System restore mysteries / shadow copies etc

Anonymous

Hi,

New Windows 10 user here.
Have Googled/Binged around and still a bit puzzled about this.

So, System Restore is defaulted to "Off" in Windows 10. I understand some of the reasons for this, but still find it a useful tool.
(I left it like that, since it's still fresh and can basically just factory reset at this point)

Restore settings mention "using system protection on a drive that contains system image backups will cause other shadow copies to be deleted faster than normal"

OK. I'm not sure how fast "normal" is meant to be...

My Windows 10 came with Dell's SupportAssist installed, which apparently has its own recovery tools. Using it to download/install a few drivers, I noticed it had enabled Windows' System Restore by itself and created some restore points there.
(This came in useful because SupportAssist's driver updates resulted in a BSOD every time! I'll be uninstalling it...)

What set me wondering though, is I later noticed some errors in Event Viewer

"The shadow copies ... were aborted because the shadow copy storage could not grow due to a user imposed limit"

So it's already full?

8.90GB was set aside and I've barely done anything besides customise my user account!

Installed nothing!!

I then checked and all my restore points had gone too
This was strange because there haven't been any Windows - or even driver - updates in the meantime (which is usually the reason against keeping old restore points, for compatibility etc..?)

So I'm not getting shadow copies, and I'm not getting restore points...

What was more odd, was system restore was saying there were no restore points, but Current Usage showed 400-600MB in use.
What is this being used for?

Are they all these functions competing for the same space?
(and is this space barely enough for more than 1 of them to work properly?)

I don't really understand a great deal about system image backups, shadow copies, or restore points generally... I just know I should be backing up in some way.
Ideally in a way I don't have to mircomanage...

So hopefully someone could explain

System Image Backup

I can just reset to factory settings / reinstall Windows can't I, if things got really bad?
Are there any likely cases where I wouldn't be able to?
Is there any advantage (for the average Joe) in making a separate recovery drive to boot from?

> When the above warning mentioned a drive with "system image backups" (plural), what did it mean?
Is Windows automatically making many new system images itself?
Are they available to me?
(beyond the factory reset)

Shadow copies

Where can I find these / how can I access them?
As long as I'm backing up my files regularly, I should mostly be fine.
But it would be nice to get back the *exact* content I lost in the event of a crash. So how do I do this?

System restore

I'd like to have something with this functionality, but not if it's preventing the above functions from working.
And I'm not into backing up my whole system to another drive on a daily basis, that seems like a lot of hassle

So basically, what's the best practice for low-effort safeguarding in the event of a failure to boot / hijack / loss of data etc?
I'm more confused than ever now

(I haven't noticed the shadow copy error in the last few days, and a new restore point was created. But I don't expect either to last like this for long...)

Thanks

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

Answer accepted by question author

Anonymous

(1) Your ReagentC shows partition 4 to be the Windows Recovery Environment partition. Shift+Restart will reboot to its recovery tools ("Choose an Option" screen). Normally, the computer also goes there when it has failed to boot Windows three times in a row. But going by that article I found, your computer will go to Partition 6 instead...

https://www.dell.com/support/kbdoc/en-in/000177401/restore-your-system-using-dell-supportassist-os-recovery

Restore your system using Dell SupportAssist OS Recovery

I don't see it saying it is making images or even just doing an independent backup & restore of user files. All I see is that you can do a factory reset (to the version of Windows that is on partition 5) or a fresh install of the latest Windows 10. You don't really want a factory reset after you've advanced to a greater version of Windows. It not only brings back the old version but also all the pre-installed Dell/Microsoft apps you've uninstalled along the way. And a fresh install of the latest version of Windows keeping files is what a regular reset will do anyway (without Dell's help). In either case, it will allow you to backup user files in concert with the reset & restore them afterward (but not apps). But the files will need to be accessible, i.e., whatever caused the catastrophe better not have messed with them. That's how I read it.

A Windows system image is superior because files, apps, & settings all are in the image, & apps that were deleted remain deleted when the image is restored. Also, Firewall rules are restored to that day. Only the ones you've changed since then will have to be changed again. And system images don't take terabytes. My three together occupy just 83.1 GB. A 3rd-party app could compress them even more...

That day I had to restore an image, everything was back as/of the date the image was made. But the choice is yours. And now I think your setup does possibly survive an upgrade-install because things work through BIOS & partition 6 instead of messing with the Windows recovery partition. But I really can't say for sure.

(2) That's right, Disk Management can't move a partition, & it can't expand a partition except into unallocated space immediately to the right of it. That's why a 3rd-party app is needed, but there's a bunch to choose from. It would have been nice had Dell decided to give us stuff Windows didn't already have on its own, but they didn't. If they ever do give us a partition manager, it likely will only do what Disk Management can already do.

(3) Yep, my DCOMCFG looks just like yours. Let us hope the VSS errors stay gone with Support Assist. But they almost sounded as if they could be ignored anyway. It certainly didn't keep you from getting a ton of shadow copies.

0 comments

Answer accepted by question author

Anonymous

DISKPART> List Part

Partition ### Type Size Offset

------------- ------------ --------- -------

Partition 1 System 250 MB 1024 KB <<<EFI system partition

Partition 2 Reserved 128 MB 251 MB <<<MSR (Microsoft Reserved)

Partition 3 Primary 222 GB 379 MB <<<Windows partition

Partition 4 Recovery 990 MB 222 GB <<<Recovery Environment partition

Partition 5 Recovery 13 GB 223 GB <<<Factory reinstall partition

Partition 6 Recovery 1309 MB 237 GB <<<Or is this the RE partition?

Let's see "ReagentC /Info" at an Admin Command Prompt. It will point to either partition 4 or 6 as the active Recovery Environment partition (Shift+Restart goes there)...

C:\WINDOWS\system32>ReagentC /Info

Windows Recovery Environment (Windows RE) and system reset configuration

Information:

Windows RE status: Enabled

Windows RE location: \?\GLOBALROOT\device\harddisk0*partition4*\Recovery\WindowsRE

Boot Configuration Data (BCD) identifier: f8d976fc-df94-11ea-b1d0-74e6e2074932

Recovery image location:

Recovery image index: 0

Custom image location:

Custom image index: 0

REAGENTC.EXE: Operation Successful.

I think yours is partition 4 like mine. Then both partition 5 & 6 are expendable as soon as you begin to make system images of your own. I guess we could put a letter on partition 6 to see what's in it first...

DiskPart

Select Disk 0

Select Part 6

Assign Letter=X <<<Put letter X on partition 6

Exit

DIR X:\ /a /s <<<Show contents of X:. Remove "/s" to show just the root directory.

DiskPart

Select Vol=X

Remove Letter=X <<<Remove the letter X

Exit

Partitions 5 & 6 can be deleted with DiskPart. Then a 3rd-party app will be required to move partition 4 fully rightward over the 14.3 GB of newly unallocated space. Finally, Disk Management can expand C:partition into that space. But we'd want you to be comfortable with Windows system images of your own (onto an external HDD) before doing so. I think Greg gave you instructions how to use Macrium Reflect. And that could indeed be worthwhile. But I am still a believer in Windows own image maker...

To backup the entire computer, make a Windows system image backup. It makes a backup of all the Windows partitions required to boot & run Windows: EFI, MSR, Windows (C:), & Recovery. If you've got additional partition(s), they will also be offered for inclusion. (But likely that Dell factory reinstall partition won't be offered). A 2 TB external HDD is large enough to never fill with images. An 8 GB flash drive should be large enough to hold a Recovery drive (used to restore an image).

I make one after each new OS Build comes in & runs well, & I keep the last three...

I rename the computername folder which is inside the WindowsImageBackup folder (by appending the OS Build to it) in order to keep them separate & distinct. All three will be offered during the restore process.

Make it at "START, Settings, Update & Security, Backup, Go to backup & Restore (Win 7), Create a system image". Afterward, make the Repair Disc or (even better) ask Cortana for Recovery Drive to put it on USB. That can be used to do a restore. Then see the following to know how to restore one...

https://answers.microsoft.com/en-us/windows/forum/windows_10-update/how-to-restore-a-windows-10-system-image-to-an/e20992ca-5641-4f7c-bb09-3895d0732162

How to restore a Windows 10 system image to an existing or larger storage device

https://www.winhelp.us/restore-a-system-image-in-windows-7.html

Restore a System Image Backup in Windows 7, 8, 8.1 and 10

Note: That is an informative 3rd-party site, but I know nothing (good or bad) about any downloads or links that are there (or anywhere else).

If your external hard drive (or the internal one I guess) is a Seagate or Maxtor, there will be a free version of Acronis True Image at their site. Seagate calls it DiscWizard. Macrium Reflect, AOMEI Backupper & others also offer free versions of their image makers. These 3rd-party apps are quicker, make more compact images, & are more flexible in use. But the Windows version works in under 15 minutes on my small & uncomplicated system. I must add, DiscWizard's Bootable Media (to restore an image when Windows won't boot) requires a Mouse to operate. Plug one in, & it is instantly recognized.

0 comments

61 additional answers

Anonymous

2021-04-26T03:23:47+00:00
1. "But once the upgrade comes in you may lose the ability to do a factory reset anyway, & the partition becomes wasted space. A regular Win 10 reset will happen instead."
Wow, that's good to know! And terrible! I had no idea.
Is this what usually happens when W10 upgrades?
1. Since posting here I made a "new drivers" subscription at Dell. It seems to be emailing me every single possible driver under the sun, so I'll be unsubscribing!
  I thought with the Service Tag thing, it would be able to detect/identify my specific configuration, and offer me drivers accordingly. But it seems only SupportAssist does that.
(I think I'll keep SupportAssist around anyway - the hardware scans I ran on the website seemed to run via the app after all)

I might tackle that firmware when I have some more secure system restore options. I trust your judgement, but advice is generally not to update something if you don't have any need to (and that's basically what the update says too - well: "update this if you have a problem")
I wish they labelled things properly...
1. A lot of shadow copies shown, only 2 restore points
A)

C:\WINDOWS\system32>VSSAdmin List Providers
vssadmin 1.1 - Volume Shadow Copy Service administrative command-line tool
(C) Copyright 2001-2013 Microsoft Corp.

Provider name: 'Microsoft Software Shadow Copy provider 1.0'
   Provider type: System
   Provider Id: {b5946137-7b9f-4925-af80-51abd60b20d5}
   Version: 1.0.0.7

B)

C:\WINDOWS\system32>VSSAdmin List Shadows
vssadmin 1.1 - Volume Shadow Copy Service administrative command-line tool
(C) Copyright 2001-2013 Microsoft Corp.

Contents of shadow copy set ID: {2f3f6b34-f1c1-451e-8df4-8950f643ce4e}
   Contained 1 shadow copies at creation time: 20/04/2021 19:49:02
      Shadow Copy ID: {846e1ee5-70d8-44f6-8319-4e53ff08c959}
         Original Volume: (C:)\?\Volume{19d85eb0-cfad-4470-9e89-a04328b5b77e}\
         Shadow Copy Volume: \?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1
         Originating Machine: DESKTOP-BICK9R2
         Service Machine: DESKTOP-BICK9R2
         Provider: 'Microsoft Software Shadow Copy provider 1.0'
         Type: ApplicationRollback
         Attributes: Persistent, No auto release, Differential, Auto recovered

Contents of shadow copy set ID: {ce616f16-4286-42bc-a08f-380953d0a0fb}
   Contained 1 shadow copies at creation time: 21/04/2021 07:41:14
      Shadow Copy ID: {d707f93e-4a0f-4ba5-93a8-f5baed96a3af}
         Original Volume: (C:)\?\Volume{19d85eb0-cfad-4470-9e89-a04328b5b77e}\
         Shadow Copy Volume: \?\GLOBALROOT\Device\HarddiskVolumeShadowCopy2
         Originating Machine: DESKTOP-BICK9R2
         Service Machine: DESKTOP-BICK9R2
         Provider: 'Microsoft Software Shadow Copy provider 1.0'
         Type: ApplicationRollback
         Attributes: Persistent, No auto release, Differential, Auto recovered

Contents of shadow copy set ID: {d9e6179b-74c0-48a0-a8ca-14d5db4efb63}
   Contained 1 shadow copies at creation time: 22/04/2021 01:58:43
      Shadow Copy ID: {98ca7ffa-4c28-4a68-9ee2-3e28f0a5b297}
         Original Volume: (C:)\?\Volume{19d85eb0-cfad-4470-9e89-a04328b5b77e}\
         Shadow Copy Volume: \?\GLOBALROOT\Device\HarddiskVolumeShadowCopy3
         Originating Machine: DESKTOP-BICK9R2
         Service Machine: DESKTOP-BICK9R2
         Provider: 'Microsoft Software Shadow Copy provider 1.0'
         Type: ClientAccessibleWriters
         Attributes: Persistent, Client-accessible, No auto release, Differential, Auto recovered

-> AUTO RESTORE POINT

Contents of shadow copy set ID: {950dae6a-f7d4-41c5-995f-548e396833b3}
   Contained 1 shadow copies at creation time: 22/04/2021 20:48:05
      Shadow Copy ID: {7da21777-466d-4010-b3f0-b37130f83831}
         Original Volume: (C:)\?\Volume{19d85eb0-cfad-4470-9e89-a04328b5b77e}\
         Shadow Copy Volume: \?\GLOBALROOT\Device\HarddiskVolumeShadowCopy4
         Originating Machine: DESKTOP-BICK9R2
         Service Machine: DESKTOP-BICK9R2
         Provider: 'Microsoft Software Shadow Copy provider 1.0'
         Type: ClientAccessibleWriters
         Attributes: Persistent, Client-accessible, No auto release, Differential, Auto recovered

-> MANUAL RESTORE POINT

Contents of shadow copy set ID: {08f185e4-d27f-4f0b-a5ba-81495bc266ce}
   Contained 1 shadow copies at creation time: 22/04/2021 21:59:42
      Shadow Copy ID: {3d1c7cda-25ab-4031-be20-44fc0e8f5fc7}
         Original Volume: (C:)\?\Volume{19d85eb0-cfad-4470-9e89-a04328b5b77e}\
         Shadow Copy Volume: \?\GLOBALROOT\Device\HarddiskVolumeShadowCopy5
         Originating Machine: DESKTOP-BICK9R2
         Service Machine: DESKTOP-BICK9R2
         Provider: 'Microsoft Software Shadow Copy provider 1.0'
         Type: ApplicationRollback
         Attributes: Persistent, No auto release, Differential, Auto recovered

Contents of shadow copy set ID: {91e54ed5-62c1-4d9a-98b1-77e7bfd166e0}
   Contained 1 shadow copies at creation time: 23/04/2021 19:48:58
      Shadow Copy ID: {24b09f5d-668c-4b4d-99ee-1eba9c0ef435}
         Original Volume: (C:)\?\Volume{19d85eb0-cfad-4470-9e89-a04328b5b77e}\
         Shadow Copy Volume: \?\GLOBALROOT\Device\HarddiskVolumeShadowCopy6
         Originating Machine: DESKTOP-BICK9R2
         Service Machine: DESKTOP-BICK9R2
         Provider: 'Microsoft Software Shadow Copy provider 1.0'
         Type: ApplicationRollback
         Attributes: Persistent, No auto release, Differential, Auto recovered

Contents of shadow copy set ID: {f4e24d4e-48dd-4d85-b02e-4ab312700a74}
   Contained 1 shadow copies at creation time: 24/04/2021 01:58:18
      Shadow Copy ID: {f48b159e-9165-4b60-9bf3-cac0ef691a64}
         Original Volume: (C:)\?\Volume{19d85eb0-cfad-4470-9e89-a04328b5b77e}\
         Shadow Copy Volume: \?\GLOBALROOT\Device\HarddiskVolumeShadowCopy7
         Originating Machine: DESKTOP-BICK9R2
         Service Machine: DESKTOP-BICK9R2
         Provider: 'Microsoft Software Shadow Copy provider 1.0'
         Type: ApplicationRollback
         Attributes: Persistent, No auto release, Differential, Auto recovered

Contents of shadow copy set ID: {fce26f07-853b-4ba0-84ab-4beda534e9cf}
   Contained 1 shadow copies at creation time: 24/04/2021 17:11:51
      Shadow Copy ID: {81f25c6d-83ec-4f3a-ae27-edb0d96e9f6e}
         Original Volume: (C:)\?\Volume{19d85eb0-cfad-4470-9e89-a04328b5b77e}\
         Shadow Copy Volume: \?\GLOBALROOT\Device\HarddiskVolumeShadowCopy8
         Originating Machine: DESKTOP-BICK9R2
         Service Machine: DESKTOP-BICK9R2
         Provider: 'Microsoft Software Shadow Copy provider 1.0'
         Type: ApplicationRollback
         Attributes: Persistent, No auto release, Differential, Auto recovered

Contents of shadow copy set ID: {33abebc3-2241-46fb-914a-9eca21853253}
   Contained 1 shadow copies at creation time: 25/04/2021 01:30:25
      Shadow Copy ID: {640a8242-02a7-4654-8dd9-e10085cb9f16}
         Original Volume: (C:)\?\Volume{19d85eb0-cfad-4470-9e89-a04328b5b77e}\
         Shadow Copy Volume: \?\GLOBALROOT\Device\HarddiskVolumeShadowCopy9
         Originating Machine: DESKTOP-BICK9R2
         Service Machine: DESKTOP-BICK9R2
         Provider: 'Microsoft Software Shadow Copy provider 1.0'
         Type: ApplicationRollback
         Attributes: Persistent, No auto release, Differential, Auto recovered

Contents of shadow copy set ID: {a6ee96be-9174-442a-a7e6-31263c5690f5}
   Contained 1 shadow copies at creation time: 25/04/2021 17:22:33
      Shadow Copy ID: {4a1d75ef-ec7c-4ce8-88ba-df5f6d8f200c}
         Original Volume: (C:)\?\Volume{19d85eb0-cfad-4470-9e89-a04328b5b77e}\
         Shadow Copy Volume: \?\GLOBALROOT\Device\HarddiskVolumeShadowCopy10
         Originating Machine: DESKTOP-BICK9R2
         Service Machine: DESKTOP-BICK9R2
         Provider: 'Microsoft Software Shadow Copy provider 1.0'
         Type: ApplicationRollback
         Attributes: Persistent, No auto release, Differential, Auto recovered

C)

C:\WINDOWS\system32>VSSAdmin List ShadowStorage
vssadmin 1.1 - Volume Shadow Copy Service administrative command-line tool
(C) Copyright 2001-2013 Microsoft Corp.

Shadow Copy Storage association
   For volume: (C:)\?\Volume{19d85eb0-cfad-4470-9e89-a04328b5b77e}\
   Shadow Copy Storage volume: (C:)\?\Volume{19d85eb0-cfad-4470-9e89-a04328b5b77e}\
   Used Shadow Copy Storage space: 7.07 GB (3%)
   Allocated Shadow Copy Storage space: 7.53 GB (3%)
   Maximum Shadow Copy Storage space: 8.90 GB (4%)

D)

C:\WINDOWS\system32>VSSAdmin List Volumes
vssadmin 1.1 - Volume Shadow Copy Service administrative command-line tool
(C) Copyright 2001-2013 Microsoft Corp.

Volume path: C:\
    Volume name: \?\Volume{19d85eb0-cfad-4470-9e89-a04328b5b77e}\
Volume path: \?\Volume{5d73f98e-5a8e-4b74-a495-b255c196832d}\
    Volume name: \?\Volume{5d73f98e-5a8e-4b74-a495-b255c196832d}\
Volume path: \?\Volume{a9a124e4-7335-4dcd-9148-b9e46c95b119}\
    Volume name: \?\Volume{a9a124e4-7335-4dcd-9148-b9e46c95b119}\
Volume path: \?\Volume{558eb5d8-73cc-4d24-abe5-f5346f79ce64}\
    Volume name: \?\Volume{558eb5d8-73cc-4d24-abe5-f5346f79ce64}\
```
It's almost maxxed out (7.07 GB) with only 2 client-accessible restore points.  

By the way, retracing my steps at the start. I think the earlier restore points disappeared after I performed a factory(?) reset/install of my graphics driver (since that was what SupportAssist kept causing to crash).  
[\*separate to the full factory reset I did earlier]  
I'm not sure why that would cause restore points to vanish, or exactly what a driver factory reset entails (probably just as it sounds, but I didn't know it was an option before), but perhaps that explains it.  
  
I'm still a bit puzzled by system restore's behaviour, now I've been looking at it!  
  
(Sorry, post formatting stopped working a while ago and I'm not sure why!)
```
Was this answer helpful?

0 comments No comments
Anonymous

2021-04-25T04:05:58+00:00

(1) Well, you've got the latest version of Windows which is 20H2 (& even updated to the latest OS Build). That's good. Maybe the computer even came that way. Then, a reset to factory state (if/when necessary) will become that version again which is fine now. But you'll lose all of the installations, updates & files you've accumulated in the meantime. Also, soon the computer will upgrade to version 21H1. Then a factory reinstall loses that too.

So, definitely make Windows system images of your own. Those would return the computer to a more fully updated state (as/of the date the image was made) & will keep all your files too. Start making the images after you've got everything set & running well. Want instructions?

But, fine, keep the factory reinstall partition around at least until there is a feature update that lifts the computer to 21H1. I kept mine, actually, until my warranty ran out after a year (& then somewhat longer out of laziness). But once the upgrade comes in you may lose the ability to do a factory reset anyway, & the partition becomes wasted space. A regular Win 10 reset will happen instead.

(2) Oops, that's right, all computers even of the same model aren't always equipped the same. So. it's best to check in Device Manager to see you at least have the device that the driver is for. But hopefully the installer can tell & will refuse to install it anyway. But I clearly do recall when I finally went & checked at my site there were at least nine that hadn't come in on their own. I must add, it was fun, though, when one of them said at the site it was a certain version but actually wrote a lesser number into the Registry (or wherever). Finally, one day, I clicked for an update in Device Manager (search automatically), & it fetched an even greater version that stopped the merry-go-round. That one was coming in through "detect drivers" at the site. I kept Support Assist & Dell Update installed until my warranty ran out & then a bit more.

I think I would take Dell, Inc. - Firmware - 11/20/2018 12:00:00AM - 1.0.0.0.74. I trust Windows Update enough to deliver the right one. Also, I trust Dell enough to think it likely would refuse to install if inapplicable. A BING of it indicates such an update is legit.

(3) I'm amazed too how many restore points I've got -- 26 of them -- all the way back to my repair-install of 2004. And all in this space...

Well, one is created each time I do a Windows system image backup, & I do one for each new OS Build that comes in. The oldest one would take the computer back to OS Build 19041.450 -- that's 19 cumulative updates ago! Far too many for me ever to want to go there. But I can't recall that I've ever seen near as many there before, not that I go looking much. Maybe some have rematerialized of my having resized the shadow copy area up/down a few times. Maybe it was the VSSAdmin's that awakened some. Let's see yours...

(a) Type "CMD" into search, & click "Run as Administrator".

(b) Copy/paste the following commands...

VSSAdmin List Providers

VSSAdmin List Shadows

VSSAdmin List ShadowStorage

VSSAdmin List Volumes

Use Ctrl-A & Ctrl-C to copy, then paste it here.
Was this answer helpful?

0 comments No comments
Anonymous

2021-04-25T00:30:55+00:00

Elias, as long as you have System Restore enabled with 5-15% disk apportioned it should have points available when needed to roll back If not I've given you all possible repairs.

Let me know if there's anything else.

Also when ready please mark the post which helped most as the Answer (or Resolved), to help others. A rating is also appreciated.
Was this answer helpful?

0 comments No comments