Author Topic: Registry Backup Beta (Read 358953 times)

Tomas_Sweden · « **Reply #225 on:** July 04, 2012, 12:39:32 am »

I think it's a good idea to be able to name each backup!

My first impression was that I didn't understand where do I find the "Backup Name" after I have done a backup? But have you done some backups it becomes obvious! (That it's under "Combo Box" in "Select Backup To Restore" under the tab "Restore Registry")

But for some it might be a bit confusing with "Backup Name" - What should I write here? Maybe you can write a brief description on the right like: "This is most for advanced users who wants to rename the "Backup Name" so they easier can distinguish between different backups, for a normal user leave it as it is, works just as well".

Tomas

eltiburon · « **Reply #226 on:** July 04, 2012, 11:15:05 am »

Hi Shane,
That's pretty quick work! I fired up the new app and successfully entered, saved, and restored a Registry Backup name selection. I like it.

One observation though; after I restore the registry via the Registry Backup GUI, you display a message indicating that the sytem needs to be restarted before the restored registry items can be accessed. Okay, I bring Win7 down gracefully and select Restart; Win7 restarts and after I log on to Win7, there is no indication that the Restore operation succeeded or failed. I took a look at the "Log_Restore.txt" file for the selected restore point and it appears that all of the registry files were correctly restored.

After a Restart and a successful login to Win7, perhaps you can display some sort of popup message indicating that the "Registry Backup Restore operation was successful (or failed)" Or something similar. The Win7 Backup/Restore function currently displays an informative message regarding the restore success/failure on Restart and login. This definitely puts me at ease.

I prefer your product over the Win7 Backup/Restore application.

I'll keep testing and keep you informed.

eltiburon

peterr · « **Reply #227 on:** July 04, 2012, 11:24:49 am »

I am also appreciating the reg program you created.
However,I too would feel better if like Win system restore there is a fail or succeed indication tha at truly reflects the status of the operstion.
Peter

>>After reading your reply then taking a closer look, the way it is, says it all, and I am pleased and grateful.
Peter

Shane · « **Reply #228 on:** July 04, 2012, 12:38:01 pm »

Quote

After a Restart and a successful login to Win7, perhaps you can display some sort of popup message indicating that the "Registry Backup Restore operation was successful (or failed)" Or something similar. The Win7 Backup/Restore function currently displays an informative message regarding the restore success/failure on Restart and login. This definitely puts me at ease.

Quote

However,I too would feel better if like Win system restore there is a fail or succeed indication tha at truly reflects the status of the operstion.

The program would actually tell you if it failed before the reboot. If you noticed it will say restore successful on the program window and then ask for the reboot.

Here is how the restore works

Restoring the main system registry files is done with a Windows API RegReplaceKey. The API takes the reg file and moves it to the reg folder and rename the others. It is set to use them at next boot. If the API fails doing this it tells my program.

The profile reg files are restored a different way and no way to really keep track of them.

I use the MoveFileEx API which in turn stores the files to be moved at boot here
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\PendingFileRenameOperations

Again if any of the API calls failed the program would have told you before the reboot

The only way the program would be able to tell if the restore worked after the reboot would be to first write something to each reg section before the restore and then after reboot see if the temp key it made is gone since it should have been replaced from the backup.

I would then need to make another small exe and have it set to run once at the next boot to read the reg to let you know if it worked or not.

I was hoping the program letting you know before the reboot would be good enough lol

Shane

eltiburon · « **Reply #229 on:** July 04, 2012, 07:08:30 pm »

The reason I am concerned about the success/failure of the registry restore is that Win7 sometimes displays a message after a Restart/Win7 log on indicating that the Restore failed. I then restart Win7 in SafeMode and run the Win7 Backup/Restore application; a message displays indicating that I must Restart the system. After a successful Restart/Win7 log on, a popup message displays indicating that the Restore operation was successful.

I guess I'm bewildered as to why Win7 Backup/Restore sometimes works in regular mode and sometimes it requires SafeMode. I was trying to visualize how your program fits into this scenario and if there would ever be any instances where your Registry Backup application would fail in restoring any "locked"(?) registry keys and thus require SafeMode to run your Registry Backup application.

I do have Win7 Backup/Restore configured to "Restore system settings and previous versions of files". Perhaps Win7 is unable to restore a previous version of a file because of exclusive use while a normal user is logged in. Since SafeMode uses a vanilla file system, the user files are no longer in use and can be restored successfully.

It seems that your Registry Backup application is mainly focused on registry and profile items. That's what I'm looking for! Your successful files copied message then reboot request should be quite adequate.

eltiburon

Shane · « **Reply #230 on:** July 05, 2012, 12:49:51 pm »

Yeah Windows restore will fail if it has any trouble restoring any files.

Since my program only does the registry and nothing else it doesn't run into that problem. The registry is locked and in use all the time, so that is taken into account when restoring

I will put the new version out this Sunday. So if you see anything to tweak on the new feature let me know

Shane

neroilo · « **Reply #231 on:** July 08, 2012, 12:38:54 pm »

I did a backup with v1.2.1 before to apply a registry tweak (disablefullrowselect.reg).
The problem is that I restored "successfully" this backup with the restore button on Windows, but I can still see all modified entries at their place.

For example, if I load as hive my backup version of ntuser.dat in regedit, FullRowSelect entry is not present. But I can still see it after the restore in HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced.

For me it seems an unsuccessful restore, but for the program is a successful restore.

Windows 7 x64.

Shane · « **Reply #232 on:** July 08, 2012, 12:42:17 pm »

When you did the restore did you reboot?

Also did you only restore the one reg file or all of them?

Can you also post the restore log?

Shane

neroilo · « **Reply #233 on:** July 08, 2012, 12:45:15 pm »

Quote from: Shane on July 08, 2012, 12:42:17 pm

When you did the restore did you reboot?

Also did you only restore the one reg file or all of them?

Can you also post the restore log?

Shane

1) Yes, of course.
2) All of them.
3)

Code: [Select]

[08/07/2012 - 21:17:44] Starting Restore...

[08/07/2012 - 21:17:44] Backup Location: D:\BACKUP\Sync\Registry\

[08/07/2012 - 21:17:44] Files To Restore: 
[08/07/2012 - 21:17:44] --------------------------------------------------------------------------------
[08/07/2012 - 21:17:44] To: C:\Windows\System32\Config\default
[08/07/2012 - 21:17:44] From: D:\BACKUP\Sync\Registry\NEROILO-W7\08.07.2012_19.48.51\C\Windows\System32\Config\default

[08/07/2012 - 21:17:44] To: C:\Windows\System32\Config\sam
[08/07/2012 - 21:17:44] From: D:\BACKUP\Sync\Registry\NEROILO-W7\08.07.2012_19.48.51\C\Windows\System32\Config\sam

[08/07/2012 - 21:17:44] To: C:\Windows\System32\Config\security
[08/07/2012 - 21:17:44] From: D:\BACKUP\Sync\Registry\NEROILO-W7\08.07.2012_19.48.51\C\Windows\System32\Config\security

[08/07/2012 - 21:17:44] To: C:\Windows\System32\Config\software
[08/07/2012 - 21:17:44] From: D:\BACKUP\Sync\Registry\NEROILO-W7\08.07.2012_19.48.51\C\Windows\System32\Config\software

[08/07/2012 - 21:17:44] To: C:\Windows\System32\Config\system
[08/07/2012 - 21:17:44] From: D:\BACKUP\Sync\Registry\NEROILO-W7\08.07.2012_19.48.51\C\Windows\System32\Config\system

[08/07/2012 - 21:17:44] To: C:\Users\NEROILO\AppData\Local\Microsoft\Windows\UsrClass.dat
[08/07/2012 - 21:17:44] From: D:\BACKUP\Sync\Registry\NEROILO-W7\08.07.2012_19.48.51\C\Users\NEROILO\AppData\Local\Microsoft\Windows\UsrClass.dat

[08/07/2012 - 21:17:44] To: C:\Users\NEROILO\ntuser.dat
[08/07/2012 - 21:17:44] From: D:\BACKUP\Sync\Registry\NEROILO-W7\08.07.2012_19.48.51\C\Users\NEROILO\ntuser.dat

[08/07/2012 - 21:17:44] To: C:\Users\Default User\ntuser.dat
[08/07/2012 - 21:17:44] From: D:\BACKUP\Sync\Registry\NEROILO-W7\08.07.2012_19.48.51\C\Users\Default User\ntuser.dat

[08/07/2012 - 21:17:44] To: C:\Users\Default\ntuser.dat
[08/07/2012 - 21:17:44] From: D:\BACKUP\Sync\Registry\NEROILO-W7\08.07.2012_19.48.51\C\Users\Default\ntuser.dat

[08/07/2012 - 21:17:44] To: C:\Windows\ServiceProfiles\LocalService\ntuser.dat
[08/07/2012 - 21:17:44] From: D:\BACKUP\Sync\Registry\NEROILO-W7\08.07.2012_19.48.51\C\Windows\ServiceProfiles\LocalService\ntuser.dat

[08/07/2012 - 21:17:44] To: C:\Windows\ServiceProfiles\NetworkService\ntuser.dat
[08/07/2012 - 21:17:44] From: D:\BACKUP\Sync\Registry\NEROILO-W7\08.07.2012_19.48.51\C\Windows\ServiceProfiles\NetworkService\ntuser.dat

[08/07/2012 - 21:17:44] --------------------------------------------------------------------------------

[08/07/2012 - 21:17:44] Restoring Files...: 
[08/07/2012 - 21:17:44] --------------------------------------------------------------------------------
[08/07/2012 - 21:17:44] Restoring File: C:\Windows\System32\Config\default
[08/07/2012 - 21:17:44] C:\Windows\temp\reg_restore\C\Windows\System32\Config\default
C:\Windows\System32\Config\default.old
[08/07/2012 - 21:17:44] Result: Successful - C:\Windows\System32\Config\default

[08/07/2012 - 21:17:44] Restoring File: C:\Windows\System32\Config\sam
[08/07/2012 - 21:17:44] C:\Windows\temp\reg_restore\C\Windows\System32\Config\sam
C:\Windows\System32\Config\sam.old
[08/07/2012 - 21:17:44] Result: Successful - C:\Windows\System32\Config\sam

[08/07/2012 - 21:17:44] Restoring File: C:\Windows\System32\Config\security
[08/07/2012 - 21:17:44] C:\Windows\temp\reg_restore\C\Windows\System32\Config\security
C:\Windows\System32\Config\security.old
[08/07/2012 - 21:17:44] Result: Successful - C:\Windows\System32\Config\security

[08/07/2012 - 21:17:44] Restoring File: C:\Windows\System32\Config\software
[08/07/2012 - 21:17:45] C:\Windows\temp\reg_restore\C\Windows\System32\Config\software
C:\Windows\System32\Config\software.old
[08/07/2012 - 21:17:45] Result: Successful - C:\Windows\System32\Config\software

[08/07/2012 - 21:17:45] Restoring File: C:\Windows\System32\Config\system
[08/07/2012 - 21:17:46] C:\Windows\temp\reg_restore\C\Windows\System32\Config\system
C:\Windows\System32\Config\system.old
[08/07/2012 - 21:17:46] Result: Successful - C:\Windows\System32\Config\system

[08/07/2012 - 21:17:46] Restoring  File: C:\Users\NEROILO\AppData\Local\Microsoft\Windows\UsrClass.dat
[08/07/2012 - 21:17:46] C:\Windows\temp\reg_restore\C\Users\NEROILO\AppData\Local\Microsoft\Windows\UsrClass.dat
C:\Users\NEROILO\AppData\Local\Microsoft\Windows\UsrClass.dat.old
[08/07/2012 - 21:17:46] Result: Successful - C:\Users\NEROILO\AppData\Local\Microsoft\Windows\UsrClass.dat

[08/07/2012 - 21:17:46] Restoring  File: C:\Users\NEROILO\ntuser.dat
[08/07/2012 - 21:17:46] C:\Windows\temp\reg_restore\C\Users\NEROILO\ntuser.dat
C:\Users\NEROILO\ntuser.dat.old
[08/07/2012 - 21:17:46] Result: Successful - C:\Users\NEROILO\ntuser.dat

[08/07/2012 - 21:17:46] Restoring  File: C:\Users\Default User\ntuser.dat
[08/07/2012 - 21:17:46] C:\Windows\temp\reg_restore\C\Users\Default User\ntuser.dat
C:\Users\Default User\ntuser.dat.old
[08/07/2012 - 21:17:46] Result: Successful - C:\Users\Default User\ntuser.dat

[08/07/2012 - 21:17:46] Restoring  File: C:\Users\Default\ntuser.dat
[08/07/2012 - 21:17:46] C:\Windows\temp\reg_restore\C\Users\Default\ntuser.dat
C:\Users\Default\ntuser.dat.old
[08/07/2012 - 21:17:46] Result: Successful - C:\Users\Default\ntuser.dat

[08/07/2012 - 21:17:46] Restoring  File: C:\Windows\ServiceProfiles\LocalService\ntuser.dat
[08/07/2012 - 21:17:46] C:\Windows\temp\reg_restore\C\Windows\ServiceProfiles\LocalService\ntuser.dat
C:\Windows\ServiceProfiles\LocalService\ntuser.dat.old
[08/07/2012 - 21:17:46] Result: Successful - C:\Windows\ServiceProfiles\LocalService\ntuser.dat

[08/07/2012 - 21:17:46] Restoring  File: C:\Windows\ServiceProfiles\NetworkService\ntuser.dat
[08/07/2012 - 21:17:46] C:\Windows\temp\reg_restore\C\Windows\ServiceProfiles\NetworkService\ntuser.dat
C:\Windows\ServiceProfiles\NetworkService\ntuser.dat.old
[08/07/2012 - 21:17:46] Result: Successful - C:\Windows\ServiceProfiles\NetworkService\ntuser.dat

[08/07/2012 - 21:17:46] --------------------------------------------------------------------------------

Shane · « **Reply #234 on:** July 08, 2012, 12:46:27 pm »

In your profile you should see a ntuser.old

Is it there?

Shane

neroilo · « **Reply #235 on:** July 08, 2012, 12:50:43 pm »

Quote from: Shane on July 08, 2012, 12:46:27 pm

In your profile you should see a ntuser.old

Is it there?

Shane

I see two files, ntuser.dat and ntuser.dat.BAK.

Shane · « **Reply #236 on:** July 08, 2012, 12:53:09 pm »

Sorry .bak lol

What is the date and time on it compared to the restored one?

Shane

neroilo · « **Reply #237 on:** July 08, 2012, 01:01:29 pm »

ntuser.dat
Creation date: ‎may 25th ‎2012, ‏‎15:43:55 Last edit: Today july 8th ‎2012, ‏‎1 minute ago Last access: Today july 8th ‎2012, ‏‎40 minutes ago

ntuser.dat.BAK
Creation date: ‎may 25th ‎2012, ‏‎15:43:55 Last edit: Tuesday june 5th ‎2012, ‏‎22:49:55 Last access: Tuesday june 5th ‎2012, ‏‎22:49:55

‎

Shane · « **Reply #238 on:** July 08, 2012, 01:03:39 pm »

Thats why the resotr didnt take.

The program should delete the bak file.

Then it adds the rename and move operation for the next system boot. But if the bak file is already there it will fail.

Remove the bak file and then do the restore. Let me know if it works.

If it does I need to put some better handling or at least reporting if it fails to delete the bak file.

When you reboot you should see a new bak file

Shane

neroilo · « **Reply #239 on:** July 08, 2012, 01:17:33 pm »

I have NTUSER.DAT.BAK also in:

C:\Windows\ServiceProfiles\NetworkService
C:\Windows\ServiceProfiles\LocalService

and three log files in all of them (NTUSER.DAT.LOG, NTUSER.DAT.LOG1, NTUSER.DAT.LOG2)

Can I delete them from those folders?

Shane · « **Reply #240 on:** July 08, 2012, 01:19:05 pm »

The .bak are the old registry files before the restore. They are safe to delete.

The log files Windows creates, so dont delete them

Like I said my program should be deleting them before each restore, unless they where locked for some reason.

Shane

neroilo · « **Reply #241 on:** July 08, 2012, 01:24:29 pm »

Quote from: Shane on July 08, 2012, 01:19:05 pm

The .bak are the old registry files before the restore. They are safe to delete.

The log files Windows creates, so dont delete them

Like I said my program should be deleting them before each restore, unless they where locked for some reason.

Shane

I have also:

C:\Windows\System32\Config\default.bak
C:\Windows\System32\Config\sam.bak
C:\Windows\System32\Config\security.bak
C:\Windows\System32\Config\software.bak
C:\Windows\System32\Config\system.bak

One minute, and I'll let you know.

neroilo · « **Reply #242 on:** July 08, 2012, 01:34:02 pm »

It didn't work, I'm afraid.

I have no bak file this time, but the music didn't change.

My registry tweaks are still there.

Shane · « **Reply #243 on:** July 08, 2012, 01:35:22 pm »

Any bak files in the system32/config?

Shane

neroilo · « **Reply #244 on:** July 08, 2012, 01:38:02 pm »

Quote from: Shane on July 08, 2012, 01:35:22 pm

Any bak files in the system32/config?

Shane

No more bak there, but only old files:

C:\Windows\System32\Config\default.old
C:\Windows\System32\Config\sam.old
C:\Windows\System32\Config\security.old
C:\Windows\System32\Config\software.old
C:\Windows\System32\Config\system.old

Shane · « **Reply #245 on:** July 08, 2012, 01:39:53 pm »

God I shouldnt be on here today, to damn tired lol

My program does make the .old files. Erunt does the .bak files lol

Ok so the main reg keys restored but not the user profiles.

This time restore the user profiles but not the system reg files and let me know how it goes

Shane

neroilo · « **Reply #246 on:** July 08, 2012, 01:52:34 pm »

Quote from: Shane on July 08, 2012, 01:39:53 pm

This time restore the user profiles but not the system reg files and let me know how it goes

Restoring only the user profiles I solved my issue. Now all restored files have their old files.
I can't imagine how much work it will be required for you to fix it in a new release.

Anyway, thank you for your support. You're very kind, as always.

Shane · « **Reply #247 on:** July 08, 2012, 01:54:19 pm »

Odd. On my system I can restore them all at once.

The main files are done then the profiles are added to the reg to do the moves and renames.

On my system Windows puts those regkeys in the new reg files. But on yours it wasn't and so the move operation was being stored in the old ones that where being replaced.

hhhmmm how to handle this one.

Shane

neroilo · « **Reply #248 on:** July 08, 2012, 02:20:21 pm »

Sorry to disturb you again, but I have just another doubt.

I loaded ntuser.dat as hive in regedit, but I can't find any Volatile Environment subkey, as you can see in this image:
http://s11.postimage.org/tvay0f2vn/hive_vs_restored.png

Is it normal to not have this subkey in my backupped ntuser.dat?

Shane · « **Reply #249 on:** July 08, 2012, 02:25:43 pm »

Correct.

Volatile means they are temp stored there.

Quote

All registry keys that are created as volatile, and the information is stored in memory and is not preserved when the corresponding registry hive is unloaded

Shane