On reboot, all files revert to previous versions

Hi all,

There have been a couple threads on this topic on the forums but they have no solutions.

Whenever I reboot, all of my file changes are reverted. Files I deleted are back, files I added are gone, files I modified are reverted to their previous state, programs I installed are gone, programs I uninstalled are back, special reboot tools like checkdisk and mdsched don't take effect on reboot. File changes I make to my slave HDD are not reverted on reboot.

This just started happening the other day.

I ran MalwareBytes, which found some minor issues related to a toolbar, but of course rebooting brings it back. I ran "sfc /scannow." No errors found.

I used a Win7 recovery disk, which found no problems.


Here is my Disk Management screenshot: http://www.develteam.com/userdata/Garmichael/posted/win7forums_diskmanagement.png


One interesting thing, however, that might be part of the issue. When I boot up and open chrome, it opens to my last visited pages, which are for a program called HD Tune, implying to me that the problem started after installing and running this program. All I did with it was a scan, which did find bad bits. Here's a screenshot of that: http://www.develteam.com/userdata/Garmichael/posted/win7forums_hdtunepro.png

Not sure if HD Tune Pro did something to cause this, but I felt it was worth mentioning.

It sounds almost like you are running this:
ToolWiz Time Freeze « ToolWiz Software

I would look and see if it is on your system.

Barring that I would open the Services applet
(Winkey-r and type services.msc)
then scroll down to Shadow copy service.
Stop it if running, then set to disabled.

Make an obvious change to something and reboot.

Thank you for your response. I checked my system for Time Freeze and Deep Freeze, neither of which are installed.

Checked my services for Shadow Copy Service, and it's not even listed.

EDIT: I found "Volume Shadow Copy." I assume this is what you meant? If so, it is not running and is set to 'Manual'

Try setting it to Disabled and perform the test if you would.

I have, and no luck. Also found "Microsoft Shadow Service" which was running, but disabling it didn't do anything either.

I did find out some stuff from sleuthing around all day yesterday.

The problem is not within Windows. I boot to a boot disk, renamed a file, rebooted from the same boot disk, and the file was reverted. I didn't enter my Win7 install at all during this process.

Chkdsk pops an error when it gets about half done with step 2, checking Indexes. It says "An unknown error has occurred."

So I ran HDD Regenerate to find and repair sectors, and it surely did find and repair most of them.. I run the software again, and it confirms that the bad sectors were repaired. However, when I reboot, and rerun the scan, the bad sectors it found previously were back!

So finally, tried running two virus scan tools, Avast and housecall.trendmicro.com. Avast crashes immediately after I open it, and Housecall crashes as soon as I hit Scan.

At this point, I'm not sure if the hard drive is just screwy, or if I have some advanced thinking virus.

What did you make the boot disk from?

It sure sounds like a very crafty virus. Almost like something infected the HD controller. How to test for that I wouldn't know. Perhaps someone may chime in if they've ever encountered something similar. But where you mentioned the browser insisting on going to HDTune I wonder if it's possible some low level action triggered accidentally some side effect. It sure sounds like the HD doesn't want to cooperate.

Edit:

If it were possible to clone the contents to another HD and boot from it may be the only way to tell outside of hiring a technician I'm thinking.

Boot from win7 install dvd->repair computer->command prompt

Now create a small file on C disk. Boot again from same DVD and enter command prompt again. File you created is still there?

I'm thinking this is an SSD thing. This page has a user with Linux but it sounds similar:
Time warp - SSD drive not saving after cold boot/restart - The Corsair User Forums

When I look at my browser history or my administrator event logs, everything stops at the same time, which is about half an hour after I downloaded HD Tune. I ran the error scan right after downloading it, so it seems like the problem started immediately following the scan. Since it was four days ago that I did this, I don't remember if the computer crashed or shut down at all at that time.


The boot disk that I used was FalconFour's Ultimate Boot CD. Kactussoft, I used the boot disk to boot into MiniXP as well as the Windows 7 install repair, and tried the process you requested already on both. The file changes I made were reverted when I booted back up with the boot disk into both environments.


I checked out the thread you linked, MilesAhead, and the problem is exactly the same I'm having. I tried looking for the thread that YellowBeard said to look at but I don't see anything about a sleep/hibernate issue.


The thing that baffles me is that the computer runs absolutely 100% fine otherwise. I'm booted into my Win7 install right now. My browser is working fine. I do indie game dev stuff, and my 3D Studio Max works flawlessly while I have Photoshop and Unity running, both also working flawlessly. I can edit my models, my code, images. I can save them, close them, reopen them, and the changes stay. If I copy my work to my slave drive (a 500GB non-SSD), and reboot, my saved changes remain on that drive. I can use my computer for hours with no problem, no errors, nothing. Everything is running perfectly. Just, when I reboot, my drive time warps.

Honestly, I can't even wrap my ahead around how this is even possible. If I edit a photo and scribble over it and save it, those pixels I drew over should be gone from existence. It reminds me of that movie Groundhog Day, where he breaks a pencil in half and wakes up to find it repaired. This issue destroys everything I understand about data! MY WHOLE WORLD IS ROCKED.

Garmy said:

~~~
If I edit a photo and scribble over it and save it, those pixels I drew over should be gone from existence.
~~~

Click to expand...

Do that while recording everything with Process Monitor.

Any chance you can clone the boot drive to another HD and boot from that? If it's proven conclusively it's only the SSD with the problem at least you can proceed from there.

The first thing I'd try is to see if you can use another drive to get back on the air with your current set of programs. If that works out then you can check into what to do about the SSD as far as warranty or replacement etc..

Edit: I'm no expert on how SSDs work. But someone mentioned they have a 20% capacity surplus and some fast memory for caching etc.. With "spinners" as the SSD guys call conventional HDs, once the file and hardware buffers are flushed to disk, files that have been changed are overwritten etc.. but I think with these SSD jobs the writes are stored in some combination of cache and temporary storage. Then at some point they will commit the write. But there may be some sleight of hand like with the deletions. The newly deleted areas are marked not available until they can be reconditioned or whatnot, for performance purposes.

I may not have the jargon right but the upshot is they just don't write files the way spinners do. For all we know some configuration setting could be reset to factory default and it could all work like new again. It's just we don't know what that is. At least that's the optimistic view.

UsernameIssues said:

Garmy said:

~~~
If I edit a photo and scribble over it and save it, those pixels I drew over should be gone from existence.
~~~

Click to expand...

Do that while recording everything with Process Monitor.

Click to expand...

This is pretty neat.. I had no idea just how much stuff was running behind the scenes. Did you want me to save a log of the save file events and share them? If so, how do I do that? I see almost everything is marked as SUCCESS, except for a few operations marked as BUFFER OVERFLOW and NAME NOT FOUND.

MilesAhead said:

Any chance you can clone the boot drive to another HD and boot from that? If it's proven conclusively it's only the SSD with the problem at least you can proceed from there.

The first thing I'd try is to see if you can use another drive to get back on the air with your current set of programs. If that works out then you can check into what to do about the SSD as far as warranty or replacement etc..

Click to expand...

Unfortunately, I don't have another drive I can do this with.

You can use File > Save.

Just leave everything at the default save settings.

Compress/zip using Windows (file) Explorer and see if it is small enough to upload to a post. If it is too big, we can work on some filtering,

Here's the PML: http://www.develteam.com/userdata/Garmichael/posted/Logfile.zip

I opened MSPaint and opened the photo, then opened Procmon, then scribbled on the image, saved it, closed MSPaint, and then stopped the logging with Control+E in Procmon, then saved the output of it.

Thanks for the log file. I'll look thru it in a little while. In the mean time, please do the same thing to a test photo while in the safe mode. Just the normal safe mode - not the safe mode with networking or any other things.

http://www.sevenforums.com/tutorials/69585-safe-mode.html


edit:
You can record with Process monitor if you want...
...but I was mainly wondering if the file changes stick if in the safe mode.

No, the changes don't stick in safe mode. Edit: Btw, the changes (in both boot modes) stick UNTIL I reboot. So if I save the altered photo and close it, reopening it will retain the changes, until I reboot.

Garmy said:

No, the changes don't stick in safe mode. Edit: Btw, the changes (in both boot modes) stick UNTIL I reboot. So if I save the altered photo and close it, reopening it will retain the changes, until I reboot.

Click to expand...

Thanks... I was hoping to see some process anomaly that explained why that is. If the clue is in that Process Monitor log file, I'm not seeing it :-(

The fact that you cannot make a change stick while using another OS (e.g. booting to something other than the OS on the drive) points to a weird hardware issue....... but you knew that

Either HD Tune barfed something during that scan or this weirdness was going to happen anyway.

You should probably turn your attention to running diagnostics on that drive. But that is not my area; so, I'll let the hardware guys help you (if you need help).

Thank you for pouring over my process log.

I've done some more research and found many posts on forums by googling "SSD Time Warp" and "SSD Groundhog Day." I guess it's a somewhat common thing. The only fix I could find was to update the firmware (which I can't find for this drive), but almost all of these threads go unsolved. I guess it's just a thing with SSD's. I'm going to order a new drive, but it would a shame to toss this one out if there's a fix for it.

Keep us posted

Reboot from some linux live cd and put a few files on the disk. Those files are gone as well after reboot?