Restore dont work - Timeout - The file or directory is corrupted and unreadable. (code: 1392)

chhoffmeister · November 10, 2020, 11:23am

Hi Guys, i need now realy your help.
Situation is that we are hitting by RAnsomware and we try now to restore the last 1-2 weeks, but we are not able to restore the files and folder.
The Situation with Urback is following :
When we try to restore the files and folder from urbackup, it needs every time hours for indexing and we dont know why. We have Disabled all Antivirus and also i have turned off “Calculate file-hashes on the client:” ( Found here in Forum.

When i restore a single file, all works fast but when i try to restore a simple 8 MB Folder with contend, it needs 4 hours for indexing and than the restore starts.

Sometimes the restore works but most time not.
I see follwing at the logfile :

2020-11-10 05:15:35: ERROR: Error while downloading files during restore
2020-11-10 05:15:35: Channel message: LOG 5-0-Restore failed.
2020-11-10 05:15:35: Restore failed.
2020-11-10 05:16:28: Channel message: FILESERV
2020-11-10 05:16:28: FileSrv: Received data…
2020-11-10 05:16:28: FileSrv: Received a Packet.
2020-11-10 05:16:28: FileSrv: Sending script output (normal) urbackup/FILE_METADATA|0MJxVI6MqnsZCuExbkEejdYoV metadata_id=0
2020-11-10 05:16:28: FileSrv: Mapped name: \tmp\mkmergsdfklrzrehmklregmfdkgfdgwretklödf\FILE_METADATA|0MJxVI6MqnsZCuExbkEejdYoV
2020-11-10 05:16:34: Channel message: RESTORE PERCENT pc=2&status_id=2&id=101&details=&detail_pc=-1&total_bytes=7572681004&done_bytes=133318564&speed_bpms=0
2020-11-10 05:16:44: Looking for old Sessions… 1 sessions
2020-11-10 05:17:28: FileSrv: Error: Sending data failed
2020-11-10 05:17:28: FileSrv: Sending script urbackup/FILE_METADATA|0MJxVI6MqnsZCuExbkEejdYoV not finished yet
2020-11-10 05:17:28: FileSrv: Select Error/Timeout in RecvMessage
2020-11-10 05:17:28: FileSrv: Deleting Memory…
2020-11-10 05:17:28: FileSrv: done.
2020-11-10 05:17:34: Channel message: RESTORE PERCENT pc=2&status_id=2&id=101&details=&detail_pc=-1&total_bytes=7572681004&done_bytes=133318564&speed_bpms=0
2020-11-10 05:18:34: Channel message: RESTORE PERCENT pc=2&status_id=2&id=101&details=&detail_pc=-1&total_bytes=7572681004&done_bytes=133318564&speed_bpms=0
2020-11-10 05:19:34: Channel message: RESTORE PERCENT pc=2&status_id=2&id=101&details=&detail_pc=-1&total_bytes=7572681004&done_bytes=133318564&speed_bpms=0
2020-11-10 05:20:34: Channel message: RESTORE PERCENT pc=2&status_id=2&id=101&details=&detail_pc=-1&total_bytes=7572681004&done_bytes=133318564&speed_bpms=0

Info
11/10/20 04:57
Starting restore of path “D\Company Data\CEase\ComputerEase\data”. Waiting for client confirmation…
Errors
11/10/20 05:02
Restore was inactive for 5min. Timeout. Stopping restore…

Found also another issue : The file or directory is corrupted and unreadable. (code: 1392)
Tis is logged at the Client where i want restore the data

2020-11-10 11:49:16: ERROR: Fatal error writing to file in writeFileRepeat. Write error in Chunked File transfer. The file or directory is corrupted and unreadable. (code: 1392)
2020-11-10 11:49:16: ERROR: Error loading “D:\AVG\AVG_Internet_Security_Business_x64_749.exe” ERROR (code: 6)
2020-11-10 11:49:16: ERROR: Error while downloading files during restore

Is anyone out there what can help me please ?
Backup Server is Windows 2012 R2, BITS enabled,

uroni · November 10, 2020, 9:08pm

Usually because you did not click “Yes, start restore” on the client within 5min.

I’d say you need to restore to a different machine? Maybe the ransomeware damaged the file system/installed a driver that prevents restores…

chhoffmeister · November 10, 2020, 10:17pm

Thanks for the answer Uroni,
the timeout is see seconds after clicking Yes, start restore.
By the way it will be nice when you see at the popup also a info what you want restore. ( User Info )
About the Fatal error, we are replacing the disk now, the system is restored from a Backup what we make bevor we get the ransomware infection but you are rigth when you say maybee the ransomware has damaged the file system. The Disk self looks ok at the Raid Management software.
Lets see whats happend when we have replace the disk.

Can you tell me why i get this error
2020-11-09 12:21:17: ERROR: Error truncating file “C:\CEase\ComputerEase\data\1\info.dat” to size 263424. Access is denied. (code: 5)
2020-11-09 12:21:55: ERROR: Error while downloading files during restore
It looks for me that i get a access error at the Server site

chhoffmeister · November 12, 2020, 11:00am

We have now replaced the server but the issues are not solved.
Some BAckup we can restore and some not.
For example there is a 400kb pdf file and we get this error : ( UrBackup Server )

2020-11-12 04:48:10: Channel message: RESTORE PERCENT pc=0&status_id=2&id=216&details=&detail_pc=-1&total_bytes=20753423&done_bytes=3847&speed_bpms=0
2020-11-12 04:48:11: Channel message: LOG 5-2-Error loading “D:\Operations\19th\ADDED TE-3 TO 19TH FLOOR.pdf” ERROR (code: 6)
2020-11-12 04:48:11: Channel message: LOG 5-2-Error while downloading files during restore
2020-11-12 04:48:11: Channel message: LOG 5-0-Restore failed.

At the Client i get this

WARNING: Failed to write to file… waiting… in Chunked File transfer. The file or directory is corrupted and unreadable. (code: 1392)

By the way, i have checked in filesystem the dokument and its there and also its not corrupted. ( UrBackup Srever )