System restore mysteries / shadow copies etc

Anonymous

Hi,

New Windows 10 user here.
Have Googled/Binged around and still a bit puzzled about this.

So, System Restore is defaulted to "Off" in Windows 10. I understand some of the reasons for this, but still find it a useful tool.
(I left it like that, since it's still fresh and can basically just factory reset at this point)

Restore settings mention "using system protection on a drive that contains system image backups will cause other shadow copies to be deleted faster than normal"

OK. I'm not sure how fast "normal" is meant to be...

My Windows 10 came with Dell's SupportAssist installed, which apparently has its own recovery tools. Using it to download/install a few drivers, I noticed it had enabled Windows' System Restore by itself and created some restore points there.
(This came in useful because SupportAssist's driver updates resulted in a BSOD every time! I'll be uninstalling it...)

What set me wondering though, is I later noticed some errors in Event Viewer

"The shadow copies ... were aborted because the shadow copy storage could not grow due to a user imposed limit"

So it's already full?

8.90GB was set aside and I've barely done anything besides customise my user account!

Installed nothing!!

I then checked and all my restore points had gone too
This was strange because there haven't been any Windows - or even driver - updates in the meantime (which is usually the reason against keeping old restore points, for compatibility etc..?)

So I'm not getting shadow copies, and I'm not getting restore points...

What was more odd, was system restore was saying there were no restore points, but Current Usage showed 400-600MB in use.
What is this being used for?

Are they all these functions competing for the same space?
(and is this space barely enough for more than 1 of them to work properly?)

I don't really understand a great deal about system image backups, shadow copies, or restore points generally... I just know I should be backing up in some way.
Ideally in a way I don't have to mircomanage...

So hopefully someone could explain

System Image Backup

I can just reset to factory settings / reinstall Windows can't I, if things got really bad?
Are there any likely cases where I wouldn't be able to?
Is there any advantage (for the average Joe) in making a separate recovery drive to boot from?

> When the above warning mentioned a drive with "system image backups" (plural), what did it mean?
Is Windows automatically making many new system images itself?
Are they available to me?
(beyond the factory reset)

Shadow copies

Where can I find these / how can I access them?
As long as I'm backing up my files regularly, I should mostly be fine.
But it would be nice to get back the *exact* content I lost in the event of a crash. So how do I do this?

System restore

I'd like to have something with this functionality, but not if it's preventing the above functions from working.
And I'm not into backing up my whole system to another drive on a daily basis, that seems like a lot of hassle

So basically, what's the best practice for low-effort safeguarding in the event of a failure to boot / hijack / loss of data etc?
I'm more confused than ever now

(I haven't noticed the shadow copy error in the last few days, and a new restore point was created. But I don't expect either to last like this for long...)

Thanks

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

Answer accepted by question author

Anonymous

(1) Your ReagentC shows partition 4 to be the Windows Recovery Environment partition. Shift+Restart will reboot to its recovery tools ("Choose an Option" screen). Normally, the computer also goes there when it has failed to boot Windows three times in a row. But going by that article I found, your computer will go to Partition 6 instead...

https://www.dell.com/support/kbdoc/en-in/000177401/restore-your-system-using-dell-supportassist-os-recovery

Restore your system using Dell SupportAssist OS Recovery

I don't see it saying it is making images or even just doing an independent backup & restore of user files. All I see is that you can do a factory reset (to the version of Windows that is on partition 5) or a fresh install of the latest Windows 10. You don't really want a factory reset after you've advanced to a greater version of Windows. It not only brings back the old version but also all the pre-installed Dell/Microsoft apps you've uninstalled along the way. And a fresh install of the latest version of Windows keeping files is what a regular reset will do anyway (without Dell's help). In either case, it will allow you to backup user files in concert with the reset & restore them afterward (but not apps). But the files will need to be accessible, i.e., whatever caused the catastrophe better not have messed with them. That's how I read it.

A Windows system image is superior because files, apps, & settings all are in the image, & apps that were deleted remain deleted when the image is restored. Also, Firewall rules are restored to that day. Only the ones you've changed since then will have to be changed again. And system images don't take terabytes. My three together occupy just 83.1 GB. A 3rd-party app could compress them even more...

That day I had to restore an image, everything was back as/of the date the image was made. But the choice is yours. And now I think your setup does possibly survive an upgrade-install because things work through BIOS & partition 6 instead of messing with the Windows recovery partition. But I really can't say for sure.

(2) That's right, Disk Management can't move a partition, & it can't expand a partition except into unallocated space immediately to the right of it. That's why a 3rd-party app is needed, but there's a bunch to choose from. It would have been nice had Dell decided to give us stuff Windows didn't already have on its own, but they didn't. If they ever do give us a partition manager, it likely will only do what Disk Management can already do.

(3) Yep, my DCOMCFG looks just like yours. Let us hope the VSS errors stay gone with Support Assist. But they almost sounded as if they could be ignored anyway. It certainly didn't keep you from getting a ton of shadow copies.

0 comments

Answer accepted by question author

Anonymous

DISKPART> List Part

Partition ### Type Size Offset

------------- ------------ --------- -------

Partition 1 System 250 MB 1024 KB <<<EFI system partition

Partition 2 Reserved 128 MB 251 MB <<<MSR (Microsoft Reserved)

Partition 3 Primary 222 GB 379 MB <<<Windows partition

Partition 4 Recovery 990 MB 222 GB <<<Recovery Environment partition

Partition 5 Recovery 13 GB 223 GB <<<Factory reinstall partition

Partition 6 Recovery 1309 MB 237 GB <<<Or is this the RE partition?

Let's see "ReagentC /Info" at an Admin Command Prompt. It will point to either partition 4 or 6 as the active Recovery Environment partition (Shift+Restart goes there)...

C:\WINDOWS\system32>ReagentC /Info

Windows Recovery Environment (Windows RE) and system reset configuration

Information:

Windows RE status: Enabled

Windows RE location: \?\GLOBALROOT\device\harddisk0*partition4*\Recovery\WindowsRE

Boot Configuration Data (BCD) identifier: f8d976fc-df94-11ea-b1d0-74e6e2074932

Recovery image location:

Recovery image index: 0

Custom image location:

Custom image index: 0

REAGENTC.EXE: Operation Successful.

I think yours is partition 4 like mine. Then both partition 5 & 6 are expendable as soon as you begin to make system images of your own. I guess we could put a letter on partition 6 to see what's in it first...

DiskPart

Select Disk 0

Select Part 6

Assign Letter=X <<<Put letter X on partition 6

Exit

DIR X:\ /a /s <<<Show contents of X:. Remove "/s" to show just the root directory.

DiskPart

Select Vol=X

Remove Letter=X <<<Remove the letter X

Exit

Partitions 5 & 6 can be deleted with DiskPart. Then a 3rd-party app will be required to move partition 4 fully rightward over the 14.3 GB of newly unallocated space. Finally, Disk Management can expand C:partition into that space. But we'd want you to be comfortable with Windows system images of your own (onto an external HDD) before doing so. I think Greg gave you instructions how to use Macrium Reflect. And that could indeed be worthwhile. But I am still a believer in Windows own image maker...

To backup the entire computer, make a Windows system image backup. It makes a backup of all the Windows partitions required to boot & run Windows: EFI, MSR, Windows (C:), & Recovery. If you've got additional partition(s), they will also be offered for inclusion. (But likely that Dell factory reinstall partition won't be offered). A 2 TB external HDD is large enough to never fill with images. An 8 GB flash drive should be large enough to hold a Recovery drive (used to restore an image).

I make one after each new OS Build comes in & runs well, & I keep the last three...

I rename the computername folder which is inside the WindowsImageBackup folder (by appending the OS Build to it) in order to keep them separate & distinct. All three will be offered during the restore process.

Make it at "START, Settings, Update & Security, Backup, Go to backup & Restore (Win 7), Create a system image". Afterward, make the Repair Disc or (even better) ask Cortana for Recovery Drive to put it on USB. That can be used to do a restore. Then see the following to know how to restore one...

https://answers.microsoft.com/en-us/windows/forum/windows_10-update/how-to-restore-a-windows-10-system-image-to-an/e20992ca-5641-4f7c-bb09-3895d0732162

How to restore a Windows 10 system image to an existing or larger storage device

https://www.winhelp.us/restore-a-system-image-in-windows-7.html

Restore a System Image Backup in Windows 7, 8, 8.1 and 10

Note: That is an informative 3rd-party site, but I know nothing (good or bad) about any downloads or links that are there (or anywhere else).

If your external hard drive (or the internal one I guess) is a Seagate or Maxtor, there will be a free version of Acronis True Image at their site. Seagate calls it DiscWizard. Macrium Reflect, AOMEI Backupper & others also offer free versions of their image makers. These 3rd-party apps are quicker, make more compact images, & are more flexible in use. But the Windows version works in under 15 minutes on my small & uncomplicated system. I must add, DiscWizard's Bootable Media (to restore an image when Windows won't boot) requires a Mouse to operate. Plug one in, & it is instantly recognized.

0 comments

61 additional answers

Anonymous

2021-04-29T06:21:09+00:00

(1) "Once the system image partition is rendered useless I might have to look into recovering that space, since there's not a whole lot to go around."

Let me see the partitions now...

(a) Right-click START, & select Disk Management. Use the divider lines in the header to make the columns readable. Post a picture.

(b) Type CMD into Search, & click Run as Administrator.

(c) Enter the following commands...

DiskPart <<<Start DiskPart

List Disk <<<List the disks. If more than one, do the next two for each.

Select Disk 0 <<<Focus on disk 0

List Part <<<Show the partitions

Exit <<<Leave DiskPart

Use Ctrl-A & Ctrl-C to copy, then paste it here.

(2) Now I see it...

That's new. But mine is out of warranty, & I don't know what would make that better than just examining the site for new ones anyway. They are still putting drivers there & BIOS updates [latest is version A16 (9/2/2020)]. Does the subscription do anything different than Support Assist & Dell Update? Those never got all of them for me, though the former did get BIOS updates.

(3) I had two extra partitions on this Dell. One was an 8 GB factory reinstall partition. The other was 40 MB & had a name I can't recall. I thought it was used for the BIOS hardware diagnostics, but it wasn't. After deleting it, the diagnostics still worked the same.

(4) I wish I knew more about shadow copies. I too trust that Microsoft has important uses for them. They definitely are not just used to fill the Previous Versions tab. Some likely are used to check the integrity of the file system. I think they are written to the same space that restore points use. Your space can grow to 8.90 GB before old ones need be deleted. I guess you are OK, especially as you've stopped Support Assist messing with that space. Turning restore points off/on likely will not affect the shadow copies. I think, though, as your restore points accumulate, older shadow copies might be deleted to make room. But I wish I knew more.

Used Shadow Copy Storage space: 7.07 GB (3%)
Allocated Shadow Copy Storage space: 7.53 GB (3%)
Maximum Shadow Copy Storage space: 8.90 GB (4%)

(5) Are you sure the VSS errors are ID 8194? Usually it will be a different ID for an error than the one used for a success. Show a picture of one like I showed. I do get many "VSS service is shutting down due to idle timeout". They are informational & can be ignored...

I've got only 55 VSS errors. They are all either ID 8193 or ID 13, & both say "A system shutdown is inprogress". So something goes wrong sometimes at shutdown. I'm not overly worried...

(6) "The log file correctly recorded the time of the scan, but it was File Explorer that showed the log files/folders to be modified/created hours ahead in the future."

Show me pictures &/or direct me to where I can see mine. If the BIOS clock is correct & Windows time is correct, I still think the time of an offline scan shown in Event Viewer might differ by an hour at most with Windows' time.
Was this answer helpful?

0 comments No comments
Anonymous

2021-04-28T21:21:41+00:00
1. Thanks for the info! Once the system image partition is rendered useless I might have to look into recovering that space, since there's not a whole lot to go around.
2. I only found the driver subscription option by going through all the tabs on the Dell website once signed in. (I'm being pretty thorough with this setup!)
3. Yes I just found some of those hardware scans. When I previously went to pre-boot settings, I must've pressed a different function key as it was just basic system information. F12 gave a plethora of info and tools!
4. I'm torn on this; wanting to be cautious but also wanting the most up-to-date everything. Will put it on the backburner for the time being. My BIOS has seemed to have shipped with the most up-to-date version (it was actually manufactured in August 2020 I just discovered, so not too old)
5. I'll have to trust there's some reason for all those shadow copies I have. They're taking up space and otherwise serving no purpose for me.
6. I had since disabled SupportAssist's ability to make restore points, so that's probably why Dell is not showing as a provider now.
  I turned system restore off and on again after the restore points vanished, and when space was still being shown as in use. I thought flushing it might clear things out a bit.
  (another annoying thing was SupportAssist kept sending notifications "We've created your first backup!" - every single day (It was certainly not the first!))
So unfortunately we're still none-the-wiser why I have all these shadow copies! Oh well

Yes something like that. I believe the storage was stated as 256GB. But in operation C: is 222GB. And once Windows files are subtracted, it's much less - there's only 140GB left now after adding a few videos (I have around only 10GB of personal files on there now). Really not much at all!
My prehistoric laptop had 800GB~ I like the SSD but wish I had more freedom to fill this full of things... plugging in external harddrives all the time is a pain
1. There seem to be a number of these VSS errors daily; I think one appears soon after booting, then again a few minutes later.
  Shortly afterwards it then says "VSS service is shutting down due to idle timeout"
2. Time is correct in BIOS. Sorry, I was not very clear with my language. The log file correctly recorded the time of the scan, but it was File Explorer that showed the log files/folders to be modified/created hours ahead in the future.
I did notice some weirdness before I synchronised my clock at the very start - despite setting timezone, it was an hour off (2 hours off when daylight saving was included). But everything's seemed fine since then.

This time disparity is huge, but presumably if this was manufactured in the East, on some deep level it's still defaulting to that timezone when user settings are not yet accessible...
I wouldn't think it should be doing that though..? It's logging the correct time, but File Explorer is in the future... makes no sense
Was this answer helpful?

0 comments No comments
Anonymous

2021-04-26T10:09:40+00:00

(1) Well, after a new Windows version comes in & works well, you shouldn't want to revert to the lesser version of a factory reset. But you'd have two ways to get there....

(a) There is a 10-day window in which to "START, Settings, Update & Security, Recovery, Get Started (under 'Go back...')"...

That one only works if it's the first upgrade to the factory installation. It would restore it including its ability to reset itself. It would be as if you never did the upgrade. I did this once & was amazed how quick it worked after the upgrade took two hours -- was it 21 minutes or just 11? And I'm not even sure I saw any reboots.

(b) If you've got a Windows system image backup of the original version, that would do it. It could be applied no matter how many upgrades you've undergone. And it obviously has no 10-day limit. This too is quick. It was around 15 minutes that time I did one.

(2) I never heard of a new drivers subscription at Dell. Maybe it's something new, but my Inspiron 3542 site doesn't have it that I've ever seen. I can't think what would make that necessary if Support Assist &/or Dell Update are working. All I expect from Dell these days is BIOS updates, & I go check for them myself.

(3) I think you are right about hardware scans at the site needing Support Assist to run. But you've probably got them in BIOS Setup too (as I do), & those will run independently. Press & hold F2 at the Dell logo (or the black screen just before it) as you boot to get there & see. F12 might do just as well.

(4) System image backups do not include BIOS or any other firmware update. Those are written to computer chips. So, I guess you are right to be hesitant. They can't be easily undone if at all. I was hesitant too but finally caved with something called "Application for Intel Haswell ME FW v.9.5.55.1948". I don't even know what chip that wrote to, but I never detected it hurt anything. And I dimly recall one came in sounding like yours that I had no choice but to take. OTOH, there is truth to what you say about not fixing a thing that isn't broke. Don't let me talk you into it, except, I say, do take the BIOS updates (but at your own risk). I've taken a ton of those.

(5) I don't have a correspondence between the number of restore points (26), shadow copies on C: (5), or items in the Previous Versions tab (1). I think that number of restore points is excessive but don't mind having them. I could wish the number of shadow copies equaled the number of items in the Previous Folders tab. But I believe there is another purpose for the shadow copies than just to supply that tab, maybe one is used as an integrity check for C:partition. So there might be more of them for that reason. And what is in that tab is actually unnecessary. It is a copy of C:partition that is put into a Windows system image. I always keep the last three images I make & can always mount one to copy individual files off it. Still, I wish I did know more about all of that.

(6)

(a) I expected to see Dell as a second provider in your VSSAdmin. That it isn't leads me to believe that when your Support Assist makes restore points it is just invoking Microsoft's own capabilities. It probably is just acting as a middleman adding nothing but overhead. I can't really say for sure, but it still looks to be strictly duplicative of what Windows can do on its own.

(b) I see nothing wrong with your shadows. They look a lot like mine but you've got more. I guess that may be Support Assist's doing. If I plug in an external HDD, it does have its own shadow copies like yours. The one that has Windows system image backups on it has more than the other.

(c) Your ShadowStorage...

Used Shadow Copy Storage space: 7.07 GB (3%)
Allocated Shadow Copy Storage space: 7.53 GB (3%)
Maximum Shadow Copy Storage space: 8.90 GB (4%)

I believe that means 7.07 GB of the Allocated storage space (7.53 GB) is being used. When the rest is used up, there will be an automatic reallocation taking from the Maximum (8.90 GB). But when the full Maximum is exhausted, then older shadow copies will be deleted to make room for new ones. The percentages are comparing against the size of the HDD/SSD I think. So yours is about 236 GB if my math is correct.

Here are my figures today. My HDD is 1 TB huge...

Used Shadow Copy Storage space: 9.78 GB (1%)

Allocated Shadow Copy Storage space: 10.2 GB (1%)

Maximum Shadow Copy Storage space: 18.6 GB (2%)

(7) I've got 38 Event Viewer ID 8194 under "Windows Logs\Application", but they all say "Successfully created restore point"...

I guess, if you've just the one error, don't worry. It might have just been a momentary glitch, & you do seem to be making restore points. Odd that I've got 38 of these, but only 26 restore points show up in the app. That's another number that doesn't correspond.

(8) Defender offline is done in the pre-boot environment where Windows has not adjusted the clock for daylight savings time. But I'd expect that to be just an hours difference. Go into BIOS Setup & check what the time is in there.
Was this answer helpful?

0 comments No comments