cancel
Showing results for 
Search instead for 
Did you mean: 

backup/restore EFS data

Max_Orlandini
Level 2
I've a problem and I need help...
My BackupExec 9.1 SP4a backup every night a lot of .pst user data files, few of this as encrypted by file system because are copy of portable user and during file system copy WIndows maintain this peculiarity. This encrypted files are accessible from owner and from domain admin.
Today I need to restore a backuped encrypted PST.
Now... BackupExec end with the error:

Final error: 0xa000fe30 - A communications failure has occurred.

Connection to the restore target has been lost. Operation canceled.

and the system event viewer of the server report:

Tipo evento:Errore
Origine evento:Ntfs
Categoria evento:Disk
ID evento:55
Data:23.08.2006
Ora:9.13.23
Utente:N/D
Computer:LYRA
Descrizione:
The file system structure on the disk is corrupt and unusable. Please run the chkdsk utility on the volume D:.

Per ulteriori informazioni, consultare la Guida in linea e supporto tecnico all'indirizzo http://go.microsoft.com/fwlink/events.asp.
Dati:
0000: 0d 00 04 00 02 00 52 00 ......R.
0008: 02 00 00 00 37 00 04 c0 ....7..?
0010: 00 00 00 00 02 01 00 c0 .......?
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 00 00 00 00 00 00 00 ........
0028: 81 01 22 00 ?.".

Tipo evento:Errore
Origine evento:EFS
Categoria evento:Nessuno
ID evento:6030
Data:23.08.2006
Ora:9.13.23
Utente:N/D
Computer:LYRA
Descrizione:
Windows found corrupted Encrypting File System (EFS) data.

This message is logged for one of the following two reasons: there was a hardware or software failure that corrupted the data, or this is a malicious attack. If this is a malicious attack, the user LYRA$ on the domain MANORD is accessing this data.

Domain: MANORD
User: LYRA$

User Action:
If the data corruption is caused by hardware or software failure and you are denied access to the file, use the Encrypted File System Recovery Agent to try to recover the data. If the data is not recoverable, then delete the file.

If this is a malicious attack, change the share permissions so that the user does not have access to the share.

Per ulteriori informazioni, consultare la Guida in linea e supporto tecnico all'indirizzo http://go.microsoft.com/fwlink/events.asp.
Dati:
0000: 01 00 00 00 ....

...so I've you few ideas?
I've launched a chkdsk to drive, reboot the server, relaunch the backup job but the result is the same...

I need to retrieve my PST!

Many thanks for your attention.

Server are Windows 2003 SP1 and Veritas BackupExec 9.1 rev 4691 SP4a
Client are Windows XP SP2
2 REPLIES 2

Max_Orlandini
Level 2
Sorry, I've forget...
I've see Veritas document 267739 (http://support.veritas.com/docs/267739) and related Microsoft KB article 828693, but this problem are pathed with SP1, Microsoft say...

So...

Deepali_Badave
Level 6
Employee
Hello,

Please run the sgmon before running the backup job.

How to create SGMON.LOG
http://seer.support.veritas.com/docs/190979.htm

Regards,

Deepali