Phantom file causing Win7 backup error

I use Windows 7 backup on Win 10 and since January I have been getting this error after backups complete -

Backup encountered a problem while backing up file E:\MyDocuments\Photographs\2006-04-02-1959-55\. Error:(STATUS_WAIT_2 (0x80070002))

This directory? does not exist. It no longer seems to exist anywhere. I probably moved all the contents to other subdirectories or deleted them if they were duplicates (which I think was the case).

I remember doing some housekeeping moving directories after Lightroom put some new files in the wrong place at Christmas time-ish.

Are there any Windows tools that reveal more metadata about a directory ?. I assume that there is a corruption in the \Photographs directory.

Andrew

Reply to
Andrew
Loading thread data ...

This is a "known" issue on machines upgraded from earlier versions, although the causes seem a bit varied and nebulous.

First thing I would try is a disk check operation to fix any disk corruption problems.

The look where the folder should be and make sure you have the view options set to show hidden and system files. It might be it is there but just not visible normally.

You could check for windows file corruption - from an admin command prompt:

DISM /Online /Cleanup-Image /ScanHealth SFC /scannow

If that does not help, search the registry for that suspect path - see if it shows up anywhere.

Some people find they get the problem due to a left over default user account created during the upgrade. Rebotting to safe mode, and using control panel User Accounts app to look at all the accounts, and delete (and its file) one called DefaultUser0 if it is there.

If none of that does it then you can start getting a bit deeper. Grab a copy of procmon from live.sysinternals.com and set it to log file access. Run the backup. It will log exactly what tried to access that folder and why it failed etc.

Reply to
John Rumm

.\Err_6.4.5.exe 80070002

# No results found for hex 0x4c5c572 / decimal 80070002 # for hex 0x80070002 / decimal -2147024894 COR_E_FILENOTFOUND corerror.h DIERR_NOTFOUND dinput.h DIERR_OBJECTNOTFOUND dinput.h STIERR_OBJECTNOTFOUND stierr.h DRM_E_WIN32_FILE_NOT_FOUND windowsplayready.h E_FILE_NOT_FOUND wpc.h # as an HRESULT: Severity: FAILURE (1), FACILITY_NTWIN32 (0x7), Code 0x2 # for hex 0x2 / decimal 2 STATUS_WAIT_2 ntstatus.h <=== bogus? # as an HRESULT: Severity: FAILURE (1), FACILITY_WIN32 (0x7), Code 0x2 ERROR_FILE_NOT_FOUND winerror.h <=== good enough # The system cannot find the file specified. # 8 matches found for "80070002"

*******

This article thinks it is Library related. Maybe Lightroom involved the usage of a Library like Photos.

formatting link
formatting link
The control file for a library, has an extension of .library-ms and is an XML file. C:\Users\paul\AppData\Roaming\Microsoft\Windows\Libraries allows you to examine a library for its membership list.

If you look there, you might well find your E:\ orphan entry.

File 29673 \Users\paul\AppData\Roaming\Microsoft\Windows\Libraries\Pictures.library-ms

File 30971 \Users\Public\Libraries\RecordedTV.library-ms

File 99420 \Users\paul\AppData\Roaming\Microsoft\Windows\Libraries\Videos.library-ms

File 99467 \Users\paul\AppData\Roaming\Microsoft\Windows\Libraries\Music.library-ms

File 100770 \Users\paul\AppData\Roaming\Microsoft\Windows\Libraries\CameraRoll.library-ms

File 100776 \Users\paul\AppData\Roaming\Microsoft\Windows\Libraries\SavedPictures.library-ms

File 101728 \Users\paul\AppData\Roaming\Microsoft\Windows\Libraries\Documents.library-ms

*******

You can use cmd.exe and issue the copy command and change the file extension. Since the files can be in usage, they may present a challenge if the OS is running.

copy Documents.library-ms D:\bonzo.txt

notepad D:\bonzo.txt

Pointers to directories consist of two types. "Well known locations" and custom locations. Whereas most of us think of all the locations as custom, Microsoft have to be squirrels about this.

formatting link
Known Folder GUID...

Documents FDD39AD0-238F-46AF-ADB4-6C85480369C7

You can see my first location is a known folder and is a Documents folder. My second folder is recorded in base64 (maybe). It's taking me too long to get one of these shelllinks to do something, so I haven't got the format right.

<?xml version="1.0" encoding="UTF-8"?> <libraryDescription xmlns="
formatting link
"> <name>@shell32.dll,-34575</name> <ownerSID>S-1-5-21-3768549767-1934788099-1503758287-1000</ownerSID> <version>11</version> <isLibraryPinned>true</isLibraryPinned> <iconReference>imageres.dll,-1002</iconReference> <templateInfo> <folderType>{7d49d726-3c21-4f05-99aa-fdc2c9474656}</folderType> </templateInfo> <propertyStore> <property name="HasModifiedLocations" type="boolean"><![CDATA[true]]></property> </propertyStore> <searchConnectorDescriptionList> <searchConnectorDescription publisher="Microsoft" product="Windows"> <description>@shell32.dll,-34577</description> <isDefaultSaveLocation>true</isDefaultSaveLocation> <simpleLocation> <url>knownfolder:{FDD39AD0-238F-46AF-ADB4-6C85480369C7}</url> <serialized>MBAAAEAFCAAAAAAAADAAAAAAA....YAgAAEAw7+ <=== base64 shelllink <???>

Paul

Reply to
Paul

Nice find, that tool!

formatting link

Reply to
Adrian Caspersz

If you have an "E" drive what about creating that directory to see what happens?

Reply to
Jeff Gaines

Actually the directory 2006-04-02-1959-55 does exist in the location where it should be (I didn't notice it), but not where Win 7 backup thinks it exists, and there are four files according to Windows, but only three actual photo files in it, -

Directory created 2/4/2006 20:02, modified 22/5/2010 13:01

I can see all three .jpg pictures without errors.

All three photos have the same creation date as the directory because they were uploaded by Lightroom V3/4 from my Caplio GX8. I have set up Lightroom to create a new directory for each unique date of taking.

I don't use Windows Libraries for my photos, they all just live in subdirectories under E:\MyDocuments\Caplio for historical reasons.

Reply to
Andrew

The error looks like Scenario Number 1, but I do not back up Libraries, I simply say backup everything under E:\MyDocuments even if some of those physical directories have also been added to a Windows Library.

I use Windows Libraries but I haven't made any changes to Windows Libraries for a long time. Lightroom has its own SQL? data structures and Libraries.Not sure how they interact with Windows.

When I upload new photos they normally end up in one or more new directories under MyDocuments\Caplio.

I forgot to mention that the 'missing' directory exists where it should be, in E:\MyDocuments\Caplio. I seem to remember that some directories ended up in E:\MyDocuments\Photographs by mistake and I have probably moved them to the correct \Caplio directory at some point.

Reply to
Andrew

A library has a "Default directory".

When a file is dropped onto a Library, it is stored in the Default directory.

As far as I know, nothing would prevent you from navigating separately to Caplio and adding the file.

Paul

Reply to
Paul

Hi Paul

The offending directory is in E:\MyDocuments\Caplio\2006-etc but I cannot remember if it ever was located under E:\Mydocuments\Photographs\2006-etc, meaning I must have cut and pasted it into the \Caplio directory at some point. The photos were taken with my Caplio GX8 and I normally use Lightroom V4 to import them and it creates a new subdirectory for each new date it discovers in the camera, but not in the format CCYY-MM-DD-NNNN-NN, so I am not sure how these photos were imported. Maybe I used Win7 to import them for some reason, probably using an SD card reader/hub that I used to possess.

I do remember doing some cleanup tasks in recent months which is when the sub-directory could have been moved.

I only back up physical directories with Win7 backup, not Microsoft Libraries. On the "what do you want to back up" screen None of the Libraries under "data Files" are ticked. I only tick the necessary boxes under My Computer E:\for backing up.

I feel that by moving this sub-directory I have confused the logic that detects files that have changed. Not only that but the January

31st backup too a long time and was backing up old photos that I have not even looked at for over 10 years yet Windows backup thought they had changed. Some or process must have 'touched' them in some way.

Andrew

Reply to
Andrew

Files have "attribute" bits.

******* File attributes can be read with fsutil usn readdata Y:\Windows\Logs\CBS\CBS.log

Constants - the following attribute values are returned by the GetFileAttributes function:

FILE_ATTRIBUTE_READONLY = 1 (0x1) \ FILE_ATTRIBUTE_HIDDEN = 2 (0x2) \___ These are classic ones from the "DOS" era FILE_ATTRIBUTE_SYSTEM = 4 (0x4) / The "dir" command has selectors for these.

FILE_ATTRIBUTE_DIRECTORY = 16 (0x10) FILE_ATTRIBUTE_ARCHIVE = 32 (0x20) <=== might be used by a backup program, not sure FILE_ATTRIBUTE_NORMAL = 128 (0x80) FILE_ATTRIBUTE_TEMPORARY = 256 (0x100) FILE_ATTRIBUTE_SPARSE_FILE = 512 (0x200) FILE_ATTRIBUTE_REPARSE_POINT = 1024 (0x400) FILE_ATTRIBUTE_COMPRESSED = 2048 (0x800) <=== an attribute for "old compressed", a reparse point for "new style compress" FILE_ATTRIBUTE_OFFLINE = 4096 (0x1000) FILE_ATTRIBUTE_NOT_CONTENT_INDEXED = 8192 (0x2000) FILE_ATTRIBUTE_ENCRYPTED = 16384 (0x4000) <=== EFS? Probably not related to Bitlocker

*******

So that is potentially a way to track an activity, in addition to simple usage of dates like last accessed or modified.

For the people who design software, they are familiar with the issue of two programs messing with the same recording facility. There are other ways to mark files, such as Alternate Streams. And the nice thing about Alternate Streams, is "you can have so many". If twenty backup programs wanted to do that, your file would get bogged down with twenty Alternate Streams. When you download a file with a web browser, it is marked with an Alternate Stream that helps declare the file as "unsafe", because of where it came from.

And if Microsoft doesn't have a utility for it, Sysinternals has one (Streams.exe , Junction.exe).

Paul

Reply to
Paul

You should be working with a copy of NFI.exe , to get a better idea of what is on E: . NFI.exe is a pretty old utility, but it's still useful, even if it needs a bit of work. For hardlinked files, it does not list the second filename the file is using. This affects forensics involving WinSxS and System32 items, but is unlikely to affect your search for your photos and their info.

*******

formatting link
In an Administrator Command Prompt window, run something like:

cd /d C:\users\andrew\Downloads\ # presumed location of unpacked nfi.exe

nfi.exe e: > nfi_E_out.txt # the hidden attribute does not prevent # you from seeing the fourth photo file # You can see System Volume Information entries too.

notepad nfi_E_out.txt # search for your pictures in here

Paul

Reply to
Paul

HomeOwnersHub website is not affiliated with any of the manufacturers or service providers discussed here. All logos and trade names are the property of their respective owners.