Skip to main content

Acronis True Image 2020 seems to be secretly reading unrelated files on my PC

Thread solved
Beginner
Posts: 1
Comments: 7

Couple of days ago I started to experience an issue with Acronis True Image 2020. I have a Dropbox folder which is set to online-only so it downloads files only on demand. And for some reason out of blue it started to give me dozens of notifications about downloading and opening files. When I went to Resource Monitor I saw that it's Acronis True Image doing this. It was just blanket reading everything from my Dropbox. And now I have about 20,000 files queued by Dropbox to download.

The thing is I don't have any backups in True Image which are in any way related to my Dropbox folder! It's already online, why would I want to back it up. And I don't do any backups to the folder too.

It happened again today but this time Acronis accessed these files together with Windows Defender so I was thinking what if it's Defender scanning them and Acronis is there only because its Active Protection tries to protect me from Windows Defender. But I went to Defender options and saw that last scan was 2 days ago. And I also clearly remember that when the issue happened for the first time only Acronis was accessing the files without Defender.

Why does Acronis read my personal files and how do I stop this?

Attachment Size
Acronis.png 37.71 KB
Defender.png 10.67 KB
1 Users found this helpful
Legend
Posts: 83
Comments: 19765

#1

welcome to these public User Forums.

I do not recall seeing any other users reporting any issues of the type being described in your post above, and have not seen this for myself on any of my own computers running ATI 2020 with Acronis Active Protection enabled and active.

Have you reviewed what is shown in the main ATI GUI on the AAP main page, and in particular if you have any Processes being monitored by AAP?  If you have any value shown than 0, then review what those processes are by using the option to 'Manage processes'.  Any monitored process will trigger extra activity by ATI & AAP.

Beginner
Posts: 1
Comments: 7

#2

Thank you for your help Steve. When I open the AAP page I see "8 monitored processes". But when I click the "Monitored" link I see only 4 processes listed:

CropAssistService.exe from Logitech webcam - "The process does not have a trusted certificate"

IPROSetMonitor.exe from Intel - "The process does not have a trusted certificate"

WorkflowAppControl.exe from Microsoft - "The process does not have a trusted certificate"

rundll32.exe - "The process is explicitly untrusted"

In this list it looks like nothing except rundll32.exe should have a reason to batch read random files from HDD. And if I understand it right the rundll32.exe is not a standalone exe but is a part of a system which can be used by arbitrary applications and it could be a culprit.

I explicitly set my Dropbox folder to online-only again and for 2 days it was quiet so far. I will try to get any additional clues if the issue happens again.

Beginner
Posts: 1
Comments: 7

#3

A thing that could be possibly related - I think this started after I added one more drive to the PC and used ATI to create a partition there. And I also moved one folder which was set to be backed up daily to this new drive without modifying the backup settings. So the backup failed for a couple of times until I adjusted it. I wonder if ATI has any logic to read all files on the PC when you add a new drive or when it can't find a folder to be backed up in expected place.

Forum Hero
Posts: 68
Comments: 8281

#4

It would depend on your backup - did you select "entire pc" as the option when you created a backup task?  If so, then yes, any new disk you add will be scanned and added to the backup too.

I don't believe True Image will scan Dropbox files hosted in the cloud and cause them to download locally.  I've used Dropbox and OneDrive and never seen that type of behavior.  However, there are definitely some sync options in the applications and could someone have fiddled with those?  

https://help.dropbox.com/installs-integrations/sync-uploads/smart-sync

https://support.office.com/en-us/article/save-disk-space-with-onedrive-files-on-demand-for-windows-10-0e6860d3-d9f3-4971-b321-7092438fb38e

Beginner
Posts: 1
Comments: 7

#5

No, I did not select the entire PC for backup. And it happened again today. ATI was doing a backup of my system disk C. At about 50-60% I opened the ATI app to cancel other queued backup of one data folder on E drive. And just a bit of time after I closed the app I got a ton of Dropbox notifications! This time in resource monitor only three processes were accessing Dropbox folder - System, Dropbox.exe and TrueImage.exe. And after I killed the TrueImage.exe everything just stopped reading the Dropbox folder. So it was Acronis. Some time after it started again. This time I saw blanket access by Acronis not only to Dropbox folder but to other folders on D drive. I killed the process again and also had to do "Pause Sync" in Dropbox settings. Only then it stopped.

This time I copied all logs from ProgramData/Acronis to see if I can get anything useful.

This whole situation is very annoying and concerning. I have no idea why does it read my files.

Attachment Size
531102-179998.png 97.82 KB
Beginner
Posts: 1
Comments: 7

#6

And some additional information I just discovered - I do 1 full backup + 6 incremental backups for drive C. Today was a full backup. Previous occurrence was one week ago also at about the same time of the day. And I just noticed that for this backup I have not only drive C selected but also Recovery Partition and EFI System Partition which reside on drive D (same as Dropbox folder). But the data partition itself is not selected for backup. See attachment.

Attachment Size
531104-180000.png 7.32 KB
Legend
Posts: 83
Comments: 19765

#7

Seeing the logs might be helpful in trying to understand this strange issue but if TrueImage is really accessing Dropbox files stored in their cloud, then you should raise this direct with Acronis to get an answer as to why it should do this when these files are not part of the source data selected for the backup task?

Forum Hero
Posts: 36
Comments: 7656

#8

Looking at your screenshot in post #6 above I see that you have EFI System partitions and Recovery partitions on both C and D drives. 

Is drive D a bootable drive or for data only?

Normally a machine will only have duplicate partitions when the machine is configured as a dual boot machine booting 2 different operating systems.  Does this apply to you?

 

Beginner
Posts: 1
Comments: 7

#9
Steve Smith wrote:
Seeing the logs might be helpful in trying to understand this strange issue but if TrueImage is really accessing Dropbox files stored in their cloud, then you should raise this direct with Acronis to get an answer as to why it should do this when these files are not part of the source data selected for the backup task?

I see. Thank you for your help. I'll reach out to support then.

Enchantech wrote:

Looking at your screenshot in post #6 above I see that you have EFI System partitions and Recovery partitions on both C and D drives. 

Is drive D a bootable drive or for data only?

Normally a machine will only have duplicate partitions when the machine is configured as a dual boot machine booting 2 different operating systems.  Does this apply to you?

 

Drive D was previously my system drive but I duplicated it to an empty SSD drive added to the system. Now D serves as data only. I guess this drive is still bootable but I have to change BIOS settings to boot from it.

Forum Hero
Posts: 36
Comments: 7656

#10

My guess here, and it is just a guess, is that because you have the EFI and Recovery partitions on drive D selected for backup along with all partitions on drive C, True Image cannot locate or is confused by this.  The boot partition that EFI on drive D points to is in this case non existent thus True Image is searching for a drive where that partition may exist.  One Drive, Drop Box, and similar, since they mimic an actual drive, are therefore being scanned in search of this missing partition.

This really shouldn't be happening but Acronis may not be able to fix this either.  Your drive D should not have the old EFI and Recovery partitions in place and if they were not there your problem would not exist.

My recommendation is that you modify your backup task by removing the EFI and Recovery partitions of drive D from the backup.  This should correct the behavior.  It this does not work then you should raise a support ticket with Acronis to see if they might address the issue.

Beginner
Posts: 1
Comments: 7

#11
Enchantech wrote:
My recommendation is that you modify your backup task by removing the EFI and Recovery partitions of drive D from the backup.  This should correct the behavior.  It this does not work then you should raise a support ticket with Acronis to see if they might address the issue.

That's a good idea, thank you. I removed them from the backup sources and waiting till Friday to get the next full backup going to see if this helps.

Beginner
Posts: 1
Comments: 7

#12

It's been 2 full backups since I removed drive D EFI and Recovery partitions from the backup and I have no issues with Acronis accessing data files on drive D since then. That's a relief. Thank you everyone - I appreciate your help!

Forum Hero
Posts: 36
Comments: 7656

#13

Thanks for the update and marking this solved.  Glad to hear that you have things cleared up.