image their system then system restore is better than nothing however, it does at least give you a fighting chance at getting back to where you were. My advice would be to seriously consider a disk imaging tool but if you don't (or can't) go down that route then system restore is worth turning on.

BTW the problem to which you linked was for Windows 7 and dates from 2009, also a hotfix was issued by Microsoft and that functionality is almost certainly included in Windows 10 which is what the OP is using.

I agree, System Restore is indeed better than nothing and Microsoft did well to include and enable it by default. However if one is making a conscious backup plan then I think it's worth considering the offline backup solutions, since the atomicity issue is not solvable on a large scale. A backup that doesn't work is not much better than having no backup, given that VSS snapshot corruptions cannot be manually detected and repaired.

The issue I linked to is rather old but I've personally experienced a couple of corrupted VSS snapshots already on a new SSD on Windows 10. PCS already replaced the SSD (ADATA SX6000 in this case) once following my report but I ran into another shortly after. It doesn't appear that the drive was at fault as it otherwise runs fine. This new laptop has not crashed once since I got it, the corruption just kinda happened.

There are a lot of 'shady' stuff done by Windows in the background and if one is not in a habit of checking Event Viewer & Reliability History all the time like I do (mainly because I don't trust Windows' stability just yet) then one might find a lot of surprises in store .

 

[ubuysa]

There are a lot of 'shady' stuff done by Windows in the background and if one is not in a habit of checking Event Viewer & Reliability History all the time like I do (mainly because I don't trust Windows' stability just yet) then one might find a lot of surprises in store .

I think you'll find that Windows 10 is a lot more stable than you might think. It's certainly still a work in progress, and you're very wise to protect yourself with regular system disk images (as I do), but it's not as 'shady' as you think.

 

[fnf]

I think you'll find that Windows 10 is a lot more stable than you might think. It's certainly still a work in progress, and you're very wise to protect yourself with regular system disk images (as I do), but it's not as 'shady' as you think.

I'm keeping my fingers crossed. In some aspects e.g., user-mode driver Windows is a lot better than either Linux or Mac OS. My best uptime yet is still a mere 10 days. Time will tell if I could get it running for 6 months straight .

 

[weare one]

Thank you all for your replies. I have a few questions if you don’t mind.

1). I did a system restore to the one I manually created the other day and got exactly the same error message as posted above. So something is not working with
system restore on a completely new ssd and windows install.


2). As regards disk imaging, do I partition my ssd drive and put the image there, or put the image (when I find out how) onto a partition on my secondary drive.

 

[fnf]

Thank you all for your replies. I have a few questions if you don’t mind.

1). I did a system restore to the one I manually created the other day and got exactly the same error message as posted above. So something is not working with
system restore on a completely new ssd and windows install.

I'd suggest checking Event Viewer for Ntfs error (event ID 55). If one of the VSS snapshots were corrupted it'd say the following:

A corruption was discovered in the file system structure on volume Windows.

A file system index structure contains entries that violate ordering rules. The file reference number is 0x9000000000009. The name of the file is "<unable to determine file name>". The corrupted index attribute is ":$SII:$INDEX_ALLOCATION". The corrupted subtree is rooted at entry number 57 of the index block located at Vcn 0xd.

The message is not overly helpful but if you check the Detail section it'd say what VSS snapshot was corrupted in the DeviceName e.g., \Device\HarddiskVolumeShadowCopy12 .

If you want to keep using System Restore for recovery, try deleting all corrupted snapshots first from an Admin command prompt/powershell:

vssadmin list shadows

That gives you a list of snapshots, then delete the corrupted snapshots with:

vssadmin delete shadows /shadow=ShadowId

ShadowId can be gotten from the list of snapshots above.

If you're uncomfortable with doing so then it's best to disable System Restore completely and use another backup solution.

2). As regards disk imaging, do I partition my ssd drive and put the image there, or put the image (when I find out how) onto a partition on my secondary drive.

The backup images should stay on another drive, preferably external but a partition in another internal drive is a good start.

 

[weare one]

I'd suggest checking Event Viewer for Ntfs error (event ID 55). If one of the VSS snapshots were corrupted it'd say the following:

Hi fnf

I'm totally unfamiliar with event viewer so the attached screen shot show what I think you are saying.

If not you will have to talk me step by step through the process.... sorry :hammer:

 

[ubuysa]

Hi fnf

I'm totally unfamiliar with event viewer so the attached screen shot show what I think you are saying.

If not you will have to talk me step by step through the process.... sorry :hammer:

View attachment 11984

View attachment 11985

The two errors in the last hour you can discount, they're both (probably) related to MS Office.

The Kernel Power events (id 41) you can probably discount too, they just indicate that Windows was not shutdown properly (so they're a symptom not a cause). Of course, if these happened because Windows crashed and had to be re-started then they're significant, but if you deliberately powered-off without shutting down for example, you'll get these errors.

It would be nice to see the whole of that Error section from Event Viewer, 11 errors in the last 24 hour is a lot and 76 errors in the last 7 days is a lot too. It would be handy to see what was contributing to those errors.

It might be worth you doing a system file scan just as a comfort check, open an elevated command prompt (or elevated PowerShell session) and enter the command 'sfc /scannow' (without the quotes). If that reports no corruptions found then all well and good, if it reports corruptions found but corrected then that's ok too, but if it reports corruptions found but not corrected then let us know (it's not the end of the world).

fnf may have more detail for you.

 

[fnf]

Hi fnf

I'm totally unfamiliar with event viewer so the attached screen shot show what I think you are saying.

If not you will have to talk me step by step through the process.... sorry :hammer:

View attachment 11984

View attachment 11985

Hi weare one, the screenshots you showed were for event ID 41. In Event Viewer's Overview and Summary section (usually what is shown after you open Event Viewer), you can right click on the line that begins with Error and click View All Instances of This Event. It will show you all errors from the most recent ones. Keep looking for the Ntfs Source or Event ID 55 when you scan through the list.

If the VSS snapshots were corrupted then you'll find those, otherwise I'm not sure what else went wrong.

You can also try restoring the system and check Event Viewer for new errors which System Restore might log.

 

[weare one]

Wow lots of tec details coming from you here lads so please bare with me and many thanks :yes:


I always shut down my computer correctly (I'm quite anal about this actually) ever since I took a "computers for dummies course" way back in the early 90's
and no I have not had a windows crash.

Result from "Error and click View All Instances of This Event" shown as 3 x screen shots from Word as to many characters for forum web page and details of scannow photo attached

 

[ubuysa]

Wow lots of tec details coming from you here lads so please bare with me and many thanks :yes:


I always shut down my computer correctly (I'm quite anal about this actually) ever since I took a "computers for dummies course" way back in the early 90's
and no I have not had a windows crash.

That's interesting, and worrying at the same time. These error 41 messages could be caused by the system automatically restarting itself, has that ever happened? When a 'system problem' is detected Windows is configured to automatically restart (and write a memory dump). This is what Microsoft has to say about error 41; https://support.microsoft.com/en-us/help/2028504/windows-kernel-event-id-41-error-the-system-has-rebooted-without-clean.

The sfc /scannow seems to have been worth running since errors in system files was detected and corrected. It will be interesting to see whether that has any effect on your restore point issue.

BTW. Did you buy this PC with Windows pre-installed or did you install your own copy?