Eraser 5.7 unused space wipe stops System Restore

[Kane's son]

Use of the 'Erase unused space' option on Eraser v. 5.7 to overwrite
freespace deactivates System Restore on XP Home SP1. I think this happens as
SR is set to deactivate if freespace falls below 200 kb and Eraser trips
this. Does anyone know of a workaround to maintain restore points over an
erase cycle or another overwriter that keeps the restore data. Thanks.

 

[Carey Frisch [MVP]]

Microsoft does not support using a program such as
Eraser v. 5.7. I suggest you do not use it. For further
assistance, visit:

Eraser Support Forums
http://www.cipherserver.com/phpbb2/viewforum.php?f=2&sid=a84caf3c47f02976b206d95213379e27

--
Carey Frisch
Microsoft MVP
Windows XP - Shell/User

Be Smart! Protect Your PC!
http://www.microsoft.com/athome/security/protect/default.aspx

----------------------------------------------------------------------------

:

| Use of the 'Erase unused space' option on Eraser v. 5.7 to overwrite
| freespace deactivates System Restore on XP Home SP1. I think this happens as
| SR is set to deactivate if freespace falls below 200 kb and Eraser trips
| this. Does anyone know of a workaround to maintain restore points over an
| erase cycle or another overwriter that keeps the restore data. Thanks.
|
| --
| Regards

 

[John Barnett MVP]

Carey are there specific reason why you personally suggest that Eraser not
be used? I use the product daily for erasing sensitive files and find it
extremely useful. I also erase the free space as and when i feel the need.
To be honest i haven't checked to see if it de-activates system restore i
will have to check the next time i erase the freespace on my drive. I
particularly find it useful when imagin my hard drive. Prior to creating an
image i disable system restore, disable hibernate, run chkdsk and then erase
the free space. Aftert his has been completed it run defrag to clean
everything up and then re-enable system restore before finally imaging the
drive. Hibernate is left disabled until i need to reimage the drive, simply
to save on disk space.
I feel sometimes that if it were left to Microsoft, Microsoft products would
be all we would be using on our pc's. A back door restrictive practice
perhaps Either way there are some good third party apps out there and
they are certainly worth using regardless of whether microsoft approve or
not.

 

[Tom]

Well said!

But as an MS zealot that Carey is, it is more than likely he doesn't even purchase foodstuffs that are not approved by MS labs (i.e. WHQL certified)! Carey is a microsoldier to the nth degree, and does what he is told by by the soothsayers from the Redmond Temple. IF MS doesn't (actually) have an ad partner, they typically DO NOT recommend certain programs/softwares to run in conjunction with theirs.

I can name quite a few software makers that MS supports, where the majority of users have terrible experiences using them. (Anything Symantec comes to mind)

 

[Carey Frisch [MVP]]

If Eraser v.5.7 causes a problem with Windows XP,
it is a problem associated with the development
of Eraser v.5.7 and not Windows XP.

--
Carey Frisch
Microsoft MVP
Windows XP - Shell/User

Be Smart! Protect Your PC!
http://www.microsoft.com/athome/security/protect/default.aspx

 

[johnf]

Agree completely - a typical example is the fact that although otherwise
strongly advised for months - Kane's son is still running SP1 instead of
SP2!!

As far as John's comments go - I thought the golden rule was to thoroughly
do your homework first - Google-search for any discussion groups on that
3rd. party app., etc., then & only then, consider installing it (after
setting a restore point). FFS, MS can't monitor, comment or re-write their
software for all that junk out there!

 

[Vanguard]

Use of the 'Erase unused space' option on Eraser v. 5.7 to overwrite
freespace deactivates System Restore on XP Home SP1. I think this
happens as
SR is set to deactivate if freespace falls below 200 kb and Eraser
trips
this. Does anyone know of a workaround to maintain restore points over
an
erase cycle or another overwriter that keeps the restore data. Thanks.

System Restore is not dependable. You will lose restore points or they
can become corrupted, so your reliance on System Restore to cover your
bet is about as effective as using just a Kevlar vest and hope you don't
get shot in the extremities (head, arms, legs). System Restore only
saves *system* files (and a FEW program files) and data (like the
registry) and do nothing for user or application data or executables;
after all, it is called SYSTEM Restore, not Platform Snapshot. It won't
even rollback to exactly the same state for many drivers, like printer
drivers, so you can't depend on it to recover when a new driver doesn't
work and you want to go back to the prior driver version. System
Restore only works when some event triggers it to save a restore point.
You would think that installing a program would trigger the save of a
restore point but, no, the install must use the new installer service to
trigger a restore point save, and there are still lots of programs that
use non-MSI install programs. One of the first steps you need to do
when eradicating a virus is to turn off System Restore and reboot to
wipe all the restore points because System Restore will save all those
infected files in the restore points. There are LOTS of MS
knowledgebase articles on what System Restore will not save or restore.
System Restore is not the equivalent of GoBack. System Restore does NOT
obviate the need for logical backups for data restores and drive images
for quick system recovery.

It might actually be a good thing that Eraser triggers System Restore to
wipe its snapshots because of reducing the temporary amount of free disk
space during the wipe (http://support.microsoft.com/?id=300044). If you
are erasing unused disk space (rather than erasing just some files) then
you probably also don't want to keep around those old restore points.
Consider it part of the cleanup. After all, System Restore doesn't
provide itself with an easy option to purge all those often superfluous
restore points.

 

[Kane's son]

System Restore is not dependable. You will lose restore points or
they can become corrupted, so your reliance on System Restore to
cover your bet is about as effective as using just a Kevlar vest and
hope you don't get shot in the extremities (head, arms, legs).
System Restore only saves *system* files (and a FEW program files)
and data (like the registry) and do nothing for user or application
data or executables; after all, it is called SYSTEM Restore, not
Platform Snapshot. It won't even rollback to exactly the same state
for many drivers, like printer drivers, so you can't depend on it to
recover when a new driver doesn't work and you want to go back to the
prior driver version. System Restore only works when some event
triggers it to save a restore point. You would think that installing
a program would trigger the save of a restore point but, no, the
install must use the new installer service to trigger a restore point
save, and there are still lots of programs that use non-MSI install
programs. One of the first steps you need to do when eradicating a
virus is to turn off System Restore and reboot to wipe all the
restore points because System Restore will save all those infected
files in the restore points. There are LOTS of MS knowledgebase
articles on what System Restore will not save or restore. System
Restore is not the equivalent of GoBack. System Restore does NOT
obviate the need for logical backups for data restores and drive
images for quick system recovery.

It might actually be a good thing that Eraser triggers System Restore
to wipe its snapshots because of reducing the temporary amount of
free disk space during the wipe
(http://support.microsoft.com/?id=300044). If you are erasing unused
disk space (rather than erasing just some files) then you probably
also don't want to keep around those old restore points. Consider it
part of the cleanup. After all, System Restore doesn't provide
itself with an easy option to purge all those often superfluous
restore points.

Thanks for this. Didn't ask as to the effectivity of SR in a backup regime I
asked if there was a method by which SR points could be maintained across a
freespace wipe.

 

[Kane's son]

Agree completely - a typical example is the fact that although
otherwise strongly advised for months - Kane's son is still running
SP1 instead of SP2!!

As far as John's comments go - I thought the golden rule was to
thoroughly do your homework first - Google-search for any discussion
groups on that 3rd. party app., etc., then & only then, consider
installing it (after setting a restore point). FFS, MS can't monitor,
comment or re-write their software for all that junk out there!

I have SP1 otherwise fully updated and have planned to upgrade to SP2 when I
have time. Running SP1 is not evidence of sloppy maintenance and does not
make my comment suspect. The problem is neither with the development of
Eraser or XP it derives from running both. As I said it arises from SR
deactivating itself if drive space falls below 200 KB which the unused space
wipe causes. I asked if anyone knew a workaround. Eraser is perfectly stable
on this system and is a sound program.

 

[johnf]

200KB? what size drive do you have?


--

johnf

I have SP1 otherwise fully updated and have planned to upgrade to SP2
when I have time. Running SP1 is not evidence of sloppy maintenance and
does not make my comment suspect. The problem is neither with the
development of Eraser or XP it derives from running both. As I said it
arises from SR deactivating itself if drive space falls below 200 KB
which the unused space wipe causes. I asked if anyone knew a
workaround. Eraser is perfectly stable on this system and is a sound
program.

 

[Tom]

If Eraser v.5.7 causes a problem with Windows XP,
it is a problem associated with the development
of Eraser v.5.7 and not Windows XP.

--
Carey Frisch
Microsoft MVP
Windows XP - Shell/User

Be Smart! Protect Your PC!
http://www.microsoft.com/athome/security/protect/default.aspx

So! What does that have to do with your comment about "MS not supporting xxxxx". This is what was taken to you in reply, not that the fact that there may be a problem with a program that doesn't (through your MS spectacles) work in XP. Bottom line is; you only support products that MS approves, good or not!

 

[John Barnett MVP]

Carey i appreciate and endorse your comments about 'if eraser causes a
problem with XP it is a problem associated with Eraser and not XP'
My question simply was ' what are your personal reasons for not using it.?'
I review software and, obviously, my personal feeling work there way into
any review. But i don't tell my readers to 'not use it' unless i can
elaborate on why, in my opinion, the software is unsuitable.
Contrary to popular belief (software manufacturer's and developers in
particular) it is reviews and word of mouth that sells software 'not' an
advertising campaign costing millions of pounds ($). The ad merchants only
highlight the good points, a good review highlights both good and bad. It is
then up to the consumer to decide whether to use the product or not.

 

[Vanguard]

Thanks for this. Didn't ask as to the effectivity of SR in a backup
regime I
asked if there was a method by which SR points could be maintained
across a
freespace wipe.

Clue: http://support.microsoft.com/?id=263455

But because the OS protects this directory, you can't do anything to it,
like access its files. Windows XP keeps the hidden restore directory
protected so that its contents can't be manipulated by anybody or
anything. None of the anti-virus makers tell you how to keep some of
the files (i.e., the good ones) so it can delete or quarantine just the
bad ones. They all say to turn off System Restore but that simply wipes
out all the contents of this hidden and protected directory.

Articles for anti-virus programs claim the restore directory is
<d>:\_Restore (where <d>: is your OS partition for Windows) yet a few
articles, like http://www.kellys-korner-xp.com/xp_restore.htm, say
restore points are saved under <d>:\system volume
information\_restore{558C94FD-3C7F-4954-A02D-
26679E6D849E}, and that "each restore point's files are saved in a
folder named RPXX where XX is a two digit number corresponding to the
restore point." I suspect the confusion lies in System Restore is
available for Windows ME and Windows XP. You won't be able to navigate
under the "System Volume Information" directory because the OS protects
it even against admin-level accounts. The SRDIAG.exe utility (mentioned
in above article) only extracts or exports the restore point
information. It cannot be used to import it.

While I have seen VB scripts that can programmatically extract restore
point information, like XPSystemRestore.vbs at
http://www.billsway.com/notes_public/WinXP_Tweaks/, that is like
SRDIAG.exe that can only export and cannot import (the script can also
create a new restore point but it has the OS do it).

So while you can create restore points automatically, manually, or
programmatically and you can extract them for diagnosis, I have yet to
find anything that lets you export and then import restore points to
compensate for System Restore's "safety" feature when disk space gets
low. Apparently no one else knows, either, and unfortunately the
subthread started by Carey turned into a side issue about what Microsoft
does or does not support. Obviously Microsoft itself only supports
Microsoft products just like any brand-X maker supports only brand-X
products so that wasn't anything new. I figured someone might reply who
knew how to do the SR export/import that you wanted but it doesn't look
like it is possible, so get used to losing restore points when using
Eraser to wipe unused disk space, or any other application that locks
out disk space that makes the OS think disk space is under some minimum
threshold. That's why I mentioned that losing restore points is not
much of a loss, anyway. If you want to ensure decent recovery, System
Restore ain't it.

 

[Noel Paton]

System Restore is a State Manager - NOT a Backup manager.
As such, its be-all and end-all is to safeguard a limited number of files in
a limited number of places, and enable the user to reverse the clock on
their manipulation.
ANY user-participation in such a process is very likely to break said
process - which is why MS effectively prohibited it, and why it's only fools
who attempt it.

Recovering data from the store is fair game - but attempting to insert data
into it is almost certainly going to lead to grief and recriminations, so
give up before you start! That's why no-one has written a utility for doing
so - and I sincerely hope that no-one ever does!

--
Noel Paton (MS-MVP 2002-2005, Windows)

Nil Carborundum Illegitemi
http://www.btinternet.com/~winnoel/millsrpch.htm
http://tinyurl.com/6oztj

Please read on how to post messages to NG's