System restore mysteries / shadow copies etc

Anonymous

Hi,

New Windows 10 user here.
Have Googled/Binged around and still a bit puzzled about this.

So, System Restore is defaulted to "Off" in Windows 10. I understand some of the reasons for this, but still find it a useful tool.
(I left it like that, since it's still fresh and can basically just factory reset at this point)

Restore settings mention "using system protection on a drive that contains system image backups will cause other shadow copies to be deleted faster than normal"

OK. I'm not sure how fast "normal" is meant to be...

My Windows 10 came with Dell's SupportAssist installed, which apparently has its own recovery tools. Using it to download/install a few drivers, I noticed it had enabled Windows' System Restore by itself and created some restore points there.
(This came in useful because SupportAssist's driver updates resulted in a BSOD every time! I'll be uninstalling it...)

What set me wondering though, is I later noticed some errors in Event Viewer

"The shadow copies ... were aborted because the shadow copy storage could not grow due to a user imposed limit"

So it's already full?

8.90GB was set aside and I've barely done anything besides customise my user account!

Installed nothing!!

I then checked and all my restore points had gone too
This was strange because there haven't been any Windows - or even driver - updates in the meantime (which is usually the reason against keeping old restore points, for compatibility etc..?)

So I'm not getting shadow copies, and I'm not getting restore points...

What was more odd, was system restore was saying there were no restore points, but Current Usage showed 400-600MB in use.
What is this being used for?

Are they all these functions competing for the same space?
(and is this space barely enough for more than 1 of them to work properly?)

I don't really understand a great deal about system image backups, shadow copies, or restore points generally... I just know I should be backing up in some way.
Ideally in a way I don't have to mircomanage...

So hopefully someone could explain

System Image Backup

I can just reset to factory settings / reinstall Windows can't I, if things got really bad?
Are there any likely cases where I wouldn't be able to?
Is there any advantage (for the average Joe) in making a separate recovery drive to boot from?

> When the above warning mentioned a drive with "system image backups" (plural), what did it mean?
Is Windows automatically making many new system images itself?
Are they available to me?
(beyond the factory reset)

Shadow copies

Where can I find these / how can I access them?
As long as I'm backing up my files regularly, I should mostly be fine.
But it would be nice to get back the *exact* content I lost in the event of a crash. So how do I do this?

System restore

I'd like to have something with this functionality, but not if it's preventing the above functions from working.
And I'm not into backing up my whole system to another drive on a daily basis, that seems like a lot of hassle

So basically, what's the best practice for low-effort safeguarding in the event of a failure to boot / hijack / loss of data etc?
I'm more confused than ever now

(I haven't noticed the shadow copy error in the last few days, and a new restore point was created. But I don't expect either to last like this for long...)

Thanks

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

Answer accepted by question author

Anonymous

(1) Your ReagentC shows partition 4 to be the Windows Recovery Environment partition. Shift+Restart will reboot to its recovery tools ("Choose an Option" screen). Normally, the computer also goes there when it has failed to boot Windows three times in a row. But going by that article I found, your computer will go to Partition 6 instead...

https://www.dell.com/support/kbdoc/en-in/000177401/restore-your-system-using-dell-supportassist-os-recovery

Restore your system using Dell SupportAssist OS Recovery

I don't see it saying it is making images or even just doing an independent backup & restore of user files. All I see is that you can do a factory reset (to the version of Windows that is on partition 5) or a fresh install of the latest Windows 10. You don't really want a factory reset after you've advanced to a greater version of Windows. It not only brings back the old version but also all the pre-installed Dell/Microsoft apps you've uninstalled along the way. And a fresh install of the latest version of Windows keeping files is what a regular reset will do anyway (without Dell's help). In either case, it will allow you to backup user files in concert with the reset & restore them afterward (but not apps). But the files will need to be accessible, i.e., whatever caused the catastrophe better not have messed with them. That's how I read it.

A Windows system image is superior because files, apps, & settings all are in the image, & apps that were deleted remain deleted when the image is restored. Also, Firewall rules are restored to that day. Only the ones you've changed since then will have to be changed again. And system images don't take terabytes. My three together occupy just 83.1 GB. A 3rd-party app could compress them even more...

That day I had to restore an image, everything was back as/of the date the image was made. But the choice is yours. And now I think your setup does possibly survive an upgrade-install because things work through BIOS & partition 6 instead of messing with the Windows recovery partition. But I really can't say for sure.

(2) That's right, Disk Management can't move a partition, & it can't expand a partition except into unallocated space immediately to the right of it. That's why a 3rd-party app is needed, but there's a bunch to choose from. It would have been nice had Dell decided to give us stuff Windows didn't already have on its own, but they didn't. If they ever do give us a partition manager, it likely will only do what Disk Management can already do.

(3) Yep, my DCOMCFG looks just like yours. Let us hope the VSS errors stay gone with Support Assist. But they almost sounded as if they could be ignored anyway. It certainly didn't keep you from getting a ton of shadow copies.

0 comments

Answer accepted by question author

Anonymous

DISKPART> List Part

Partition ### Type Size Offset

------------- ------------ --------- -------

Partition 1 System 250 MB 1024 KB <<<EFI system partition

Partition 2 Reserved 128 MB 251 MB <<<MSR (Microsoft Reserved)

Partition 3 Primary 222 GB 379 MB <<<Windows partition

Partition 4 Recovery 990 MB 222 GB <<<Recovery Environment partition

Partition 5 Recovery 13 GB 223 GB <<<Factory reinstall partition

Partition 6 Recovery 1309 MB 237 GB <<<Or is this the RE partition?

Let's see "ReagentC /Info" at an Admin Command Prompt. It will point to either partition 4 or 6 as the active Recovery Environment partition (Shift+Restart goes there)...

C:\WINDOWS\system32>ReagentC /Info

Windows Recovery Environment (Windows RE) and system reset configuration

Information:

Windows RE status: Enabled

Windows RE location: \?\GLOBALROOT\device\harddisk0*partition4*\Recovery\WindowsRE

Boot Configuration Data (BCD) identifier: f8d976fc-df94-11ea-b1d0-74e6e2074932

Recovery image location:

Recovery image index: 0

Custom image location:

Custom image index: 0

REAGENTC.EXE: Operation Successful.

I think yours is partition 4 like mine. Then both partition 5 & 6 are expendable as soon as you begin to make system images of your own. I guess we could put a letter on partition 6 to see what's in it first...

DiskPart

Select Disk 0

Select Part 6

Assign Letter=X <<<Put letter X on partition 6

Exit

DIR X:\ /a /s <<<Show contents of X:. Remove "/s" to show just the root directory.

DiskPart

Select Vol=X

Remove Letter=X <<<Remove the letter X

Exit

Partitions 5 & 6 can be deleted with DiskPart. Then a 3rd-party app will be required to move partition 4 fully rightward over the 14.3 GB of newly unallocated space. Finally, Disk Management can expand C:partition into that space. But we'd want you to be comfortable with Windows system images of your own (onto an external HDD) before doing so. I think Greg gave you instructions how to use Macrium Reflect. And that could indeed be worthwhile. But I am still a believer in Windows own image maker...

To backup the entire computer, make a Windows system image backup. It makes a backup of all the Windows partitions required to boot & run Windows: EFI, MSR, Windows (C:), & Recovery. If you've got additional partition(s), they will also be offered for inclusion. (But likely that Dell factory reinstall partition won't be offered). A 2 TB external HDD is large enough to never fill with images. An 8 GB flash drive should be large enough to hold a Recovery drive (used to restore an image).

I make one after each new OS Build comes in & runs well, & I keep the last three...

I rename the computername folder which is inside the WindowsImageBackup folder (by appending the OS Build to it) in order to keep them separate & distinct. All three will be offered during the restore process.

Make it at "START, Settings, Update & Security, Backup, Go to backup & Restore (Win 7), Create a system image". Afterward, make the Repair Disc or (even better) ask Cortana for Recovery Drive to put it on USB. That can be used to do a restore. Then see the following to know how to restore one...

https://answers.microsoft.com/en-us/windows/forum/windows_10-update/how-to-restore-a-windows-10-system-image-to-an/e20992ca-5641-4f7c-bb09-3895d0732162

How to restore a Windows 10 system image to an existing or larger storage device

https://www.winhelp.us/restore-a-system-image-in-windows-7.html

Restore a System Image Backup in Windows 7, 8, 8.1 and 10

Note: That is an informative 3rd-party site, but I know nothing (good or bad) about any downloads or links that are there (or anywhere else).

If your external hard drive (or the internal one I guess) is a Seagate or Maxtor, there will be a free version of Acronis True Image at their site. Seagate calls it DiscWizard. Macrium Reflect, AOMEI Backupper & others also offer free versions of their image makers. These 3rd-party apps are quicker, make more compact images, & are more flexible in use. But the Windows version works in under 15 minutes on my small & uncomplicated system. I must add, DiscWizard's Bootable Media (to restore an image when Windows won't boot) requires a Mouse to operate. Plug one in, & it is instantly recognized.

0 comments

61 additional answers

Anonymous

2021-04-24T23:29:29+00:00

@Greg I have File History off, along with backup imaging etc. (I thought I'd start by keeping it simple!)

Seeing PCR's restore points only makes me more baffled.

I've never really looked under the hood of System Restore before, so thank you both for your help and patience here. I *think* I'm not experiencing any further issues, but it's hard to really understand what exactly's going on with the space it's using
Was this answer helpful?

0 comments No comments
Anonymous

2021-04-24T23:21:42+00:00
Ah wow, thanks PCR

1a)
Edition         Windows 10 Home
Version         20H2
Installed on ‎13/4/2021
OS build       19042.928
Experience Windows Feature Experience Pack 120.2212.551.0

1b) Windows came as Windows 10; I can't remember the version it was out of the box but it installed 20H2 on the 14th (the first day I wanted to change some security settings etc before going online)
1. Yep, I plan to keep restore ON!
  When I checked to see why it might've been off, I saw some threads here about how restore behaves in Win10, so just assumed it was meant to be off... Even then, I still wanted a way to keep it on...
2. Hmm I did wonder that, it was a strange warning. The way it comes, it's like it's warning you about the C: drive (since that's the first place you'd turn it on).
  I'm really no expert, my knowledge extends to the system image being on a separate partition, which is not something I'd be messing with.
  But I just don't know what's normal in Windows 10, if there would be system images tucked away in all sorts of places. Haha
4-6) Wow that's a lot of restore points! (and they've lasted that long?!)
Mine's currently taking 5.14GB, and there are only 2 restore points
- That's for a practically unused laptop - so there shouldn't be much data to be storing...
  You have that many for 9GB?!
```
  
No I was actually quite reluctant to remove SupportAssist; I didn't expect to find the bundled apps to be much use, but I was quite impressed with them. So I have good feelings towards Dell!  
It's just unfortunate there seem to be a few problems with it.  
  
I'll be checking the website, but it is listing a few drivers that I don't think are applicable. Even though it's supposed to be listing only what's relevant to my specific Service Tag.  
- eg, it's listing an AMD chipset driver (I have AMD graphics, but the chipset appears to be Intel..?)  
- SK Hynix SSD firmware (mine seems to be Kioxia)  
  
No big deal, I'll just be doing what I've always done; checking the site occasionally and seeing what applies.  
  
Windows Update is offering something only called "Dell, Inc. - Firmware - 11/20/2018 12:00:00AM - 1.0.0.0"  
No idea what this is (and nor does anyone else, seemingly). So I'm a bit scared to install it!  
Advice generally seems to be "if it ain't broke (don't update mystery firmware)"
```
Was this answer helpful?

0 comments No comments
Anonymous

2021-04-24T06:12:46+00:00

(1) I recall when the initial version of Win 10 (OS Build 10240) upgraded this Dell Inspiron 3542 (which was Win 8.1), it did turn off restore pointsts. But no succeeding version of Win 10 did that, & I took them all up to the latest 20H2. Along the way, I did one clean install which also did not turn it back off. But they all did wipe the points & start fresh. That's normal.

(a) What is your info at "right-click START, System"...?...

Edition         Windows 10 Home

Version         20H2

Installed on ‎8/‎16/‎2020

OS build       19042.928

Experience Windows Feature Experience Pack 120.2212.551.0

(b) Have you undergone an upgrade or did it come that way? Well, anyway, has it been that way since you did the factory reinstall?

(2) But, I say, go ahead & turn restore points ON. As Greg says, they are an early recourse in the event of big trouble to get back to a working state. (Individual driver/app/update uninstalls might be tried first). Restore points undo all settings, driver/program installs as well as Quality updates that occurred after the restore point was made while keeping files.

It is less drastic than a Windows system image restore which restores whole partitions: EFI, MSR, Windows (C:), Recovery & any others one might have included in a Windows system image backup. And files (except those on OneDrive) made since the image was made are lost.

(3) Regarding "using system protection on a drive that contains system image backups will cause other shadow copies to be deleted faster than normal", that sounds like it's referring to the external drive onto which a system image is made. At the end of the image making process, a shadow copy is written onto that drive. So, I make mine onto Seagate Slim Red (E:), but I keep Protection OFF for that drive...

[Frankly, I don't even know what it would accomplish to turn it on. Why would one want restore points for a drive other than Windows (C:)? Is it some kind of backup for the drive? Anyhow, I've seen Greg & possibly others say, it is problematic to turn on restore points for any drive other than Windows. I guess, if one dual boots & has two Windows partitions, one would want it on for both, though.].

(4) Here is how my Windows (C:) is configured...

The blurb does say, as you rightly opined, that only old ones should get deleted when a new one needs space. Those figures fairly well match what VSSAdmin reports under ListShadowStorage below.

(5) Let's compare VSSAdmin...

C:\WINDOWS\system32>VSSAdmin List Providers

vssadmin 1.1 - Volume Shadow Copy Service administrative command-line tool

(C) Copyright 2001-2013 Microsoft Corp.

Provider name: 'Microsoft Software Shadow Copy provider 1.0'

   Provider type: System

   Provider Id: {b5946137-7b9f-4925-af80-51abd60b20d5}

   Version: 1.0.0.7

Note: I suppose you will have Dell as a provider as well as Microsoft.

C:\WINDOWS\system32>VSSAdmin List Shadows

vssadmin 1.1 - Volume Shadow Copy Service administrative command-line tool

(C) Copyright 2001-2013 Microsoft Corp.

Contents of shadow copy set ID: {123bc331-7dc8-485c-89ff-0ea0b02fd720}

   Contained 1 shadow copies at creation time: 4/8/2021 2:03:18 AM

      Shadow Copy ID: {a2fc1d2c-9eeb-4d88-a77c-c7b0ee1cdb14}

         Original Volume: (C:)\?\Volume{e25e0508-48be-470f-a312-9a0ea0ce543e}\

         Shadow Copy Volume: \?\GLOBALROOT\Device\HarddiskVolumeShadowCopy2

         Originating Machine: PCRsComputer

         Service Machine: PCRsComputer

         Provider: 'Microsoft Software Shadow Copy provider 1.0'

         Type: ClientAccessibleWriters

         Attributes: Persistent, Client-accessible, No auto release, Differential, Auto recovered

Note: 4/8/2021 used to be in Previous Versions along with the next two, but it has dropped off, & one of the following dropped off. I'm unsure why, but maybe it was because I adjusted the space allocated to shadow copies. Also, I'm unsure why there were two for 4/14/2021 in the first place since I made only one system image backup on that date. There do seem to be three restore points (below) made on that date. I guess the top two made it into a shadow copy.

Contents of shadow copy set ID: {a7ed1dc8-555d-4e94-879a-d02aa6c68200}

   Contained 1 shadow copies at creation time: 4/14/2021 12:41:46 AM

      Shadow Copy ID: {c788cb54-cf4f-4738-b37b-2d4b8eb0c4e3}

         Original Volume: (C:)\?\Volume{e25e0508-48be-470f-a312-9a0ea0ce543e}\

         Shadow Copy Volume: \?\GLOBALROOT\Device\HarddiskVolumeShadowCopy3

         Originating Machine: PCRsComputer

         Service Machine: PCRsComputer

         Provider: 'Microsoft Software Shadow Copy provider 1.0'

         Type: ClientAccessibleWriters

         Attributes: Persistent, Client-accessible, No auto release, Differential, Auto recovered

Contents of shadow copy set ID: {93ccfbbb-7f28-4ea9-be96-dee8852e4132}

   Contained 2 shadow copies at creation time: 4/14/2021 9:51:33 AM

      Shadow Copy ID: {46ae862b-3bb1-4891-b450-fddc50994d2d}

         Original Volume: (C:)\?\Volume{e25e0508-48be-470f-a312-9a0ea0ce543e}\

         Shadow Copy Volume: \?\GLOBALROOT\Device\HarddiskVolumeShadowCopy33

         Originating Machine: PCRsComputer

         Service Machine: PCRsComputer

         Provider: 'Microsoft Software Shadow Copy provider 1.0'

         Type: ClientAccessibleWriters

         Attributes: Persistent, Client-accessible, No auto release, Differential, Auto recovered

Contents of shadow copy set ID: {0cb5a7d4-d818-43da-bfbb-739d64d552b3}

   Contained 1 shadow copies at creation time: 4/21/2021 11:44:34 AM

      Shadow Copy ID: {1b9309d1-3411-4741-9a10-ce665eb803ac}

         Original Volume: (C:)\?\Volume{e25e0508-48be-470f-a312-9a0ea0ce543e}\

         Shadow Copy Volume: \?\GLOBALROOT\Device\HarddiskVolumeShadowCopy49

         Originating Machine: PCRsComputer

         Service Machine: PCRsComputer

         Provider: 'Microsoft Software Shadow Copy provider 1.0'

         Type: ClientAccessibleWriters

         Attributes: Persistent, Client-accessible, No auto release, Differential, Auto recovered

Contents of shadow copy set ID: {8b6d3091-b360-444b-95e6-205554b9c831}

   Contained 1 shadow copies at creation time: 4/23/2021 1:31:14 PM

      Shadow Copy ID: {f5b0e56c-5969-4d55-86a4-78d556d92eb0}

         Original Volume: (C:)\?\Volume{e25e0508-48be-470f-a312-9a0ea0ce543e}\

         Shadow Copy Volume: \?\GLOBALROOT\Device\HarddiskVolumeShadowCopy64

         Originating Machine: PCRsComputer

         Service Machine: PCRsComputer

         Provider: 'Microsoft Software Shadow Copy provider 1.0'

         Type: ClientAccessibleWriters

         Attributes: Persistent, Client-accessible, No auto release, Differential, Auto recovered

Note: I just made that last one (4/23/2021) to see whether it would add to Previous Versions per an article Greg posted. It did not. The only thing that puts stuff in there for me is the making of a Windows system image...

C:\WINDOWS\system32>VSSAdmin List ShadowStorage

vssadmin 1.1 - Volume Shadow Copy Service administrative command-line tool

(C) Copyright 2001-2013 Microsoft Corp.

Shadow Copy Storage association

   For volume: (C:)\?\Volume{e25e0508-48be-470f-a312-9a0ea0ce543e}\

   Shadow Copy Storage volume: (C:)\?\Volume{e25e0508-48be-470f-a312-9a0ea0ce543e}\

   Used Shadow Copy Storage space: 9.06 GB (0%) <<< Huh?

   Allocated Shadow Copy Storage space: 9.78 GB (1%)

   Maximum Shadow Copy Storage space: 18.6 GB (2%)

Edit: OK, today it shows...

   Used Shadow Copy Storage space: 9.78 GB (1%) <<<I guess it compares against

   Allocated Shadow Copy Storage space: 10.2 GB (1%)   my 1TB HDD & just now hit 1%

   Maximum Shadow Copy Storage space: 18.6 GB (2%)

C:\WINDOWS\system32>VSSAdmin List Volumes

vssadmin 1.1 - Volume Shadow Copy Service administrative command-line tool

(C) Copyright 2001-2013 Microsoft Corp.

Volume path: C:\

    Volume name: \?\Volume{e25e0508-48be-470f-a312-9a0ea0ce543e}\

Volume path: \?\Volume{457ef4fb-b253-437a-8212-e3b0b7dc0926}\

    Volume name: \?\Volume{457ef4fb-b253-437a-8212-e3b0b7dc0926}\

Note: There's an entry in my Registry that indicates that 2nd volume is my Recovery partition. I wonder why there isn't one for EFI partition.

(6) Here are my restore points...

It's the most I've ever seen. 8/16/2020 matches the date of my upgrade to 20H2. (Or -- wait a minute -- it was the date I did a repair-install of 2004 over 2004 which on 12/8/2020 I transitioned to 20H2 with the Enablement Package. That just turned on switches. An actual upgrade/repair-install clears the restore points.). But I don't recall ever seeing that many. Maybe playing with VSSAdmin has awakened some. When I click the bottom one & then "Scan for affected progrms", I get this...

I think you probably are right that Dell Support Assist is messing things up. It is duplicative of what Windows already has & I'd uninstall it. In fact, I did uninstall mine long ago (but can't recall whether mine did system restore). I do recall neither it nor Dell Update ever fetched all there was for me at the Dell site. I had to go & get the others manually anyway. Furthermore, Windows, itself, eventually fetches drivers on its own through Windows Update (that are supplied by Dell &/or component manufacturers). Mine won't get BIOS updates that way, though. Yours might get those if it's a newer model than mine.

But I can't hate Dell seeing as this computer made it from 10/31/2014 to now taking all the upgrades without serious mishap. And I can't hate Microsoft.
Was this answer helpful?

0 comments No comments