Use of System Restore followed by great loss of disk space

[johnnino]

This week I tried four or five restore points in an attempt to get Windows to
start. Once the problem was resolved I discovered that my used disk space
had gone from 72 GB to 108 GB! (250 GB capacity). Disk Cleanup shows only a
couple of hundred MB of disposable files. I peeked into the System Restore
file and saw that it now occupies 37.4 Gb of disk space.

I assume I have nearly the same number of restore points now as before the
operation. My question is, does activating restore points consume disk space
beyond the space occupied by the points themselves?

The more important question is how do I clean this up? Is my only option to
wipe out all the restore points and then restart System Restore? I'd rather
not lose this month's restore points until I have a better grasp on what
caused my crash. What happens if I only reduce the amount of space allocated
to System Restore, currently at the maximum of 12%. Would I then lose only
the oldest points? Would I stand to recover a lot of the lost space?

Any guidance would be appreciated. Thanks.

 

[Jerry]

Go to Accessoies > System Tools > Disk Cleanup > select the Windows drive >
wait > More Options > System restore > cleanup - this will delete/remove all
but the most recent restore points.

 

[johnnino]

Thanks for the reminder on the System Restore cleanup procedure. I suppose
this is the way I'll have to go once I'm sure I'm ready to say goodbye to all
but the last backup. Any idea why the used disk space shot up so rapidly?
Does activating a restore point eat up gigabytes of space? Or was disk usage
being reported erroneously before or after the activation?

 

[Gerry]

The default allocation to System Restore is 12% on your C partition
which is over generous. I would reduce it to 700 mb. Right click your My
Computer icon on the Desktop and select System Restore. Place the cursor
on your C drive select Settings but this time find the slider and drag
it to the left until it reads 700 mb and exit. When you get to the
Settings screen click on Apply and OK and exit.

What firewall do you use?


--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

 

[johnnino]

You're quite right. I don't need 12% of the disk for restore points. But if
I proceed directly to reducing space to 700MB, will I get a good cleanup of
the used disk space?

My firewall is Zone Alarm :7.0.483.000.

Thanks.

 

[Gerry]

Zone Alarm does seem to create problems with System Restore. Version
7.0.408.000 certainly caused problems. It can cause restore points not
to work and you can get bloated restore points. The situation can get
confusing with regard to try trying to revert to earlier restore points
as there are a number of anti-virus programmes, which also interfere.
Bloated restore points is definitely a Zone Alarms phenomenon. Zone Labs
has not really documented the problems or recorded solutions.

This link gives more but it is now dated advice:
http://bertk.mvps.org/html/srfail.html

Another link covering System Restore also somewhat dated:
http://www.bleepingcomputer.com/tutorials/tutorial56.html

I would be interested in seeing a Disk Defragmenter report . Open Disk
Defragmenter and click on Analyse. Select View Report and click on Save
As and Save. Now find VolumeC.txt in your My Documents Folder and post a
copy. Do this before running Disk Defragmenter as it is more
informative. Make sure the Most Fragmented Files list is included.

--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

 

[johnnino]

It's interesting you should bring up Zone Alarm and anti-virus programs. You
see, Windows crashed because I was torpedoed by my own anti-virus. I was one
of the victims of the AVG false positive a little over a week ago. In my
case it was winsrv.dll that got eliminated. And I got no warning, no notice
of a suspected virus. AVG 7.5 just went ahead and acted on its own. So when
Windows refused to start, I had no inkling that the antivirus was involved.
I was casting around for possible causes, undoing recent installations -- and
trying various restore points. It was only when I uninstalled AVG that
Windows started and I discovered that my used disk space had grown like Topsy.

Now to your suggestion. Here's the Disk Defragmenter report. I look
forward to your analysis of the analysis. Thanks.

Volume (C
Dimensioni volume = 228 GB
Dimensioni cluster = 4 KB
Spazio utilizzato = 109 GB
Spazio disponibile = 119 GB
Percentuale spazio libero = 52 %

Frammentazione volume
Frammentazione totale = 1 %
Frammentazione file = 2 %
Frammentazione spazio libero = 0 %

Frammentazione file
File totali = 109.690
Dimensioni medie file = 1 MB
Totale file frammentati = 846
Totale frammenti in eccesso = 15.995
Media frammenti per file = 1,14

Frammentazione file di paging
Dimensioni file di paging = 1,95 GB
Totale frammenti = 2

Frammentazione cartella
Cartelle totali = 9.638
Cartelle frammentate = 40
Frammenti di cartella in eccesso = 966

Frammentazione Tabella file master (MFT)
Dimensioni totali Tabella file master (MFT)= 118 MB
Conteggio record Tabella file master (MFT) = 120.438
Percentuale Tabella file master (MFT) in uso= 99 %
Totale frammenti Tabella file master (MFT) = 3

--------------------------------------------------------------------------------
Frammenti Dimensioni file File maggiormente frammentati
1,180 7 MB \Programmi\Alwil
Software\Avast4\DATA\integ\avast.int
1,019 4 MB \WINDOWS\ntbtlog.txt
973 62 MB \WINDOWS\system32\Restore\rstrlog.dat
490 31 MB \System Volume
Information\_restore{314B27D0-4D8E-4EB9-93E3-D4C722A597B0}\RP636\snapshot\_REGISTRY_MACHINE_SOFTWARE
335 31 MB \System Volume
Information\_restore{314B27D0-4D8E-4EB9-93E3-D4C722A597B0}\RP635\snapshot\_REGISTRY_MACHINE_SOFTWARE
293 1 MB \System Volume
Information\_restore{314B27D0-4D8E-4EB9-93E3-D4C722A597B0}\RP641
267 31 MB \System Volume
Information\_restore{314B27D0-4D8E-4EB9-93E3-D4C722A597B0}\RP629\snapshot\_REGISTRY_MACHINE_SOFTWARE
196 832 KB \System Volume
Information\_restore{314B27D0-4D8E-4EB9-93E3-D4C722A597B0}\RP642
189 832 KB \Documents and Settings\John
Guerrini\Documenti\Immagini\Scheda luglio 06\Thumbs.db
184 30 MB \System Volume
Information\_restore{314B27D0-4D8E-4EB9-93E3-D4C722A597B0}\RP626\snapshot\_REGISTRY_MACHINE_SOFTWARE
175 1 MB \WINDOWS\Internet Logs
130 517 KB
\RECYCLER\S-1-5-21-629326616-832064773-2655755788-1005\Dc101.log
109 522 KB \WINDOWS\msxml6-KB954459-enu-x86.LOG
109 7 MB \System Volume
Information\_restore{314B27D0-4D8E-4EB9-93E3-D4C722A597B0}\RP637\snapshot\_REGISTRY_MACHINE_SYSTEM
106 7 MB \System Volume
Information\_restore{314B27D0-4D8E-4EB9-93E3-D4C722A597B0}\RP642\snapshot\_REGISTRY_MACHINE_SYSTEM
101 7 MB \System Volume
Information\_restore{314B27D0-4D8E-4EB9-93E3-D4C722A597B0}\RP639\snapshot\_REGISTRY_MACHINE_SYSTEM
99 396 KB \System Volume
Information\_restore{314B27D0-4D8E-4EB9-93E3-D4C722A597B0}\RP640
94 1 KB \WINDOWS\system32\config\software.LOG
89 27 MB
\RECYCLER\S-1-5-21-629326616-832064773-2655755788-1005\Dc50.exe
81 7 MB \System Volume
Information\_restore{314B27D0-4D8E-4EB9-93E3-D4C722A597B0}\RP640\snapshot\_REGISTRY_MACHINE_SYSTEM
77 7 MB \System Volume
Information\_restore{314B27D0-4D8E-4EB9-93E3-D4C722A597B0}\RP638\snapshot\_REGISTRY_MACHINE_SYSTEM
73 12 MB \WINDOWS\system32\drivers\fidbox.dat
72 1 KB \Documents and Settings\John
Guerrini\ntuser.dat.LOG
67 6 MB \Documents and Settings\John
Guerrini\Impostazioni locali\Dati
applicazioni\Mozilla\Firefox\Profiles\qlcco9g2.default\Cache\_CACHE_003_
64 1,023 KB \System Volume
Information\_restore{314B27D0-4D8E-4EB9-93E3-D4C722A597B0}\RP640\change.log.3
64 1,023 KB \System Volume
Information\_restore{314B27D0-4D8E-4EB9-93E3-D4C722A597B0}\RP639\change.log.4
64 1,023 KB \System Volume
Information\_restore{314B27D0-4D8E-4EB9-93E3-D4C722A597B0}\RP640\change.log.8
64 1,024 KB \System Volume
Information\_restore{314B27D0-4D8E-4EB9-93E3-D4C722A597B0}\RP638\change.log.2
64 1,024 KB \System Volume
Information\_restore{314B27D0-4D8E-4EB9-93E3-D4C722A597B0}\RP639\change.log.13

 

[johnnino]

Situation report: I defragmented the disk. A long time was spent processing
the Restore files. When it was all over, only two Restore files remained
fragmented. But used disk space was unchanged.

I then reduced the allowance for System Restore from the maximum of 12% to
5% (by the way my slider doesn't really slide -- it hops. There was no 6%).
A month of the oldest restore points disappeared but the gain in disk space
was only 4 GB (from 105 to 101 GB). The System Restore Folder, however
showed a decrease from 37.4 to 30.2 GB in size on disk. By the way, both
figures are far in excess of the respective 12% and 5% per cent limits.

Next step, I took a look at the System Volume Information folder with Tree
Size Free. There I saw right away that a few of the most recent restore
folders were truly gargantuan -- 5 GB, 6 GB and even 13,7GB. Clearly, once
these are gone, I should have all my disk space back. Two points: these are
almost certainly the restore points I activated, sometimes more than once.
And I notice that, unlike most of the other restore points, they are not
compressed. So I wonder, does applying a restore point always lead to a
ballooning of the folder -- and is that because it is no longer compressed?

This is the technical curiosity of a novice. After following up the leads
provided to me in this forum I know now where my disk space went and how to
get it back. So thanks Jerry and Gerry -- I'm off to pare my restore points
to the bare minimum.

 

[Gerry]

johnnino

Disable Zone Alarm and enable the Windows Firewall. Manually Create a
Restore Point:
http://bertk.mvps.org/html/createrp.html

Restart your computer. Select Start, All Programs, Accessories, System
Tools, Disk CleanUp to Empty your Recycle Bin and Remove Temporary
Internet Files. Also select Start, All Programs, accessories, System
Tools, Disk CleanUp, More Options, System Restore and remove all but the
latest System Restore point. Run Disk Defragmenter.

Does that result in smaller restore points, which can be defragmented?

--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~