System restore mysteries / shadow copies etc

Anonymous
2021-04-22T05:04:50+00:00

Hi,

New Windows 10 user here.
Have Googled/Binged around and still a bit puzzled about this.

So, System Restore is defaulted to "Off" in Windows 10. I understand some of the reasons for this, but still find it a useful tool.
(I left it like that, since it's still fresh and can basically just factory reset at this point)

Restore settings mention "using system protection on a drive that contains system image backups will cause other shadow copies to be deleted faster than normal"

OK. I'm not sure how fast "normal" is meant to be...

My Windows 10 came with Dell's SupportAssist installed, which apparently has its own recovery tools. Using it to download/install a few drivers, I noticed it had enabled Windows' System Restore by itself and created some restore points there.
(This came in useful because SupportAssist's driver updates resulted in a BSOD every time! I'll be uninstalling it...)

What set me wondering though, is I later noticed some errors in Event Viewer

"The shadow copies ... were aborted because the shadow copy storage could not grow due to a user imposed limit"

So it's already full?

8.90GB was set aside and I've barely done anything besides customise my user account!

Installed nothing!!

I then checked and all my restore points had gone too
This was strange because there haven't been any Windows - or even driver - updates in the meantime (which is usually the reason against keeping old restore points, for compatibility etc..?)

So I'm not getting shadow copies, and I'm not getting restore points...

What was more odd, was system restore was saying there were no restore points, but Current Usage showed 400-600MB in use.
What is this being used for?

Are they all these functions competing for the same space?
(and is this space barely enough for more than 1 of them to work properly?)

I don't really understand a great deal about system image backups, shadow copies, or restore points generally... I just know I should be backing up in some way.
Ideally in a way I don't have to mircomanage...

So hopefully someone could explain

System Image Backup

  • I can just reset to factory settings / reinstall Windows can't I, if things got really bad?
    Are there any likely cases where I wouldn't be able to?
    Is there any advantage (for the average Joe) in making a separate recovery drive to boot from?

> When the above warning mentioned a drive with "system image backups" (plural), what did it mean?
Is Windows automatically making many new system images itself?
Are they available to me?
(beyond the factory reset)

Shadow copies

  • Where can I find these / how can I access them?
    As long as I'm backing up my files regularly, I should mostly be fine.
    But it would be nice to get back the *exact* content I lost in the event of a crash. So how do I do this?

System restore

  • I'd like to have something with this functionality, but not if it's preventing the above functions from working.
    And I'm not into backing up my whole system to another drive on a daily basis, that seems like a lot of hassle

So basically, what's the best practice for low-effort safeguarding in the event of a failure to boot / hijack / loss of data etc?
I'm more confused than ever now

(I haven't noticed the shadow copy error in the last few days, and a new restore point was created. But I don't expect either to last like this for long...)

Thanks

Windows for home | Windows 10 | Windows update

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments
Answer accepted by question author
Anonymous
2021-05-04T01:22:14+00:00

(1) Your ReagentC shows partition 4 to be the Windows Recovery Environment partition. Shift+Restart will reboot to its recovery tools ("Choose an Option" screen). Normally, the computer also goes there when it has failed to boot Windows three times in a row. But going by that article I found, your computer will go to Partition 6 instead...

https://www.dell.com/support/kbdoc/en-in/000177401/restore-your-system-using-dell-supportassist-os-recovery

Restore your system using Dell SupportAssist OS Recovery

I don't see it saying it is making images or even just doing an independent backup & restore of user files. All I see is that you can do a factory reset (to the version of Windows that is on partition 5) or a fresh install of the latest Windows 10. You don't really want a factory reset after you've advanced to a greater version of Windows. It not only brings back the old version but also all the pre-installed Dell/Microsoft apps you've uninstalled along the way. And a fresh install of the latest version of Windows keeping files is what a regular reset will do anyway (without Dell's help). In either case, it will allow you to backup user files in concert with the reset & restore them afterward (but not apps). But the files will need to be accessible, i.e., whatever caused the catastrophe better not have messed with them. That's how I read it.

A Windows system image is superior because files, apps, & settings all are in the image, & apps that were deleted remain deleted when the image is restored. Also, Firewall rules are restored to that day. Only the ones you've changed since then will have to be changed again. And system images don't take terabytes. My three together occupy just 83.1 GB. A 3rd-party app could compress them even more...

That day I had to restore an image, everything was back as/of the date the image was made. But the choice is yours. And now I think your setup does possibly survive an upgrade-install because things work through BIOS & partition 6 instead of messing with the Windows recovery partition. But I really can't say for sure.

(2) That's right, Disk Management can't move a partition, & it can't expand a partition except into unallocated space immediately to the right of it. That's why a 3rd-party app is needed, but there's a bunch to choose from. It would have been nice had Dell decided to give us stuff Windows didn't already have on its own, but they didn't. If they ever do give us a partition manager, it likely will only do what Disk Management can already do.

(3) Yep, my DCOMCFG looks just like yours. Let us hope the VSS errors stay gone with Support Assist. But they almost sounded as if they could be ignored anyway. It certainly didn't keep you from getting a ton of shadow copies.

Was this answer helpful?

1 person found this answer helpful.
0 comments
Answer accepted by question author
Anonymous
2021-05-02T23:01:05+00:00

DISKPART> List Part

  Partition ###  Type             Size      Offset

  -------------  ------------  ---------  -------

  Partition 1    System         250 MB  1024 KB     <<<EFI system partition

  Partition 2    Reserved      128 MB    251 MB    <<<MSR (Microsoft Reserved)

  Partition 3    Primary        222 GB     379 MB    <<<Windows partition

  Partition 4    Recovery      990 MB    222 GB     <<<Recovery Environment partition 

  Partition 5    Recovery        13 GB     223 GB    <<<Factory reinstall partition

  Partition 6    Recovery    1309 MB    237 GB    <<<Or is this the RE partition?

Let's see "ReagentC  /Info" at an Admin Command Prompt. It will point to either partition 4 or 6 as the active Recovery Environment partition (Shift+Restart goes there)...

C:\WINDOWS\system32>ReagentC /Info

Windows Recovery Environment (Windows RE) and system reset configuration

Information:

    Windows RE status:         Enabled

    Windows RE location:    \?\GLOBALROOT\device\harddisk0*partition4*\Recovery\WindowsRE

    Boot Configuration Data (BCD) identifier: f8d976fc-df94-11ea-b1d0-74e6e2074932

    Recovery image location:

    Recovery image index:      0

    Custom image location:

    Custom image index:        0

REAGENTC.EXE: Operation Successful.

I think yours is partition 4 like mine. Then both partition 5 & 6 are expendable as soon as you begin to make system images of your own. I guess we could put a letter on partition 6 to see what's in it first...

DiskPart

Select  Disk  0

Select  Part  6

Assign  Letter=X    <<<Put letter X on partition 6

Exit

DIR  X:\  /a  /s       <<<Show contents of X:. Remove "/s" to show just the root directory.

DiskPart

Select Vol=X

Remove  Letter=X    <<<Remove the letter X

Exit

Partitions 5 & 6 can be deleted with DiskPart. Then a 3rd-party app will be required to move partition 4 fully rightward over the 14.3 GB of newly unallocated space. Finally, Disk Management can expand C:partition into that space. But we'd want you to be comfortable with Windows system images of your own (onto an external HDD) before doing so. I think Greg gave you instructions how to use Macrium Reflect. And that could indeed be worthwhile. But I am still a believer in Windows own image maker...

To backup the entire computer, make a Windows system image backup. It makes a backup of all the Windows partitions required to boot & run Windows:  EFI, MSR, Windows (C:), & Recovery. If you've got additional partition(s), they will also be offered for inclusion. (But likely that Dell factory reinstall partition won't be offered). A 2 TB external HDD is large enough to never fill with images. An 8 GB flash drive should be large enough to hold a Recovery drive (used to restore an image).

I make one after each new OS Build comes in & runs well, & I keep the last three...

Image

I rename the computername folder which is inside the WindowsImageBackup folder (by appending the OS Build to it) in order to keep them separate & distinct. All three will be offered during the restore process.

Make it at "START, Settings, Update & Security, Backup, Go to backup & Restore (Win 7), Create a system image". Afterward, make the Repair Disc or (even better) ask Cortana for Recovery Drive to put it on USB. That can be used to do a restore. Then see the following to know how to restore one...

https://answers.microsoft.com/en-us/windows/forum/windows_10-update/how-to-restore-a-windows-10-system-image-to-an/e20992ca-5641-4f7c-bb09-3895d0732162

How to restore a Windows 10 system image to an existing or larger storage device

https://www.winhelp.us/restore-a-system-image-in-windows-7.html

Restore a System Image Backup in Windows 7, 8, 8.1 and 10

Note: That is an informative 3rd-party site, but I know nothing (good or bad) about any downloads or links that are there (or anywhere else).

If your external hard drive (or the internal one I guess) is a Seagate or Maxtor, there will be a free version of Acronis True Image at their site. Seagate calls it DiscWizard. Macrium Reflect, AOMEI Backupper & others also offer free versions of their image makers. These 3rd-party apps are quicker, make more compact images, & are more flexible in use. But the Windows version works in under 15 minutes on my small & uncomplicated system. I must add, DiscWizard's Bootable Media (to restore an image when Windows won't boot) requires a Mouse to operate. Plug one in, & it is instantly recognized.

Was this answer helpful?

1 person found this answer helpful.
0 comments

61 additional answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Anonymous
    2021-05-03T20:01:05+00:00

    Yes you were correct
    It seems it's too long to post in full...

    C:\WINDOWS\system32>ReagentC /info

    Windows Recovery Environment (Windows RE) and system reset configuration

    Information:

        Windows RE status:         Enabled

        Windows RE location:       \?\GLOBALROOT\device\harddisk0\partition4\Recovery\WindowsRE

        Boot Configuration Data (BCD) identifier: 553424e7-03e9-11eb-86bf-30d04202cd4d

        Recovery image location:

        Recovery image index:      0

        Custom image location:

        Custom image index:        0

    REAGENTC.EXE: Operation Successful.

    C:\WINDOWS\system32>DIR X:\ /a /s

     Volume in drive X is DELLSUPPORT

     Volume Serial Number is 8E4F-7240

     Directory of X:\

    01/10/2020  14:18    <DIR>          apps

    02/05/2021  02:41    <DIR>          data

    03/05/2021  05:58    <DIR>          Logs

    12/04/2021  16:30    <DIR>          pictures

    02/05/2021  20:26    <DIR>          sources

    23/03/2021  15:51    <DIR>          System Volume Information

    02/05/2021  21:08    <DIR>          telemetry

                   0 File(s)              0 bytes

     Directory of X:\apps

    01/10/2020  14:18    <DIR>          .

    01/10/2020  14:18    <DIR>          ..

    02/05/2021  21:07    <DIR>          bin

    14/04/2021  15:39    <DIR>          docs

    03/05/2021  05:58    <DIR>          fonts

                   0 File(s)              0 bytes

     Directory of X:\apps\bin

    02/05/2021  21:07    <DIR>          .

    02/05/2021  21:07    <DIR>          ..

    14/04/2021  15:39            17,592 Authentication.dll

    14/04/2021  15:39           240,824 Autofac.dll

    14/04/2021  15:39            23,224 BIOSiQUtils.dll

    14/04/2021  15:39            57,016 BootupSOS.exe

    14/04/2021  15:39    <DIR>          browsersupport

    14/04/2021  15:39           138,936 CloudDownload.dll

    14/04/2021  15:39            22,712 CommandUtils.dll

    14/04/2021  15:39            19,128 Common.Logging.Core.dll

    14/04/2021  15:39            53,432 Common.Logging.dll

    14/04/2021  15:39           147,128 CommonNative.dll

    14/04/2021  15:39    <DIR>          content

    14/04/2021  15:39            25,272 CryptoUtils.dll

    14/04/2021  15:39           205,496 DdmErase.dll

    14/04/2021  15:39           104,120 Dell.Pla.LogFile.Capture.SDK.dll

    14/04/2021  15:39            26,808 Dell.Pla.P1.Common.dll

    14/04/2021  15:39            81,592 Dell.Pla.P1.MessageClient.dll

    14/04/2021  15:39            51,384 DellSupportCore.dll

    01/10/2020  14:18    <DIR>          diags

    14/04/2021  15:39            89,272 diskmgmt.dll

    14/04/2021  15:39            29,880 DriveInfo.dll

    14/04/2021  15:39            16,056 EraseWrapper.dll

    14/04/2021  15:39            14,520 EraseWrapperUtils.dll

    14/04/2021  15:39            66,744 EsupportServiceClientLib.dll

    14/04/2021  15:39         2,981,048 File_Restore.exe

    22/05/2020  11:50             1,022 File_Restore.exe.config

    14/04/2021  15:39           134,840 FIRCore.dll

    14/04/2021  15:39            55,992 FIRCoreWrapper.dll

    14/04/2021  15:39           327,864 Google.ProtocolBuffers.dll

    14/04/2021  15:39           143,544 HtmlAgilityPack.dll

    01/10/2020  14:18    <DIR>          Images

    14/04/2021  15:39            79,544 InstantRestore.Core.dll

    14/04/2021  15:39         4,407,992 InstantRestore.dll

    14/04/2021  15:39    <DIR>          lib

    14/04/2021  15:39         2,307,256 libxml2.dll

    22/05/2020  11:50             2,686 LICENSE_MS-PL

    14/04/2021  15:39            21,176 log.dll

    14/04/2021  15:39           279,224 log4net.dll

    14/04/2021  15:39            26,296 LogUploader.dll

    14/04/2021  15:39            20,664 LogUploadUtils.dll

    14/04/2021  15:39            15,032 LogUtil.exe

    14/04/2021  15:39           297,656 mailbox.dll

    14/04/2021  15:39           121,016 MainOSProfile.dll

    14/04/2021  15:39        11,402,936 MainUI.exe

    22/05/2020  11:50               570 MainUI.exe.config

    14/04/2021  15:39           472,760 ManagedWMI.dll

    14/04/2021  15:39            15,032 Microsoft.Azure.KeyVault.Core.dll

    14/04/2021  15:39            78,520 Microsoft.ComponentStudio.Common.dll

    14/04/2021  15:39           120,504 microsoft.componentstudio.ComponentPlatformImplementation.dll

    14/04/2021  15:39           264,888 Microsoft.ComponentStudio.ComponentPlatformInterface.dll

    14/04/2021  15:39            54,456 Microsoft.ComponentStudio.Serializer.dll

    14/04/2021  15:39            66,232 Microsoft.Dism.dll

    14/04/2021  15:39            69,304 Microsoft.Rest.ClientRuntime.Azure.dll

    14/04/2021  15:39            73,912 Microsoft.Rest.ClientRuntime.dll

    14/04/2021  15:39         3,552,952 Microsoft.ServiceBus.dll

    14/04/2021  15:39            58,552 Microsoft.Wim.dll

    14/04/2021  15:39         1,198,776 Microsoft.WindowsAzure.Storage.dll

    14/04/2021  15:39           144,568 Microsoft.Xaml.Behaviors.dll

    14/04/2021  15:39    <DIR>          Migration

    22/05/2020  11:49           122,192 migration.instantrestore.xml

    14/04/2021  15:39           627,896 msvcp140.dll

    14/04/2021  15:39            55,992 NativeWrapper.dll

    14/04/2021  15:39            98,488 Newtonsoft.Json.Bson.dll

    14/04/2021  15:39           701,112 Newtonsoft.Json.dll

    14/04/2021  15:39           123,064 NFluent.dll

    14/04/2021  15:39           125,624 NTCore.dll

    14/04/2021  15:39            58,040 OSFeedback.dll

    14/04/2021  15:39            15,544 OSRepairWrapper.dll

    14/04/2021  15:39    <DIR>          osri

    14/04/2021  15:39           214,200 OSRIUtils.dll

    14/04/2021  15:39             8,820 Param.xml

    14/04/2021  15:39             7,062 Param_Everything.xml

    14/04/2021  15:39           335,544 platformconfig64.exe

    14/04/2021  15:39           898,744 Quartz.dll

    14/04/2021  15:39    <DIR>          ramdisk

    14/04/2021  15:39           106,680 Registry.dll

    01/10/2020  14:18    <DIR>          res

    14/04/2021  15:39           175,288 RestSharp.dll

    14/04/2021  15:39               936 SDS.xml

    14/04/2021  15:39            97,976 SDSCompFLZ64.dll

    14/04/2021  15:39           139,960 SDSCompZIP64.dll

    14/04/2021  15:39         2,246,328 SDSImageTools.dll

    14/04/2021  15:39         1,415,352 SDSMigrationTools.dll

    14/04/2021  15:39         3,661,496 SDSSmartRepairLocal.dll

    14/04/2021  15:39        13,143,736 SDSSmartRepairTools.dll

    14/04/2021  15:39         3,894,456 SDSSnapshotProcess.dll

    14/04/2021  15:39    <DIR>          selfupdate

    14/04/2021  15:39            49,336 SelfUpdateUtils.dll

    14/04/2021  15:39           135,864 Serilog.dll

    14/04/2021  15:39            37,048 Serilog.Sinks.File.dll

    14/04/2021  15:39            76,984 SmartRepairToolsWrapper.dll

    14/04/2021  15:39            20,664 soscore.dll

    14/04/2021  15:39            81,592 SOSDataContract.dll

    14/04/2021  15:39            45,752 SOSExplorer.exe

    14/04/2021  15:39            88,248 STVssMVista.dll

    14/04/2021  15:39            97,976 STVssMVista64.dll

    22/05/2020  11:49                78 ST_LOG.INI

    14/04/2021  15:39           177,848 System.Net.Http.Formatting.dll

    14/04/2021  15:39           315,576 SystemHelper.dll

    14/04/2021  15:39             4,521 sys_settings_sos.xml

    14/04/2021  15:39            45,240 TelemetryWrapper.dll

    14/04/2021  15:39            20,664 Toqe.Downloader.Business.Contract.dll

    14/04/2021  15:39           121,528 Toqe.Downloader.Business.dll

    14/04/2021  15:39            79,032 UnattendUtils.dll

    14/04/2021  15:39           169,144 USMTUtils.dll

    14/04/2021  15:39           574,648 utilities.dll

    14/04/2021  15:39            81,592 vcruntime140.dll

    14/04/2021  15:39           639,160 VSSX64.exe

    14/04/2021  15:39            42,168 WinPEDiags.dll

    14/04/2021  15:39           331,960 Xceed.Compression.v6.6.dll

    14/04/2021  15:39           160,440 Xceed.FileSystem.v6.6.dll

    14/04/2021  15:39            58,040 Xceed.FileSystem.Windows.v6.6.dll

    14/04/2021  15:39           393,912 Xceed.Zip.v6.6.dll

    14/04/2021  15:39           109,752 xmlhelper.dll

    14/04/2021  15:39            97,976 zlibwapi.dll

    14/04/2021  15:39           429,752 zxing.dll

                 105 File(s)     62,988,975 bytes

    Directory of X:\apps\bin\browsersupport

    14/04/2021  15:39    <DIR>          .

    14/04/2021  15:39    <DIR>          ..

    14/04/2021  15:39           277,688 UIAnimation.dll

                   1 File(s)        277,688 bytes

    (etc)

    Was this answer helpful?

    0 comments
  2. Anonymous
    2021-05-03T04:38:29+00:00

    (1) I found this for that VSS error...

    http://kb.naturalnetworks.com/article/36/resolve-vss-error-8194-event-viewer-415.html#:~:text=Error%20code%208194%20is%20an%20%22Accessed%20Denied%22%20error,%28Microsoft%20programming%20interface%20to%20the%20Volume%20Shadow%20Service%29.

    Resolve VSS Error 8194 Event Viewer

    (a) After opening dcomcnfg, I had to double-click "Computers" to see "My Computer"...

    Image

    (b) When I got to step 6, I could not find a Network Services account.

    Maybe your configuration is different & you will find it. Good luck.

    (2) I've got a MPLog where you do...

    Image

    Its date matches as does yours to the bottom of the log & with the timestamp off by 3 hours...

    Stopped On 03-09-2021 03:03:47 (Exit Code = 0x0)

    ************************************************************

    But I see no future date within the log itself above that line. Not sure what to make of that, but it does seem weird.

    Was this answer helpful?

    0 comments
  3. Anonymous
    2021-05-03T03:38:24+00:00

    Your shadow copies still look OK far as I can see. You've got a new set of 12 now from 26/04/2021 to 02/05/2021. Earlier you had just 10 from 20/04/2021 to 25/04/2021. I guess you are getting more due to activity in Support Assist. Now that it's uninstalled, you may get fewer.

    I've still just got 5. The earliest two dropped off & were replaced by two new ones that correspond to this activity in my restore points...

    Image

    I've got a shadow copy that matches the date/time of each restore point that isn't a system image. It looks like my Windows keeps five, deleting the oldest for each new one. It doesn't touch the system image restore points. And, in fact, when I accidently clicked to restore one of those, I got this...

    Image

    So, those are actually located on my external HDD that holds the image itself. I can examine them with the drive unplugged, but not restore them. I'm sure restoring a system image restore point wouldn't be the same as restoring the image itself. It would just be the same as restoring a normal restore point: it would undo settings & driver/program/quality updates done after that restore point was made.

    Your shadow copies that do not match the date/time of your two restore points I guess are due to something Support Assist did. Or are you making image backups through a Dell app too?

    Was this answer helpful?

    0 comments