Veeam Backup Files are Unavailable

Gillware’s technicians are experts in Data Recovery and we have been in business since 2004. We have some of the very best data scientists and data experts in-house, and many of the team have been with us since the very beginning.

Are you experiencing issues with your Veeam Backup? Do you have corrupted restore points or a broken backup chain? Is your Veeam Repository offline? Is your backup software missing important files? Or are you having issues with a virtual disk?

Gillware is here to help.

As part of our business model, we don’t charge any fees for our data recovery evaluations. In fact, we only charge for our data recovery efforts after we’ve successfully recovered your most important files! With our ISO-5 Class 100 cleanroom workstations and GSA-contracted facilities, you can rest easy knowing there’s no safer place for your data. If you need to fix a broken backup chain, missing restore points, or some other problem with your Veeam backup replication, talk to Gillware today!

How Do I Troubleshoot a Veeam Backup?

One particular Veeam error message that our clients frequently contact us with is the “Backup Files are Unavailable” message. This happens when attempting to restore a virtual machine from a broken backup chain. The Veeam configuration database identifies the backup job and the restore points, yet the restore fails. This is a strange error that often appears without warning, and amending the backup job settings has zero effect.

To start, check backup repository lists and select a different restore point and see if you encounter the same error. You may be prompted to “select all unavailable backups” or “fix backup chain” during this process, but the restore will always fail.

Put Veeam into maintenance mode and check numerous earlier available restore points to see if you have the same problem. Hopefully, the VM restore continues with the backup chain starting with one of the more recent restore points even if the last backup is corrupt.

If you are able to work from this restore point and the corrupt restore point is not important, you can right-click the missing restore points in maintenance mode, hover over “Forget” and select “This and dependent backups.” By selecting “This and dependent backups,” you will remove records about missing restore points in the broken backup chain, but hopefully, you have identified new restore points that will work for you.

Alternatively, if you don’t want to just remove the selected restore point, you can select “All unavailable backups” for removal. If you select “All unavailable backups” from the “Forget” menu, you will remove any missing restore points from the backup chain, starting over with only restore points that are accessible for Veeam backup replication. However, if you are still getting the same problem with other restore points, we will need to dig deeper in order to fix broken backup chain problems.

A broken chain backup occurs when you have full backups with several incremental restore points that are either missing incremental files or have corrupted incremental data. You must determine if you are using reverse incremental backups or a standard incremental following an initial incremental image. You can find whether you are using reverse incremental backups in the Veeam Console under the backup chain section.

Generally, this error will occur with a reverse incremental backup (a slow backup compared to other methods); if the backup chain happens to miss incremental files, you will see the following error. The “Backup files are unavailable” error message relates to damaged incremental files. Damage can be caused by hardware failure, failed disks, a failed Veeam SQL instance, and so on. All files in an incremental backup create a backup chain. If you lose a piece of this backup chain, it can corrupt the restore points, essentially destroying your full backup and making Veeam backup replication impossible.

How Do I Troubleshoot a Veeam Broken Backup Chain?

The first fix for a broken backup chain is to rescan the backup infrastructure so that it can reconnect and check backup repository options. To do this, navigate to the Backup Repository page of the Veeam console and find the backup repository giving the same error, right-click, and select the re-scan button. If this method to fix broken backup chain errors does not work, there might be something more sinister going on.

Check the backup job log and the restore log to see if a VIB file exists (or not). (VIB file is short for Veeam Incremental Backup). If the VIB file is missing, the root cause is always going to be related to the Storage Repository.

To diagnose the issue and fix broken backup chain errors, select the virtual backups of the VM you want to restore, right-click, then select properties. It’s likely incremental restore points will be unavailable (grayed out). The only restore point available should be the Full Backup.

To recover the broken chain, you can ‘forget’ or ‘delete’ the missing incremental files on the chain, which will remove records about missing restore points from your backup chain. Be warned that if you remove records about missing restore points, you may suffer data loss and missing files from restore points in the broken chain that you delete. Removing the missing files/corrupted files from the backup can recover the broken chain and get you some (hopefully all) of your data back.

How Do I Fix the Veeam Backup and Replication Backup Chain?

If potential data loss is not something you can risk, Gillware Data Recovery Services is available with a risk-free option that includes free shipping and a free evaluation for your Veeam backup repair. Our engineers will only proceed with a fix once you are happy with the provided estimate, and there is no sales pressure put upon our customers; you can simply walk away if you want to, or you can instruct Gillware to recover the missing files and get the backup chain started.

A support case can be logged directly from the website, or if you prefer to discuss your case with the team, speak to our data recovery experts on 877-624-7206. Our team will provide a label to ship the storage device and media to our data recovery lab.

Our experts will discuss the shipping process with you. We will advise what needs to be included; most of the time we just need the hard disks, but on occasion, you may need to ship the entire device to us. Either way, we will let you know what is needed.

Upon arrival, the media will be cataloged by our team and sent to the lab for an initial investigation. Our lab is located in Madison, Wisconsin, and each case begins its journey at our 10,000 sq foot facility where our team of experts investigates and diagnoses the root cause of the problem. We provide an estimate of how long data recovery will take, and estimate what percentage of the full backup data can be saved.

You can track the entire data recovery process on our website; simply log into your account (this is provided when your case is submitted to Gillware). In most circumstances, we can upload your repaired backup chain files to the customer portal for easy download.

Can Ransomware Delete Backup Files?

Once the Ransomware payloads have been delivered, the goal of the attacker is to exfiltrate sensitive data and encrypt local user files. A financial ransom is demanded to regain access to the data. Some iterations of malware are incredibly malicious because they target the user’s full backup files, intending to spread the malware into the backup inventory.

As backups usually happen once a day, the malware will typically lay dormant, hiding in plain sight to increase the probability that the malware is copied as part of the backup data sets. The malware may wait 2 weeks or 2 months before the payload is activated, often via a command and control server. Once activated, there is a very good chance the malware will be copied to your last backup set, and potentially your long-term full backup solution.

Ransomware attacks do this by targeting your system’s shadow copies, and when a backup runs, the backup uses shadow copies to back up live data. This occurs because a shadow copy allows a full backup of a system drive when the server is still running. If a malware payload is written to the shadow copy, it will be written to your backups at the next write.

Backups are typically not monitored as rigorously as live production systems. You may get alerts when a backup starts, finishes, or fails, but mainstream monitoring solutions do not provide granular monitoring of the data in the backup. It’s expected that an antivirus product will pick up the malware, but it’s not uncommon for ransomware to circumvent antivirus definitions, particularly in 0-day exploits.

How Do I Troubleshoot a Veeam Restore?

It’s possible to get the “Backup Files are Unavailable” error message if you are impacted by ransomware. The purpose of a backup is to have the ability to recover the system to a specific restore point.

If you are recovering from a ransomware attack, there is a distinctive lack of visibility of what you are actually restoring. You may have to rely on your IT Operations team to know the best restore point to roll back to or guess which backup will not have the ransomware payload. If the ransomware has infected the backup chain, there is a good possibility that the infected malware will be restored into a production environment.

It can be difficult to balance the urgent requirements of recovering an environment quickly with the need to restore it cleanly into production. Gillware’s Data Recovery Experts have a dedicated digital forensics team that investigates the ransomware incidents we are sent.

When a client comes to us with a malware issue and they need data recovered from it fast, in most of these cases, Veeam backup servers are typically attached to a NAS, SAN, or RAID array. If malware has impacted the storage, our engineers know that they’ll need to work hard to identify where the malware has penetrated and find a clean restore point.

Recovering a Veeam backup chain and file data from a virtual machine disk takes a lot of work. Our engineers will do whatever it takes to rebuild the storage volumes (often involving repairs to two or more hard drives). Our engineers can recover the virtual machines themselves, and after that, the file systems and files within the virtual machine backups. Our engineers must peel back layer after layer before reaching our client’s partition data files.

Ransomware can be incredibly malicious, but in many scenarios, we can recover corrupted restore points for our clients. This is possible because in many cases the hacker doesn’t do a very good job of encrypting the data or damaging the initial full backup. Backup servers are usually well protected, with network segregation being commonplace, hackers do not tend to focus on large files during a ransomware attack. Larger files take much longer to encrypt, and hackers usually have to work fast to encrypt as many files manually as possible before they are detected.

Backup chains found in Veeam are usually very large files, typically over 2 GB in size (often more), and because large files take longer to encrypt, they are often overlooked by the hacker; instead, they try to damage the file, delete it or corrupt a selected restore point.

Backup chains and available restore points usually reside on a network share and are protected by network permissions. The malicious actor will rarely have read, write, or delete permissions to all restore points and dependent backups. Even if they choose to delete backup files or incremental backups, the underlying snapshots will likely not be impacted and can be used to fix broken backup chain errors.

Gillware engineers have the expertise to recover your data from these snapshots and fix unavailable restore points. Once our engineers have pulled your broken chain backup out of the wreckage, the next step in the data recovery process is to pry open those virtual machine backups and examine their contents. To do this, our engineers mount the virtual machines on physical hard disks, just as if they were a hard disk pulled from any normal computer.

We use proprietary file recovery software known internally as “HOMBRE” to examine the GUID partition table and look for recovery settings and recovered files and folders using a bespoke recovery algorithm.

By cross-referencing status maps and carefully spot-testing files within the recovered virtual hard disks, our data recovery experts ensure that our clients get the best results possible from our data recovery efforts.