SIRIS, ALTO and NAS: Datto Windows Agent: Error: "Snapshot not in a good state - State 5 Error 0x00000028"



When you start a backup by using the Datto Windows Agent, you see a generic "Critical backup failure during data transfer" error in the device GUI. In the agent logs, you see, "Snapshot not in a good state - State 5 Error 0x00000028."


  • Datto Windows Agent 2.1 and above


The Copy on Write (COW) file for one or more volumes is highly fragmented, causing the backup to fail.

You'll see the following error in the Agent Logs from the Protect tab of the Datto device GUI:

Snapshot not in a good state - State 5 Error 0x00000028. Deleting snapshot set 801ade94-1ece-42b4-af67-dca42b2c9a6a


Confirm the fragmented volume 

1. Pause backups for the agent and cancel any active backup jobs

2. Download and extract the Microsoft program Contig from the Sysinternals website (external link).

3. Open an elevated command prompt and navigate to the download location of Contig.

4. Run the following commands to check the COW (.ctl) file for fragmentation: 

sc stop dattofsf 
contig.exe -a C:\datto.ctl 

5. Check the output for the value ${file} is in ${x} fragments. Example output:

C:\Users\Administrator\Downloads\Contig>Contig.exe -a C:\datto.ctl 
Contig v1.8 - Contig Copyright (C) 2001-2016 Mark Russinovich Sysinternals

C:\datto.ctl is in 10130 fragments
Summary: Number of files processed: 1 
Number unsuccessfully procesed: 0 
Average fragmentation : 10130 frags/fil

6. Repeat steps one through five for each volume included in the backup.

7. Once the files have been checked, if fragmentation is not above 1000, go ahead and start the dattofsf service again: 

sc start dattofsf

If you find disk fragmentation ( Part 1 )

Perform the following steps for any COW file that shows 1000 fragments or more.

  1. Open an Administrator command prompt
  2. Perform the following command to stop the dattofsf service. sc stop dattofsf
  3. Run the following command against each datto.ctl file per volume that you are backing up.
    • Contig.exe -v C:\datto.ctl 
      Contig.exe -a -v D:\datto.ctl 
  1. After running that command, Please run the same commands above again to validate if contig determined that the file can be optimized. This should show the Fragmentation # close to 1 or substantially lower then the previous analysis.
    • NOTE: If the file can be optimized, it is moved into the free space of the disk to clear the current fragmentation. 

If fragmentation Remains ( Part 2 )

  1. Go into the root directory of each volume where COW fragmentation was high & delete the datto.ctl & datto.mif file. 
    • NOTE: They appear as system level Files so you may need to go into windows explorer options to show system protected files. 
  2. Perform a full Defragment of each volume where COW fragmentation was high.
  3. Once Defrag is complete, start the service again with sc start dattofsf
  4. Then we are going to want to start a new backup. This will re-create the .ctl & .mif file. 

If you do not find disk fragmentation

Contact Datto Technical Support for assistance.

Was this article helpful?

2 out of 2 found this helpful

You must sign in before voting on this article.

Want to talk about it? Have a feature request?

Head on over to our Datto Community Forum or the Datto Community Online.

For more Business Management resources, see the Datto RMM Online Help and the Autotask PSA Online Help .

Still have questions? Get live help.

Datto Homepage