Disappearing Restore Points. Help?

J

Julian

There's quite a lot about limited restore point history around, but just to
add some more info of my own and to plead again for assistance!

Since recently posting about how woefully few restore points I have I've
been watching them... I think I racked up 5 or 6 (spanning a magnificent 4-5
days) and then all but one disappeared.

Yesterday (27 Feb) 2 new restore points were created (between midnight and
1am) - one scheduled and then one as a result of a Windows Update. Then,
between 03:20 and 05:00 I find 4 instance of volsnap helpfully reporting
that "The oldest shadow copy of volume C: was deleted to keep disk space
usage for shadow copies of volume C: below the user defined limit." - and
then another two deletions at 16:45 and 23:28...

Why??? All I've done is use the machine - nothing installed, uninstalled,
reconfigured... what is there to stuff into shadow storage? (My
differential Acronis System State Backup is only 30MB, that's an indication
of how little has changed since Saturday when I took the full backup).

And this is Vista HP so there's no "version" facility; I hope the Vista
isn't making shadow copies of stuff I cant' use.

Last night a new restore point was created automatically ... and then a
further 3 "oldest shadow copies" were deleted... which is why I had only a
single 10hr old restore point this morning.

Using vssadmin I find today 7.4GB used of the allocated 7.9B shadow storage,
in which I have 2 restore points (the one created automatically just after
midnight and one I just created as a test), which looks suspicously like 2x
full system state images judging by the size of my Acronis System State
backups. Somehow the space requirement for a restore point just doesn't seem
right. Never mind lasting 136 years I'd be happy if a restore point stuck
around for a week!

This is seriously, seriously annoying now as it is utterly useless the way
it stands. Can anyone help out? Have looked at BertK's stuff and checked
around but there's a bit of a fact famine on this topic when it comes to
specifics...

TIA
 
M

Mark

A restore point is about 300MB, I find it difficult to imagine you have 7.4
GB of shadow copied files.
(Five restore points would be 1.5 GB.)

Restore/shadow copy by default uses 15% percent of your drive. You stated
that your system is allocating 7.9 GB for storage. This would imply a hard
drive of 52GB. Since I've never heard of that size, sharing some hardware
info might help. (Ex. You've got a bigger drive, but you've partitioned your
Windows drive to some smaller value.)

The command:
vssadmin list shadowstorage
should tell you:
1. How much space of that allocated is actually being used.
2. The amount currently allocated.
3. The maximum amount that can be allocated.

The command:
vssadmin list shadows
should tell you:
1. How many and what restore points are currently being retained.

The commands:
(NOTE: With your current problem, you may be erasing some prior restore
points.)
vssadmin create shadow /for=c:
vssadmin list shadows
You can use these commands to test your storage ability.
Just enter it a few times in a row to verify that it is keeping each restore
point.

Let us know what results you get.
 
J

Julian

Thanks Mark! Look forward to your further input.

Happy to provide the xtra (I didn't do it before because it seems that
Enough Info is in fact Too Much Info at first - seems to put people off
reading...)

A restore point of 300MB sounds much more reasonable to me (XP's history
used to go back 1-2 months)...but as to how much should be allocated (or
max), Help says "To store restore points, you need at least 300 megabytes
(MB) of free space on each hard disk that has System Protection turned on.
System Restore might use up to 15 percent of the space on each disk." - key
point being "up to 15%" - though why it should be less when I have more free
space I don't know.

BTW - after collecting the information below I tried your suggested
commands - to no avail unfortunately... this is a direct copy/paste from the
Cmd window (running as Admin of course) just so you know I didn't mistype

C:\Windows\system32>vssadmin create shadow /for=c:
vssadmin 1.1 - Volume Shadow Copy Service administrative command-line tool
(C) Copyright 2001-2005 Microsoft Corp.

Error: Invalid command.

....Wasn't expecting it to work as vssadmin /? didn't list a Create command -
does this work for other versions of Vista than HP (which is what I have)?

But - here's the rest of the promised info

This is a Rock Xtreme latop with a ~93.16GB hard disk (that's what Disk
Mamagement says - odd figure!) partitioned by the OEM with a 9.61GB Restore
partition, leaving 83.5GB for the C drive, of which 12.1GB is still free.
(At home there is also a 40GB iSCSI device attached but I checked and it is
not marked for System Restore - besides which it *is* a separate disk...)

Further info as follows:

C:\Windows\system32>vssadmin List ShadowStorage
Shadow Copy Storage association
For volume: (C:)\\?\Volume{70b18d2e-c8de-11db-ae44-806e6f6e6963}\
Shadow Copy Storage volume:
(C:)\\?\Volume{70b18d2e-c8de-11db-ae44-806e6f6e6963}\
Used Shadow Copy Storage space: 7.657 GB
Allocated Shadow Copy Storage space: 8.059 GB
Maximum Shadow Copy Storage space: 12.533 GB

[NB that max does equate to 15% of C, and I have seen the allocated as high
as 11GB+]

C:\Windows\system32>vssadmin List Shadows
Contents of shadow copy set ID: {a870dd4f-e9c6-405d-86be-49bba3e9011d}
Contained 1 shadow copies at creation time: 28/02/2008 00:01:19
Shadow Copy ID: {caf4d6cd-27b6-45fb-a366-7876970d491d}
Original Volume:
(C:)\\?\Volume{70b18d2e-c8de-11db-ae44-806e6f6e6963}\
Shadow Copy Volume:
\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy11
Originating Machine: mymachine
Service Machine: mymachine
Provider: 'Microsoft Software Shadow Copy provider 1.0'
Type: ClientAccessibleWriters
Attributes: Persistent, Client-accessible, No auto release,
Differential, Auto recovered

Contents of shadow copy set ID: {c252dc8d-2681-4a3d-897b-f974b972d8be}
Contained 1 shadow copies at creation time: 28/02/2008 14:12:23
Shadow Copy ID: {781034dc-c5b1-4226-b1b0-61b16a2e5a1f}
Original Volume:
(C:)\\?\Volume{70b18d2e-c8de-11db-ae44-806e6f6e6963}\
Shadow Copy Volume:
\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy12
Originating Machine: mymachine
Service Machine: mymachine
Provider: 'Microsoft Software Shadow Copy provider 1.0'
Type: ClientAccessibleWriters
Attributes: Persistent, Client-accessible, No auto release,
Differential, Auto recovered

And FWIW...

C:\Windows\system32>vssadmin list writers

Writer name: 'System Writer'
Writer Id: {e8132975-6f93-4464-a53e-1050253ae220}
Writer Instance Id: {1f05d78e-68f7-4183-a8b5-4cda0adc5cc8}
State: [5] Waiting for completion
Last error: No error

Writer name: 'ASR Writer'
Writer Id: {be000cbe-11fe-4426-9c58-531aa6355fc4}
Writer Instance Id: {476931d0-a53d-4a28-8f51-85a37ec03645}
State: [1] Stable
Last error: No error

Writer name: 'COM+ REGDB Writer'
Writer Id: {542da469-d3e1-473c-9f4f-7847f01fc64f}
Writer Instance Id: {890f7958-7d8d-48cb-841e-45dbae0b3b96}
State: [1] Stable
Last error: No error

Writer name: 'Shadow Copy Optimization Writer'
Writer Id: {4dc3bdd4-ab48-4d07-adb0-3bee2926fd7f}
Writer Instance Id: {57eb3dec-4196-482d-86a1-03601774fecf}
State: [1] Stable
Last error: No error

Writer name: 'Registry Writer'
Writer Id: {afbab4a2-367d-4d15-a586-71dbb18f8485}
Writer Instance Id: {bf7c57c9-b720-4219-be9a-07f21198d577}
State: [1] Stable
Last error: No error

Writer name: 'MSSearch Service Writer'
Writer Id: {cd3f2362-8bef-46c7-9181-d62844cdc0b2}
Writer Instance Id: {76c6eb0a-98be-4371-ade9-666e88a8476f}
State: [5] Waiting for completion
Last error: No error

Writer name: 'BITS Writer'
Writer Id: {4969d978-be47-48b0-b100-f328f07ac1e0}
Writer Instance Id: {de5e5c24-de13-49ea-82d0-c353c84e0e4e}
State: [1] Stable
Last error: No error

Writer name: 'WMI Writer'
Writer Id: {a6ad56c2-b509-4e6c-bb19-49d8f43532f0}
Writer Instance Id: {bc066c88-80c5-45fc-8004-643019f7b041}
State: [5] Waiting for completion
Last error: No error

What do you think?

Julian
 
M

Mark

You are right about vssadmin not having a create command. (Apparently that's
only in 2003 and 2008 Server.)
But, you can create several restore points from control panel to test that
they are actually visible under vssadmin list.
(I thought I would be keeping you in the same window.)

Well the good Max allocated = 12.533GB (/15*100 = 83.5GB, which is your c: partition
size)
You have plenty of room to make new points.

The 136 years only applies to restore points assuming you never remove a
restore point due to insufficient space.
So, you are either running out of space, or you have some routine "cleaning
up" for you.

So what shadows are you filling 8.0 GB with?
Do you keep lots of photos or multimedia on this drive and edit them?
Select a folder that has lots of big files and right-click it. You should
have an option to Retore previous version.
Does the list make sense based on what you've been doing with your computer?

My suspicion:
Is there a task scheduled to perform daily cleanup which may be deleting all
but the most recent restore point?
Disk cleanup options or some proprietary software from the builder?

If you want to keep all those shadow copies, make a complete backup of your
system and then try turning off System Restore to wipe the stored
information. Reboot, then turn it back on. (NOTE: This may now set your
default percentage to 30% instead of 15%. It can only be reset to 15% in the
registry.)
Or, use vssadmin to resize your storage to 300MB. When done, reset it to the
original value. (This will basically wipe it also.)
Try to store several restore points.

They should remain and the allocated space should grow appropriately. Check
them again in the morning. If they are all still there, you've been running
out of space with the shadow copy feature. Don't know what you do with the
computer. But, if you fill up 8GB in one day, something is going on.


Julian said:
Thanks Mark! Look forward to your further input.

Happy to provide the xtra (I didn't do it before because it seems that
Enough Info is in fact Too Much Info at first - seems to put people off
reading...)

A restore point of 300MB sounds much more reasonable to me (XP's history
used to go back 1-2 months)...but as to how much should be allocated (or
max), Help says "To store restore points, you need at least 300 megabytes
(MB) of free space on each hard disk that has System Protection turned on.
System Restore might use up to 15 percent of the space on each disk." - key
point being "up to 15%" - though why it should be less when I have more free
space I don't know.

BTW - after collecting the information below I tried your suggested
commands - to no avail unfortunately... this is a direct copy/paste from the
Cmd window (running as Admin of course) just so you know I didn't mistype

C:\Windows\system32>vssadmin create shadow /for=c:
vssadmin 1.1 - Volume Shadow Copy Service administrative command-line tool
(C) Copyright 2001-2005 Microsoft Corp.

Error: Invalid command.

...Wasn't expecting it to work as vssadmin /? didn't list a Create command -
does this work for other versions of Vista than HP (which is what I have)?

But - here's the rest of the promised info

This is a Rock Xtreme latop with a ~93.16GB hard disk (that's what Disk
Mamagement says - odd figure!) partitioned by the OEM with a 9.61GB Restore
partition, leaving 83.5GB for the C drive, of which 12.1GB is still free.
(At home there is also a 40GB iSCSI device attached but I checked and it is
not marked for System Restore - besides which it *is* a separate disk...)

Further info as follows:

C:\Windows\system32>vssadmin List ShadowStorage
Shadow Copy Storage association
For volume: (C:)\\?\Volume{70b18d2e-c8de-11db-ae44-806e6f6e6963}\
Shadow Copy Storage volume:
(C:)\\?\Volume{70b18d2e-c8de-11db-ae44-806e6f6e6963}\
Used Shadow Copy Storage space: 7.657 GB
Allocated Shadow Copy Storage space: 8.059 GB
Maximum Shadow Copy Storage space: 12.533 GB

[NB that max does equate to 15% of C, and I have seen the allocated as high
as 11GB+]

C:\Windows\system32>vssadmin List Shadows
Contents of shadow copy set ID: {a870dd4f-e9c6-405d-86be-49bba3e9011d}
Contained 1 shadow copies at creation time: 28/02/2008 00:01:19
Shadow Copy ID: {caf4d6cd-27b6-45fb-a366-7876970d491d}
Original Volume:
(C:)\\?\Volume{70b18d2e-c8de-11db-ae44-806e6f6e6963}\
Shadow Copy Volume:
\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy11
Originating Machine: mymachine
Service Machine: mymachine
Provider: 'Microsoft Software Shadow Copy provider 1.0'
Type: ClientAccessibleWriters
Attributes: Persistent, Client-accessible, No auto release,
Differential, Auto recovered

Contents of shadow copy set ID: {c252dc8d-2681-4a3d-897b-f974b972d8be}
Contained 1 shadow copies at creation time: 28/02/2008 14:12:23
Shadow Copy ID: {781034dc-c5b1-4226-b1b0-61b16a2e5a1f}
Original Volume:
(C:)\\?\Volume{70b18d2e-c8de-11db-ae44-806e6f6e6963}\
Shadow Copy Volume:
\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy12
Originating Machine: mymachine
Service Machine: mymachine
Provider: 'Microsoft Software Shadow Copy provider 1.0'
Type: ClientAccessibleWriters
Attributes: Persistent, Client-accessible, No auto release,
Differential, Auto recovered

And FWIW...

C:\Windows\system32>vssadmin list writers

Writer name: 'System Writer'
Writer Id: {e8132975-6f93-4464-a53e-1050253ae220}
Writer Instance Id: {1f05d78e-68f7-4183-a8b5-4cda0adc5cc8}
State: [5] Waiting for completion
Last error: No error

Writer name: 'ASR Writer'
Writer Id: {be000cbe-11fe-4426-9c58-531aa6355fc4}
Writer Instance Id: {476931d0-a53d-4a28-8f51-85a37ec03645}
State: [1] Stable
Last error: No error

Writer name: 'COM+ REGDB Writer'
Writer Id: {542da469-d3e1-473c-9f4f-7847f01fc64f}
Writer Instance Id: {890f7958-7d8d-48cb-841e-45dbae0b3b96}
State: [1] Stable
Last error: No error

Writer name: 'Shadow Copy Optimization Writer'
Writer Id: {4dc3bdd4-ab48-4d07-adb0-3bee2926fd7f}
Writer Instance Id: {57eb3dec-4196-482d-86a1-03601774fecf}
State: [1] Stable
Last error: No error

Writer name: 'Registry Writer'
Writer Id: {afbab4a2-367d-4d15-a586-71dbb18f8485}
Writer Instance Id: {bf7c57c9-b720-4219-be9a-07f21198d577}
State: [1] Stable
Last error: No error

Writer name: 'MSSearch Service Writer'
Writer Id: {cd3f2362-8bef-46c7-9181-d62844cdc0b2}
Writer Instance Id: {76c6eb0a-98be-4371-ade9-666e88a8476f}
State: [5] Waiting for completion
Last error: No error

Writer name: 'BITS Writer'
Writer Id: {4969d978-be47-48b0-b100-f328f07ac1e0}
Writer Instance Id: {de5e5c24-de13-49ea-82d0-c353c84e0e4e}
State: [1] Stable
Last error: No error

Writer name: 'WMI Writer'
Writer Id: {a6ad56c2-b509-4e6c-bb19-49d8f43532f0}
Writer Instance Id: {bc066c88-80c5-45fc-8004-643019f7b041}
State: [5] Waiting for completion
Last error: No error

What do you think?

Julian

Mark said:
A restore point is about 300MB, I find it difficult to imagine you have 7.4
GB of shadow copied files.
(Five restore points would be 1.5 GB.)

Restore/shadow copy by default uses 15% percent of your drive. You stated
that your system is allocating 7.9 GB for storage. This would imply a hard
drive of 52GB. Since I've never heard of that size, sharing some hardware
info might help. (Ex. You've got a bigger drive, but you've partitioned
your
Windows drive to some smaller value.)

The command:
vssadmin list shadowstorage
should tell you:
1. How much space of that allocated is actually being used.
2. The amount currently allocated.
3. The maximum amount that can be allocated.

The command:
vssadmin list shadows
should tell you:
1. How many and what restore points are currently being retained.

The commands:
(NOTE: With your current problem, you may be erasing some prior restore
points.)
vssadmin create shadow /for=c:
vssadmin list shadows
You can use these commands to test your storage ability.
Just enter it a few times in a row to verify that it is keeping each
restore
point.

Let us know what results you get.



just
to magnificent
4-5 like
2x
 
J

Julian

Well...

Worth re-iterating that this is Vista HP and AFAIK it does not have the
"Restore" functionality from shadowstorage - certainly never seen a Restore
option and I have just double-checked a recently changed folder... it's not
there (Business/Ultimate I should expect)

Testing hypotheses I tried the following

1. Set a tag on a large number of photos... 210 MB... shadowstorage
consumption went up by 45MB
2. Copied a 400MB folder on a Removable drive that is in fact a mounted
TrueCrypt volume residing in a 10GB file... shadowstorage went up by 7MB,
not much of a change when I deleted it again either.
3. Then created a Restore point via the System Protection Tab of System
Properties... shadowstorage went up by 35 MB [NB no event in the event log
yet!]
4. Then I had Outlook do a Send and Receive (hopefully to cause a change to
the PST file... didn't make any difference at all)
5. Then looked again after I had written up 1-3 above and it had shot up by
486MB!
6. Later created another restore point, and although "creation" seems to be
quick I suspect that stuff has been flagged for writing to shadow storage as
I have been watching the disk light and shadowstorage since and it has gone
up by about 250MBish...

But if restore points aren't eating GB each, where's the storage space
going?

Is there a scheduled clean up task? Not that I know of... though having
inspected the Task Scheduler I see a regular DeFrag for 01:00 on Wednesdays
(the 27th was a Wednesday... there were several volsnap cleanups early that
morning). The triggers for the System Restore point creation are System
Startup and 00:00 daily...

Must confess I was hoping you would look at the list of Writers and say
"Hey! That shouldn't be there...!" to at least one of them.

Something is eating my shadowstorage when I don't think it should be!

Mark said:
You are right about vssadmin not having a create command. (Apparently
that's
only in 2003 and 2008 Server.)
But, you can create several restore points from control panel to test that
they are actually visible under vssadmin list.
(I thought I would be keeping you in the same window.)

Well the good Max allocated = 12.533GB (/15*100 = 83.5GB, which is your c: partition
size)
You have plenty of room to make new points.

The 136 years only applies to restore points assuming you never remove a
restore point due to insufficient space.
So, you are either running out of space, or you have some routine
"cleaning
up" for you.

So what shadows are you filling 8.0 GB with?
Do you keep lots of photos or multimedia on this drive and edit them?
Select a folder that has lots of big files and right-click it. You should
have an option to Retore previous version.
Does the list make sense based on what you've been doing with your
computer?

My suspicion:
Is there a task scheduled to perform daily cleanup which may be deleting
all
but the most recent restore point?
Disk cleanup options or some proprietary software from the builder?

If you want to keep all those shadow copies, make a complete backup of
your
system and then try turning off System Restore to wipe the stored
information. Reboot, then turn it back on. (NOTE: This may now set your
default percentage to 30% instead of 15%. It can only be reset to 15% in
the
registry.)
Or, use vssadmin to resize your storage to 300MB. When done, reset it to
the
original value. (This will basically wipe it also.)
Try to store several restore points.

They should remain and the allocated space should grow appropriately.
Check
them again in the morning. If they are all still there, you've been
running
out of space with the shadow copy feature. Don't know what you do with the
computer. But, if you fill up 8GB in one day, something is going on.


Julian said:
Thanks Mark! Look forward to your further input.

Happy to provide the xtra (I didn't do it before because it seems that
Enough Info is in fact Too Much Info at first - seems to put people off
reading...)

A restore point of 300MB sounds much more reasonable to me (XP's history
used to go back 1-2 months)...but as to how much should be allocated (or
max), Help says "To store restore points, you need at least 300 megabytes
(MB) of free space on each hard disk that has System Protection turned
on.
System Restore might use up to 15 percent of the space on each disk." - key
point being "up to 15%" - though why it should be less when I have more free
space I don't know.

BTW - after collecting the information below I tried your suggested
commands - to no avail unfortunately... this is a direct copy/paste from the
Cmd window (running as Admin of course) just so you know I didn't mistype

C:\Windows\system32>vssadmin create shadow /for=c:
vssadmin 1.1 - Volume Shadow Copy Service administrative command-line
tool
(C) Copyright 2001-2005 Microsoft Corp.

Error: Invalid command.

...Wasn't expecting it to work as vssadmin /? didn't list a Create command -
does this work for other versions of Vista than HP (which is what I
have)?

But - here's the rest of the promised info

This is a Rock Xtreme latop with a ~93.16GB hard disk (that's what Disk
Mamagement says - odd figure!) partitioned by the OEM with a 9.61GB Restore
partition, leaving 83.5GB for the C drive, of which 12.1GB is still free.
(At home there is also a 40GB iSCSI device attached but I checked and it is
not marked for System Restore - besides which it *is* a separate disk...)

Further info as follows:

C:\Windows\system32>vssadmin List ShadowStorage
Shadow Copy Storage association
For volume: (C:)\\?\Volume{70b18d2e-c8de-11db-ae44-806e6f6e6963}\
Shadow Copy Storage volume:
(C:)\\?\Volume{70b18d2e-c8de-11db-ae44-806e6f6e6963}\
Used Shadow Copy Storage space: 7.657 GB
Allocated Shadow Copy Storage space: 8.059 GB
Maximum Shadow Copy Storage space: 12.533 GB

[NB that max does equate to 15% of C, and I have seen the allocated as high
as 11GB+]

C:\Windows\system32>vssadmin List Shadows
Contents of shadow copy set ID: {a870dd4f-e9c6-405d-86be-49bba3e9011d}
Contained 1 shadow copies at creation time: 28/02/2008 00:01:19
Shadow Copy ID: {caf4d6cd-27b6-45fb-a366-7876970d491d}
Original Volume:
(C:)\\?\Volume{70b18d2e-c8de-11db-ae44-806e6f6e6963}\
Shadow Copy Volume:
\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy11
Originating Machine: mymachine
Service Machine: mymachine
Provider: 'Microsoft Software Shadow Copy provider 1.0'
Type: ClientAccessibleWriters
Attributes: Persistent, Client-accessible, No auto release,
Differential, Auto recovered

Contents of shadow copy set ID: {c252dc8d-2681-4a3d-897b-f974b972d8be}
Contained 1 shadow copies at creation time: 28/02/2008 14:12:23
Shadow Copy ID: {781034dc-c5b1-4226-b1b0-61b16a2e5a1f}
Original Volume:
(C:)\\?\Volume{70b18d2e-c8de-11db-ae44-806e6f6e6963}\
Shadow Copy Volume:
\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy12
Originating Machine: mymachine
Service Machine: mymachine
Provider: 'Microsoft Software Shadow Copy provider 1.0'
Type: ClientAccessibleWriters
Attributes: Persistent, Client-accessible, No auto release,
Differential, Auto recovered

And FWIW...

C:\Windows\system32>vssadmin list writers

Writer name: 'System Writer'
Writer Id: {e8132975-6f93-4464-a53e-1050253ae220}
Writer Instance Id: {1f05d78e-68f7-4183-a8b5-4cda0adc5cc8}
State: [5] Waiting for completion
Last error: No error

Writer name: 'ASR Writer'
Writer Id: {be000cbe-11fe-4426-9c58-531aa6355fc4}
Writer Instance Id: {476931d0-a53d-4a28-8f51-85a37ec03645}
State: [1] Stable
Last error: No error

Writer name: 'COM+ REGDB Writer'
Writer Id: {542da469-d3e1-473c-9f4f-7847f01fc64f}
Writer Instance Id: {890f7958-7d8d-48cb-841e-45dbae0b3b96}
State: [1] Stable
Last error: No error

Writer name: 'Shadow Copy Optimization Writer'
Writer Id: {4dc3bdd4-ab48-4d07-adb0-3bee2926fd7f}
Writer Instance Id: {57eb3dec-4196-482d-86a1-03601774fecf}
State: [1] Stable
Last error: No error

Writer name: 'Registry Writer'
Writer Id: {afbab4a2-367d-4d15-a586-71dbb18f8485}
Writer Instance Id: {bf7c57c9-b720-4219-be9a-07f21198d577}
State: [1] Stable
Last error: No error

Writer name: 'MSSearch Service Writer'
Writer Id: {cd3f2362-8bef-46c7-9181-d62844cdc0b2}
Writer Instance Id: {76c6eb0a-98be-4371-ade9-666e88a8476f}
State: [5] Waiting for completion
Last error: No error

Writer name: 'BITS Writer'
Writer Id: {4969d978-be47-48b0-b100-f328f07ac1e0}
Writer Instance Id: {de5e5c24-de13-49ea-82d0-c353c84e0e4e}
State: [1] Stable
Last error: No error

Writer name: 'WMI Writer'
Writer Id: {a6ad56c2-b509-4e6c-bb19-49d8f43532f0}
Writer Instance Id: {bc066c88-80c5-45fc-8004-643019f7b041}
State: [5] Waiting for completion
Last error: No error

What do you think?

Julian

Mark said:
A restore point is about 300MB, I find it difficult to imagine you have 7.4
GB of shadow copied files.
(Five restore points would be 1.5 GB.)

Restore/shadow copy by default uses 15% percent of your drive. You stated
that your system is allocating 7.9 GB for storage. This would imply a hard
drive of 52GB. Since I've never heard of that size, sharing some hardware
info might help. (Ex. You've got a bigger drive, but you've partitioned
your
Windows drive to some smaller value.)

The command:
vssadmin list shadowstorage
should tell you:
1. How much space of that allocated is actually being used.
2. The amount currently allocated.
3. The maximum amount that can be allocated.

The command:
vssadmin list shadows
should tell you:
1. How many and what restore points are currently being retained.

The commands:
(NOTE: With your current problem, you may be erasing some prior restore
points.)
vssadmin create shadow /for=c:
vssadmin list shadows
You can use these commands to test your storage ability.
Just enter it a few times in a row to verify that it is keeping each
restore
point.

Let us know what results you get.



There's quite a lot about limited restore point history around, but just
to
add some more info of my own and to plead again for assistance!

Since recently posting about how woefully few restore points I have I've
been watching them... I think I racked up 5 or 6 (spanning a magnificent
4-5
days) and then all but one disappeared.

Yesterday (27 Feb) 2 new restore points were created (between midnight
and
1am) - one scheduled and then one as a result of a Windows Update. Then,
between 03:20 and 05:00 I find 4 instance of volsnap helpfully reporting
that "The oldest shadow copy of volume C: was deleted to keep disk space
usage for shadow copies of volume C: below the user defined limit." - and
then another two deletions at 16:45 and 23:28...

Why??? All I've done is use the machine - nothing installed, uninstalled,
reconfigured... what is there to stuff into shadow storage? (My
differential Acronis System State Backup is only 30MB, that's an
indication
of how little has changed since Saturday when I took the full backup).

And this is Vista HP so there's no "version" facility; I hope the
Vista
isn't making shadow copies of stuff I cant' use.

Last night a new restore point was created automatically ... and then
a
further 3 "oldest shadow copies" were deleted... which is why I had only
a
single 10hr old restore point this morning.

Using vssadmin I find today 7.4GB used of the allocated 7.9B shadow
storage,
in which I have 2 restore points (the one created automatically just
after
midnight and one I just created as a test), which looks suspicously like
2x
full system state images judging by the size of my Acronis System
State
backups. Somehow the space requirement for a restore point just
doesn't
seem
right. Never mind lasting 136 years I'd be happy if a restore point stuck
around for a week!

This is seriously, seriously annoying now as it is utterly useless the
way
it stands. Can anyone help out? Have looked at BertK's stuff and checked
around but there's a bit of a fact famine on this topic when it comes to
specifics...

TIA
--
Julian I-Do-Stuff

Some Vista stuff, but mostly just Stuff at
http://berossus,blogspot.com
 
M

Mark

Sorry, it's difficult because I have Vista Ultimate at home, 2K and XP at
work and you're on HP.
So, I'm trying to remember most of this and look up the rest.

"Shadow Copy. Available in the Ultimate, Business, and Enterprise editions
of Windows Vista, this feature automatically creates point-in-time copies of
files as you work, so you can quickly and easily retrieve versions of a
document you may have accidentally deleted.
It works on single files as well as whole folders. When restoring a file,
all previous versions that are different from the live copy on the disk are
shown. When accessing a previous version of a folder, users can browse the
folder hierarchy as it was in a previous point in time."


So why is this service funcitoning in HP if you can't make use of it?
---
Well, I looked at that list of writers and and nothing stood out.
You are definitely running out of room in the allocated space and Vista
wants to keep the the most recent shadow copy. That being a 486MB file, it
simply deletes the oldest stuff first and your restore points are
disappearing.

With HP, you also do not have secpol.msc or Complete PC Backup.

I'm assuming you're only recourse is third-party software,
http://www.shadowexplorer.com/uploads/ShadowExplorer-0.1-setup.exe
or turning System Restore off. There is a method within the registry to
exclude specific files from being shadowed which might take care of the
486MB files.
http://msdn2.microsoft.com/en-us/library/aa819132.aspx
The problem: You have to know what to exclude.


Julian said:
Well...

Worth re-iterating that this is Vista HP and AFAIK it does not have the
"Restore" functionality from shadowstorage - certainly never seen a Restore
option and I have just double-checked a recently changed folder... it's not
there (Business/Ultimate I should expect)

Testing hypotheses I tried the following

1. Set a tag on a large number of photos... 210 MB... shadowstorage
consumption went up by 45MB
2. Copied a 400MB folder on a Removable drive that is in fact a mounted
TrueCrypt volume residing in a 10GB file... shadowstorage went up by 7MB,
not much of a change when I deleted it again either.
3. Then created a Restore point via the System Protection Tab of System
Properties... shadowstorage went up by 35 MB [NB no event in the event log
yet!]
4. Then I had Outlook do a Send and Receive (hopefully to cause a change to
the PST file... didn't make any difference at all)
5. Then looked again after I had written up 1-3 above and it had shot up by
486MB!
6. Later created another restore point, and although "creation" seems to be
quick I suspect that stuff has been flagged for writing to shadow storage as
I have been watching the disk light and shadowstorage since and it has gone
up by about 250MBish...

But if restore points aren't eating GB each, where's the storage space
going?

Is there a scheduled clean up task? Not that I know of... though having
inspected the Task Scheduler I see a regular DeFrag for 01:00 on Wednesdays
(the 27th was a Wednesday... there were several volsnap cleanups early that
morning). The triggers for the System Restore point creation are System
Startup and 00:00 daily...

Must confess I was hoping you would look at the list of Writers and say
"Hey! That shouldn't be there...!" to at least one of them.

Something is eating my shadowstorage when I don't think it should be!

Mark said:
You are right about vssadmin not having a create command. (Apparently
that's
only in 2003 and 2008 Server.)
But, you can create several restore points from control panel to test that
they are actually visible under vssadmin list.
(I thought I would be keeping you in the same window.)

Well the good Max allocated = 12.533GB (/15*100 = 83.5GB, which is your c: partition
size)
You have plenty of room to make new points.

The 136 years only applies to restore points assuming you never remove a
restore point due to insufficient space.
So, you are either running out of space, or you have some routine
"cleaning
up" for you.

So what shadows are you filling 8.0 GB with?
Do you keep lots of photos or multimedia on this drive and edit them?
Select a folder that has lots of big files and right-click it. You should
have an option to Retore previous version.
Does the list make sense based on what you've been doing with your
computer?

My suspicion:
Is there a task scheduled to perform daily cleanup which may be deleting
all
but the most recent restore point?
Disk cleanup options or some proprietary software from the builder?

If you want to keep all those shadow copies, make a complete backup of
your
system and then try turning off System Restore to wipe the stored
information. Reboot, then turn it back on. (NOTE: This may now set your
default percentage to 30% instead of 15%. It can only be reset to 15% in
the
registry.)
Or, use vssadmin to resize your storage to 300MB. When done, reset it to
the
original value. (This will basically wipe it also.)
Try to store several restore points.

They should remain and the allocated space should grow appropriately.
Check
them again in the morning. If they are all still there, you've been
running
out of space with the shadow copy feature. Don't know what you do with the
computer. But, if you fill up 8GB in one day, something is going on.


Julian said:
Thanks Mark! Look forward to your further input.

Happy to provide the xtra (I didn't do it before because it seems that
Enough Info is in fact Too Much Info at first - seems to put people off
reading...)

A restore point of 300MB sounds much more reasonable to me (XP's history
used to go back 1-2 months)...but as to how much should be allocated (or
max), Help says "To store restore points, you need at least 300 megabytes
(MB) of free space on each hard disk that has System Protection turned
on.
System Restore might use up to 15 percent of the space on each disk." - key
point being "up to 15%" - though why it should be less when I have more free
space I don't know.

BTW - after collecting the information below I tried your suggested
commands - to no avail unfortunately... this is a direct copy/paste
from
the
Cmd window (running as Admin of course) just so you know I didn't mistype

C:\Windows\system32>vssadmin create shadow /for=c:
vssadmin 1.1 - Volume Shadow Copy Service administrative command-line
tool
(C) Copyright 2001-2005 Microsoft Corp.

Error: Invalid command.

...Wasn't expecting it to work as vssadmin /? didn't list a Create command -
does this work for other versions of Vista than HP (which is what I
have)?

But - here's the rest of the promised info

This is a Rock Xtreme latop with a ~93.16GB hard disk (that's what Disk
Mamagement says - odd figure!) partitioned by the OEM with a 9.61GB Restore
partition, leaving 83.5GB for the C drive, of which 12.1GB is still free.
(At home there is also a 40GB iSCSI device attached but I checked and
it
is
not marked for System Restore - besides which it *is* a separate disk...)

Further info as follows:

C:\Windows\system32>vssadmin List ShadowStorage
Shadow Copy Storage association
For volume: (C:)\\?\Volume{70b18d2e-c8de-11db-ae44-806e6f6e6963}\
Shadow Copy Storage volume:
(C:)\\?\Volume{70b18d2e-c8de-11db-ae44-806e6f6e6963}\
Used Shadow Copy Storage space: 7.657 GB
Allocated Shadow Copy Storage space: 8.059 GB
Maximum Shadow Copy Storage space: 12.533 GB

[NB that max does equate to 15% of C, and I have seen the allocated as high
as 11GB+]

C:\Windows\system32>vssadmin List Shadows
Contents of shadow copy set ID: {a870dd4f-e9c6-405d-86be-49bba3e9011d}
Contained 1 shadow copies at creation time: 28/02/2008 00:01:19
Shadow Copy ID: {caf4d6cd-27b6-45fb-a366-7876970d491d}
Original Volume:
(C:)\\?\Volume{70b18d2e-c8de-11db-ae44-806e6f6e6963}\
Shadow Copy Volume:
\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy11
Originating Machine: mymachine
Service Machine: mymachine
Provider: 'Microsoft Software Shadow Copy provider 1.0'
Type: ClientAccessibleWriters
Attributes: Persistent, Client-accessible, No auto release,
Differential, Auto recovered

Contents of shadow copy set ID: {c252dc8d-2681-4a3d-897b-f974b972d8be}
Contained 1 shadow copies at creation time: 28/02/2008 14:12:23
Shadow Copy ID: {781034dc-c5b1-4226-b1b0-61b16a2e5a1f}
Original Volume:
(C:)\\?\Volume{70b18d2e-c8de-11db-ae44-806e6f6e6963}\
Shadow Copy Volume:
\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy12
Originating Machine: mymachine
Service Machine: mymachine
Provider: 'Microsoft Software Shadow Copy provider 1.0'
Type: ClientAccessibleWriters
Attributes: Persistent, Client-accessible, No auto release,
Differential, Auto recovered

And FWIW...

C:\Windows\system32>vssadmin list writers

Writer name: 'System Writer'
Writer Id: {e8132975-6f93-4464-a53e-1050253ae220}
Writer Instance Id: {1f05d78e-68f7-4183-a8b5-4cda0adc5cc8}
State: [5] Waiting for completion
Last error: No error

Writer name: 'ASR Writer'
Writer Id: {be000cbe-11fe-4426-9c58-531aa6355fc4}
Writer Instance Id: {476931d0-a53d-4a28-8f51-85a37ec03645}
State: [1] Stable
Last error: No error

Writer name: 'COM+ REGDB Writer'
Writer Id: {542da469-d3e1-473c-9f4f-7847f01fc64f}
Writer Instance Id: {890f7958-7d8d-48cb-841e-45dbae0b3b96}
State: [1] Stable
Last error: No error

Writer name: 'Shadow Copy Optimization Writer'
Writer Id: {4dc3bdd4-ab48-4d07-adb0-3bee2926fd7f}
Writer Instance Id: {57eb3dec-4196-482d-86a1-03601774fecf}
State: [1] Stable
Last error: No error

Writer name: 'Registry Writer'
Writer Id: {afbab4a2-367d-4d15-a586-71dbb18f8485}
Writer Instance Id: {bf7c57c9-b720-4219-be9a-07f21198d577}
State: [1] Stable
Last error: No error

Writer name: 'MSSearch Service Writer'
Writer Id: {cd3f2362-8bef-46c7-9181-d62844cdc0b2}
Writer Instance Id: {76c6eb0a-98be-4371-ade9-666e88a8476f}
State: [5] Waiting for completion
Last error: No error

Writer name: 'BITS Writer'
Writer Id: {4969d978-be47-48b0-b100-f328f07ac1e0}
Writer Instance Id: {de5e5c24-de13-49ea-82d0-c353c84e0e4e}
State: [1] Stable
Last error: No error

Writer name: 'WMI Writer'
Writer Id: {a6ad56c2-b509-4e6c-bb19-49d8f43532f0}
Writer Instance Id: {bc066c88-80c5-45fc-8004-643019f7b041}
State: [5] Waiting for completion
Last error: No error

What do you think?

Julian

A restore point is about 300MB, I find it difficult to imagine you
have
7.4
GB of shadow copied files.
(Five restore points would be 1.5 GB.)

Restore/shadow copy by default uses 15% percent of your drive. You stated
that your system is allocating 7.9 GB for storage. This would imply a hard
drive of 52GB. Since I've never heard of that size, sharing some hardware
info might help. (Ex. You've got a bigger drive, but you've partitioned
your
Windows drive to some smaller value.)

The command:
vssadmin list shadowstorage
should tell you:
1. How much space of that allocated is actually being used.
2. The amount currently allocated.
3. The maximum amount that can be allocated.

The command:
vssadmin list shadows
should tell you:
1. How many and what restore points are currently being retained.

The commands:
(NOTE: With your current problem, you may be erasing some prior restore
points.)
vssadmin create shadow /for=c:
vssadmin list shadows
You can use these commands to test your storage ability.
Just enter it a few times in a row to verify that it is keeping each
restore
point.

Let us know what results you get.



There's quite a lot about limited restore point history around, but just
to
add some more info of my own and to plead again for assistance!

Since recently posting about how woefully few restore points I have I've
been watching them... I think I racked up 5 or 6 (spanning a magnificent
4-5
days) and then all but one disappeared.

Yesterday (27 Feb) 2 new restore points were created (between midnight
and
1am) - one scheduled and then one as a result of a Windows Update. Then,
between 03:20 and 05:00 I find 4 instance of volsnap helpfully reporting
that "The oldest shadow copy of volume C: was deleted to keep disk space
usage for shadow copies of volume C: below the user defined
limit." -
and
then another two deletions at 16:45 and 23:28...

Why??? All I've done is use the machine - nothing installed, uninstalled,
reconfigured... what is there to stuff into shadow storage? (My
differential Acronis System State Backup is only 30MB, that's an
indication
of how little has changed since Saturday when I took the full backup).

And this is Vista HP so there's no "version" facility; I hope the
Vista
isn't making shadow copies of stuff I cant' use.

Last night a new restore point was created automatically ... and then
a
further 3 "oldest shadow copies" were deleted... which is why I had only
a
single 10hr old restore point this morning.

Using vssadmin I find today 7.4GB used of the allocated 7.9B shadow
storage,
in which I have 2 restore points (the one created automatically just
after
midnight and one I just created as a test), which looks suspicously like
2x
full system state images judging by the size of my Acronis System
State
backups. Somehow the space requirement for a restore point just
doesn't
seem
right. Never mind lasting 136 years I'd be happy if a restore point stuck
around for a week!

This is seriously, seriously annoying now as it is utterly useless the
way
it stands. Can anyone help out? Have looked at BertK's stuff and checked
around but there's a bit of a fact famine on this topic when it
comes
to
specifics...

TIA
--
Julian I-Do-Stuff

Some Vista stuff, but mostly just Stuff at
http://berossus,blogspot.com
 
J

Julian

w00t! (dragging myself into 21st C)...

That tool - basic though it is at v0.1 - works [from
http://www.shadowexplorer.com... only installed after it passed Virus and
Malware scan of course], and it has answered one question: what's consuming
all my shadowstorage space. Answer: shadow copies of just about everything -
not just system restore points!

Of couse one can't squeeze 70GB into just a couple, but there was so much -
including all my music (eh? hasn't changed in months!). I exported one wma
file at random and played it quite successfully!

So... as you correctly say, why is shadow storage beiung used for copies of
stuff that as an HP user I can't access... to the detriment of my System
Restore capabilities?

Dunno... obviously the Shadow Storage service is required to support System
Restore, but how is everything else getting in there... and how do I stop
it? I'll be damned if I'm going to try and exclude file by file stuff that
shouldn't need excluding!

I'm going to start a separate thread and ask other HP users what their
System Restore history is like... I have a hunch that I am not unique in
this problem....

Magnificent, Mark - thanks very much...

Mark said:
Sorry, it's difficult because I have Vista Ultimate at home, 2K and XP at
work and you're on HP.
So, I'm trying to remember most of this and look up the rest.

"Shadow Copy. Available in the Ultimate, Business, and Enterprise editions
of Windows Vista, this feature automatically creates point-in-time copies
of
files as you work, so you can quickly and easily retrieve versions of a
document you may have accidentally deleted.
It works on single files as well as whole folders. When restoring a file,
all previous versions that are different from the live copy on the disk
are
shown. When accessing a previous version of a folder, users can browse the
folder hierarchy as it was in a previous point in time."


So why is this service funcitoning in HP if you can't make use of it?
---
Well, I looked at that list of writers and and nothing stood out.
You are definitely running out of room in the allocated space and Vista
wants to keep the the most recent shadow copy. That being a 486MB file, it
simply deletes the oldest stuff first and your restore points are
disappearing.

With HP, you also do not have secpol.msc or Complete PC Backup.

I'm assuming you're only recourse is third-party software,
http://www.shadowexplorer.com/uploads/ShadowExplorer-0.1-setup.exe
or turning System Restore off. There is a method within the registry to
exclude specific files from being shadowed which might take care of the
486MB files.
http://msdn2.microsoft.com/en-us/library/aa819132.aspx
The problem: You have to know what to exclude.


Julian said:
Well...

Worth re-iterating that this is Vista HP and AFAIK it does not have the
"Restore" functionality from shadowstorage - certainly never seen a Restore
option and I have just double-checked a recently changed folder... it's not
there (Business/Ultimate I should expect)

Testing hypotheses I tried the following

1. Set a tag on a large number of photos... 210 MB... shadowstorage
consumption went up by 45MB
2. Copied a 400MB folder on a Removable drive that is in fact a mounted
TrueCrypt volume residing in a 10GB file... shadowstorage went up by 7MB,
not much of a change when I deleted it again either.
3. Then created a Restore point via the System Protection Tab of System
Properties... shadowstorage went up by 35 MB [NB no event in the event
log
yet!]
4. Then I had Outlook do a Send and Receive (hopefully to cause a change to
the PST file... didn't make any difference at all)
5. Then looked again after I had written up 1-3 above and it had shot up by
486MB!
6. Later created another restore point, and although "creation" seems to be
quick I suspect that stuff has been flagged for writing to shadow storage as
I have been watching the disk light and shadowstorage since and it has gone
up by about 250MBish...

But if restore points aren't eating GB each, where's the storage space
going?

Is there a scheduled clean up task? Not that I know of... though having
inspected the Task Scheduler I see a regular DeFrag for 01:00 on Wednesdays
(the 27th was a Wednesday... there were several volsnap cleanups early that
morning). The triggers for the System Restore point creation are System
Startup and 00:00 daily...

Must confess I was hoping you would look at the list of Writers and say
"Hey! That shouldn't be there...!" to at least one of them.

Something is eating my shadowstorage when I don't think it should be!

Mark said:
You are right about vssadmin not having a create command. (Apparently
that's
only in 2003 and 2008 Server.)
But, you can create several restore points from control panel to test that
they are actually visible under vssadmin list.
(I thought I would be keeping you in the same window.)

Well the good Max allocated = 12.533GB (/15*100 = 83.5GB, which is your c: partition
size)
You have plenty of room to make new points.

The 136 years only applies to restore points assuming you never remove
a
restore point due to insufficient space.
So, you are either running out of space, or you have some routine
"cleaning
up" for you.

So what shadows are you filling 8.0 GB with?
Do you keep lots of photos or multimedia on this drive and edit them?
Select a folder that has lots of big files and right-click it. You should
have an option to Retore previous version.
Does the list make sense based on what you've been doing with your
computer?

My suspicion:
Is there a task scheduled to perform daily cleanup which may be
deleting
all
but the most recent restore point?
Disk cleanup options or some proprietary software from the builder?

If you want to keep all those shadow copies, make a complete backup of
your
system and then try turning off System Restore to wipe the stored
information. Reboot, then turn it back on. (NOTE: This may now set your
default percentage to 30% instead of 15%. It can only be reset to 15%
in
the
registry.)
Or, use vssadmin to resize your storage to 300MB. When done, reset it
to
the
original value. (This will basically wipe it also.)
Try to store several restore points.

They should remain and the allocated space should grow appropriately.
Check
them again in the morning. If they are all still there, you've been
running
out of space with the shadow copy feature. Don't know what you do with the
computer. But, if you fill up 8GB in one day, something is going on.


Thanks Mark! Look forward to your further input.

Happy to provide the xtra (I didn't do it before because it seems that
Enough Info is in fact Too Much Info at first - seems to put people
off
reading...)

A restore point of 300MB sounds much more reasonable to me (XP's history
used to go back 1-2 months)...but as to how much should be allocated (or
max), Help says "To store restore points, you need at least 300 megabytes
(MB) of free space on each hard disk that has System Protection turned
on.
System Restore might use up to 15 percent of the space on each
disk." -
key
point being "up to 15%" - though why it should be less when I have
more
free
space I don't know.

BTW - after collecting the information below I tried your suggested
commands - to no avail unfortunately... this is a direct copy/paste from
the
Cmd window (running as Admin of course) just so you know I didn't mistype

C:\Windows\system32>vssadmin create shadow /for=c:
vssadmin 1.1 - Volume Shadow Copy Service administrative command-line
tool
(C) Copyright 2001-2005 Microsoft Corp.

Error: Invalid command.

...Wasn't expecting it to work as vssadmin /? didn't list a Create
command -
does this work for other versions of Vista than HP (which is what I
have)?

But - here's the rest of the promised info

This is a Rock Xtreme latop with a ~93.16GB hard disk (that's what
Disk
Mamagement says - odd figure!) partitioned by the OEM with a 9.61GB
Restore
partition, leaving 83.5GB for the C drive, of which 12.1GB is still free.
(At home there is also a 40GB iSCSI device attached but I checked and it
is
not marked for System Restore - besides which it *is* a separate disk...)

Further info as follows:

C:\Windows\system32>vssadmin List ShadowStorage
Shadow Copy Storage association
For volume: (C:)\\?\Volume{70b18d2e-c8de-11db-ae44-806e6f6e6963}\
Shadow Copy Storage volume:
(C:)\\?\Volume{70b18d2e-c8de-11db-ae44-806e6f6e6963}\
Used Shadow Copy Storage space: 7.657 GB
Allocated Shadow Copy Storage space: 8.059 GB
Maximum Shadow Copy Storage space: 12.533 GB

[NB that max does equate to 15% of C, and I have seen the allocated as
high
as 11GB+]

C:\Windows\system32>vssadmin List Shadows
Contents of shadow copy set ID: {a870dd4f-e9c6-405d-86be-49bba3e9011d}
Contained 1 shadow copies at creation time: 28/02/2008 00:01:19
Shadow Copy ID: {caf4d6cd-27b6-45fb-a366-7876970d491d}
Original Volume:
(C:)\\?\Volume{70b18d2e-c8de-11db-ae44-806e6f6e6963}\
Shadow Copy Volume:
\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy11
Originating Machine: mymachine
Service Machine: mymachine
Provider: 'Microsoft Software Shadow Copy provider 1.0'
Type: ClientAccessibleWriters
Attributes: Persistent, Client-accessible, No auto release,
Differential, Auto recovered

Contents of shadow copy set ID: {c252dc8d-2681-4a3d-897b-f974b972d8be}
Contained 1 shadow copies at creation time: 28/02/2008 14:12:23
Shadow Copy ID: {781034dc-c5b1-4226-b1b0-61b16a2e5a1f}
Original Volume:
(C:)\\?\Volume{70b18d2e-c8de-11db-ae44-806e6f6e6963}\
Shadow Copy Volume:
\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy12
Originating Machine: mymachine
Service Machine: mymachine
Provider: 'Microsoft Software Shadow Copy provider 1.0'
Type: ClientAccessibleWriters
Attributes: Persistent, Client-accessible, No auto release,
Differential, Auto recovered

And FWIW...

C:\Windows\system32>vssadmin list writers

Writer name: 'System Writer'
Writer Id: {e8132975-6f93-4464-a53e-1050253ae220}
Writer Instance Id: {1f05d78e-68f7-4183-a8b5-4cda0adc5cc8}
State: [5] Waiting for completion
Last error: No error

Writer name: 'ASR Writer'
Writer Id: {be000cbe-11fe-4426-9c58-531aa6355fc4}
Writer Instance Id: {476931d0-a53d-4a28-8f51-85a37ec03645}
State: [1] Stable
Last error: No error

Writer name: 'COM+ REGDB Writer'
Writer Id: {542da469-d3e1-473c-9f4f-7847f01fc64f}
Writer Instance Id: {890f7958-7d8d-48cb-841e-45dbae0b3b96}
State: [1] Stable
Last error: No error

Writer name: 'Shadow Copy Optimization Writer'
Writer Id: {4dc3bdd4-ab48-4d07-adb0-3bee2926fd7f}
Writer Instance Id: {57eb3dec-4196-482d-86a1-03601774fecf}
State: [1] Stable
Last error: No error

Writer name: 'Registry Writer'
Writer Id: {afbab4a2-367d-4d15-a586-71dbb18f8485}
Writer Instance Id: {bf7c57c9-b720-4219-be9a-07f21198d577}
State: [1] Stable
Last error: No error

Writer name: 'MSSearch Service Writer'
Writer Id: {cd3f2362-8bef-46c7-9181-d62844cdc0b2}
Writer Instance Id: {76c6eb0a-98be-4371-ade9-666e88a8476f}
State: [5] Waiting for completion
Last error: No error

Writer name: 'BITS Writer'
Writer Id: {4969d978-be47-48b0-b100-f328f07ac1e0}
Writer Instance Id: {de5e5c24-de13-49ea-82d0-c353c84e0e4e}
State: [1] Stable
Last error: No error

Writer name: 'WMI Writer'
Writer Id: {a6ad56c2-b509-4e6c-bb19-49d8f43532f0}
Writer Instance Id: {bc066c88-80c5-45fc-8004-643019f7b041}
State: [5] Waiting for completion
Last error: No error

What do you think?

Julian

A restore point is about 300MB, I find it difficult to imagine you have
7.4
GB of shadow copied files.
(Five restore points would be 1.5 GB.)

Restore/shadow copy by default uses 15% percent of your drive. You
stated
that your system is allocating 7.9 GB for storage. This would imply
a
hard
drive of 52GB. Since I've never heard of that size, sharing some
hardware
info might help. (Ex. You've got a bigger drive, but you've partitioned
your
Windows drive to some smaller value.)

The command:
vssadmin list shadowstorage
should tell you:
1. How much space of that allocated is actually being used.
2. The amount currently allocated.
3. The maximum amount that can be allocated.

The command:
vssadmin list shadows
should tell you:
1. How many and what restore points are currently being retained.

The commands:
(NOTE: With your current problem, you may be erasing some prior restore
points.)
vssadmin create shadow /for=c:
vssadmin list shadows
You can use these commands to test your storage ability.
Just enter it a few times in a row to verify that it is keeping each
restore
point.

Let us know what results you get.



There's quite a lot about limited restore point history around, but
just
to
add some more info of my own and to plead again for assistance!

Since recently posting about how woefully few restore points I have
I've
been watching them... I think I racked up 5 or 6 (spanning a
magnificent
4-5
days) and then all but one disappeared.

Yesterday (27 Feb) 2 new restore points were created (between midnight
and
1am) - one scheduled and then one as a result of a Windows Update.
Then,
between 03:20 and 05:00 I find 4 instance of volsnap helpfully
reporting
that "The oldest shadow copy of volume C: was deleted to keep disk
space
usage for shadow copies of volume C: below the user defined limit." -
and
then another two deletions at 16:45 and 23:28...

Why??? All I've done is use the machine - nothing installed,
uninstalled,
reconfigured... what is there to stuff into shadow storage? (My
differential Acronis System State Backup is only 30MB, that's an
indication
of how little has changed since Saturday when I took the full backup).

And this is Vista HP so there's no "version" facility; I hope the
Vista
isn't making shadow copies of stuff I cant' use.

Last night a new restore point was created automatically ... and then
a
further 3 "oldest shadow copies" were deleted... which is why I had
only
a
single 10hr old restore point this morning.

Using vssadmin I find today 7.4GB used of the allocated 7.9B shadow
storage,
in which I have 2 restore points (the one created automatically
just
after
midnight and one I just created as a test), which looks suspicously
like
2x
full system state images judging by the size of my Acronis System
State
backups. Somehow the space requirement for a restore point just
doesn't
seem
right. Never mind lasting 136 years I'd be happy if a restore point
stuck
around for a week!

This is seriously, seriously annoying now as it is utterly useless the
way
it stands. Can anyone help out? Have looked at BertK's stuff and
checked
around but there's a bit of a fact famine on this topic when it comes
to
specifics...

TIA
--
Julian I-Do-Stuff

Some Vista stuff, but mostly just Stuff at
http://berossus,blogspot.com




--
Julian I-Do-Stuff

Some Vista stuff, but mostly just Stuff at
http://berossus,blogspot.com
 
M

Mark

You're welcome.

Julian said:
w00t! (dragging myself into 21st C)...

That tool - basic though it is at v0.1 - works [from
http://www.shadowexplorer.com... only installed after it passed Virus and
Malware scan of course], and it has answered one question: what's
consuming all my shadowstorage space. Answer: shadow copies of just about
everything - not just system restore points!

Of couse one can't squeeze 70GB into just a couple, but there was so
much - including all my music (eh? hasn't changed in months!). I exported
one wma file at random and played it quite successfully!

So... as you correctly say, why is shadow storage beiung used for copies
of stuff that as an HP user I can't access... to the detriment of my
System Restore capabilities?

Dunno... obviously the Shadow Storage service is required to support
System Restore, but how is everything else getting in there... and how do
I stop it? I'll be damned if I'm going to try and exclude file by file
stuff that shouldn't need excluding!

I'm going to start a separate thread and ask other HP users what their
System Restore history is like... I have a hunch that I am not unique in
this problem....

Magnificent, Mark - thanks very much...

Mark said:
Sorry, it's difficult because I have Vista Ultimate at home, 2K and XP at
work and you're on HP.
So, I'm trying to remember most of this and look up the rest.

"Shadow Copy. Available in the Ultimate, Business, and Enterprise
editions
of Windows Vista, this feature automatically creates point-in-time copies
of
files as you work, so you can quickly and easily retrieve versions of a
document you may have accidentally deleted.
It works on single files as well as whole folders. When restoring a file,
all previous versions that are different from the live copy on the disk
are
shown. When accessing a previous version of a folder, users can browse
the
folder hierarchy as it was in a previous point in time."


So why is this service funcitoning in HP if you can't make use of it?
---
Well, I looked at that list of writers and and nothing stood out.
You are definitely running out of room in the allocated space and Vista
wants to keep the the most recent shadow copy. That being a 486MB file,
it
simply deletes the oldest stuff first and your restore points are
disappearing.

With HP, you also do not have secpol.msc or Complete PC Backup.

I'm assuming you're only recourse is third-party software,
http://www.shadowexplorer.com/uploads/ShadowExplorer-0.1-setup.exe
or turning System Restore off. There is a method within the registry to
exclude specific files from being shadowed which might take care of the
486MB files.
http://msdn2.microsoft.com/en-us/library/aa819132.aspx
The problem: You have to know what to exclude.


Julian said:
Well...

Worth re-iterating that this is Vista HP and AFAIK it does not have the
"Restore" functionality from shadowstorage - certainly never seen a Restore
option and I have just double-checked a recently changed folder... it's not
there (Business/Ultimate I should expect)

Testing hypotheses I tried the following

1. Set a tag on a large number of photos... 210 MB... shadowstorage
consumption went up by 45MB
2. Copied a 400MB folder on a Removable drive that is in fact a mounted
TrueCrypt volume residing in a 10GB file... shadowstorage went up by
7MB,
not much of a change when I deleted it again either.
3. Then created a Restore point via the System Protection Tab of System
Properties... shadowstorage went up by 35 MB [NB no event in the event
log
yet!]
4. Then I had Outlook do a Send and Receive (hopefully to cause a change to
the PST file... didn't make any difference at all)
5. Then looked again after I had written up 1-3 above and it had shot up by
486MB!
6. Later created another restore point, and although "creation" seems to be
quick I suspect that stuff has been flagged for writing to shadow
storage as
I have been watching the disk light and shadowstorage since and it has gone
up by about 250MBish...

But if restore points aren't eating GB each, where's the storage space
going?

Is there a scheduled clean up task? Not that I know of... though having
inspected the Task Scheduler I see a regular DeFrag for 01:00 on Wednesdays
(the 27th was a Wednesday... there were several volsnap cleanups early that
morning). The triggers for the System Restore point creation are System
Startup and 00:00 daily...

Must confess I was hoping you would look at the list of Writers and say
"Hey! That shouldn't be there...!" to at least one of them.

Something is eating my shadowstorage when I don't think it should be!

You are right about vssadmin not having a create command. (Apparently
that's
only in 2003 and 2008 Server.)
But, you can create several restore points from control panel to test that
they are actually visible under vssadmin list.
(I thought I would be keeping you in the same window.)

Well the good Max allocated = 12.533GB (/15*100 = 83.5GB, which is your c: partition
size)
You have plenty of room to make new points.

The 136 years only applies to restore points assuming you never remove
a
restore point due to insufficient space.
So, you are either running out of space, or you have some routine
"cleaning
up" for you.

So what shadows are you filling 8.0 GB with?
Do you keep lots of photos or multimedia on this drive and edit them?
Select a folder that has lots of big files and right-click it. You should
have an option to Retore previous version.
Does the list make sense based on what you've been doing with your
computer?

My suspicion:
Is there a task scheduled to perform daily cleanup which may be
deleting
all
but the most recent restore point?
Disk cleanup options or some proprietary software from the builder?

If you want to keep all those shadow copies, make a complete backup of
your
system and then try turning off System Restore to wipe the stored
information. Reboot, then turn it back on. (NOTE: This may now set
your
default percentage to 30% instead of 15%. It can only be reset to 15%
in
the
registry.)
Or, use vssadmin to resize your storage to 300MB. When done, reset it
to
the
original value. (This will basically wipe it also.)
Try to store several restore points.

They should remain and the allocated space should grow appropriately.
Check
them again in the morning. If they are all still there, you've been
running
out of space with the shadow copy feature. Don't know what you do with the
computer. But, if you fill up 8GB in one day, something is going on.


Thanks Mark! Look forward to your further input.

Happy to provide the xtra (I didn't do it before because it seems
that
Enough Info is in fact Too Much Info at first - seems to put people
off
reading...)

A restore point of 300MB sounds much more reasonable to me (XP's history
used to go back 1-2 months)...but as to how much should be allocated (or
max), Help says "To store restore points, you need at least 300 megabytes
(MB) of free space on each hard disk that has System Protection
turned
on.
System Restore might use up to 15 percent of the space on each
disk." -
key
point being "up to 15%" - though why it should be less when I have
more
free
space I don't know.

BTW - after collecting the information below I tried your suggested
commands - to no avail unfortunately... this is a direct copy/paste from
the
Cmd window (running as Admin of course) just so you know I didn't mistype

C:\Windows\system32>vssadmin create shadow /for=c:
vssadmin 1.1 - Volume Shadow Copy Service administrative command-line
tool
(C) Copyright 2001-2005 Microsoft Corp.

Error: Invalid command.

...Wasn't expecting it to work as vssadmin /? didn't list a Create
command -
does this work for other versions of Vista than HP (which is what I
have)?

But - here's the rest of the promised info

This is a Rock Xtreme latop with a ~93.16GB hard disk (that's what
Disk
Mamagement says - odd figure!) partitioned by the OEM with a 9.61GB
Restore
partition, leaving 83.5GB for the C drive, of which 12.1GB is still free.
(At home there is also a 40GB iSCSI device attached but I checked and it
is
not marked for System Restore - besides which it *is* a separate disk...)

Further info as follows:

C:\Windows\system32>vssadmin List ShadowStorage
Shadow Copy Storage association
For volume: (C:)\\?\Volume{70b18d2e-c8de-11db-ae44-806e6f6e6963}\
Shadow Copy Storage volume:
(C:)\\?\Volume{70b18d2e-c8de-11db-ae44-806e6f6e6963}\
Used Shadow Copy Storage space: 7.657 GB
Allocated Shadow Copy Storage space: 8.059 GB
Maximum Shadow Copy Storage space: 12.533 GB

[NB that max does equate to 15% of C, and I have seen the allocated
as
high
as 11GB+]

C:\Windows\system32>vssadmin List Shadows
Contents of shadow copy set ID:
{a870dd4f-e9c6-405d-86be-49bba3e9011d}
Contained 1 shadow copies at creation time: 28/02/2008 00:01:19
Shadow Copy ID: {caf4d6cd-27b6-45fb-a366-7876970d491d}
Original Volume:
(C:)\\?\Volume{70b18d2e-c8de-11db-ae44-806e6f6e6963}\
Shadow Copy Volume:
\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy11
Originating Machine: mymachine
Service Machine: mymachine
Provider: 'Microsoft Software Shadow Copy provider 1.0'
Type: ClientAccessibleWriters
Attributes: Persistent, Client-accessible, No auto release,
Differential, Auto recovered

Contents of shadow copy set ID:
{c252dc8d-2681-4a3d-897b-f974b972d8be}
Contained 1 shadow copies at creation time: 28/02/2008 14:12:23
Shadow Copy ID: {781034dc-c5b1-4226-b1b0-61b16a2e5a1f}
Original Volume:
(C:)\\?\Volume{70b18d2e-c8de-11db-ae44-806e6f6e6963}\
Shadow Copy Volume:
\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy12
Originating Machine: mymachine
Service Machine: mymachine
Provider: 'Microsoft Software Shadow Copy provider 1.0'
Type: ClientAccessibleWriters
Attributes: Persistent, Client-accessible, No auto release,
Differential, Auto recovered

And FWIW...

C:\Windows\system32>vssadmin list writers

Writer name: 'System Writer'
Writer Id: {e8132975-6f93-4464-a53e-1050253ae220}
Writer Instance Id: {1f05d78e-68f7-4183-a8b5-4cda0adc5cc8}
State: [5] Waiting for completion
Last error: No error

Writer name: 'ASR Writer'
Writer Id: {be000cbe-11fe-4426-9c58-531aa6355fc4}
Writer Instance Id: {476931d0-a53d-4a28-8f51-85a37ec03645}
State: [1] Stable
Last error: No error

Writer name: 'COM+ REGDB Writer'
Writer Id: {542da469-d3e1-473c-9f4f-7847f01fc64f}
Writer Instance Id: {890f7958-7d8d-48cb-841e-45dbae0b3b96}
State: [1] Stable
Last error: No error

Writer name: 'Shadow Copy Optimization Writer'
Writer Id: {4dc3bdd4-ab48-4d07-adb0-3bee2926fd7f}
Writer Instance Id: {57eb3dec-4196-482d-86a1-03601774fecf}
State: [1] Stable
Last error: No error

Writer name: 'Registry Writer'
Writer Id: {afbab4a2-367d-4d15-a586-71dbb18f8485}
Writer Instance Id: {bf7c57c9-b720-4219-be9a-07f21198d577}
State: [1] Stable
Last error: No error

Writer name: 'MSSearch Service Writer'
Writer Id: {cd3f2362-8bef-46c7-9181-d62844cdc0b2}
Writer Instance Id: {76c6eb0a-98be-4371-ade9-666e88a8476f}
State: [5] Waiting for completion
Last error: No error

Writer name: 'BITS Writer'
Writer Id: {4969d978-be47-48b0-b100-f328f07ac1e0}
Writer Instance Id: {de5e5c24-de13-49ea-82d0-c353c84e0e4e}
State: [1] Stable
Last error: No error

Writer name: 'WMI Writer'
Writer Id: {a6ad56c2-b509-4e6c-bb19-49d8f43532f0}
Writer Instance Id: {bc066c88-80c5-45fc-8004-643019f7b041}
State: [5] Waiting for completion
Last error: No error

What do you think?

Julian

A restore point is about 300MB, I find it difficult to imagine you have
7.4
GB of shadow copied files.
(Five restore points would be 1.5 GB.)

Restore/shadow copy by default uses 15% percent of your drive. You
stated
that your system is allocating 7.9 GB for storage. This would imply
a
hard
drive of 52GB. Since I've never heard of that size, sharing some
hardware
info might help. (Ex. You've got a bigger drive, but you've partitioned
your
Windows drive to some smaller value.)

The command:
vssadmin list shadowstorage
should tell you:
1. How much space of that allocated is actually being used.
2. The amount currently allocated.
3. The maximum amount that can be allocated.

The command:
vssadmin list shadows
should tell you:
1. How many and what restore points are currently being
retained.

The commands:
(NOTE: With your current problem, you may be erasing some prior restore
points.)
vssadmin create shadow /for=c:
vssadmin list shadows
You can use these commands to test your storage ability.
Just enter it a few times in a row to verify that it is keeping
each
restore
point.

Let us know what results you get.



There's quite a lot about limited restore point history around,
but
just
to
add some more info of my own and to plead again for assistance!

Since recently posting about how woefully few restore points I
have
I've
been watching them... I think I racked up 5 or 6 (spanning a
magnificent
4-5
days) and then all but one disappeared.

Yesterday (27 Feb) 2 new restore points were created (between midnight
and
1am) - one scheduled and then one as a result of a Windows Update.
Then,
between 03:20 and 05:00 I find 4 instance of volsnap helpfully
reporting
that "The oldest shadow copy of volume C: was deleted to keep disk
space
usage for shadow copies of volume C: below the user defined limit." -
and
then another two deletions at 16:45 and 23:28...

Why??? All I've done is use the machine - nothing installed,
uninstalled,
reconfigured... what is there to stuff into shadow storage? (My
differential Acronis System State Backup is only 30MB, that's an
indication
of how little has changed since Saturday when I took the full backup).

And this is Vista HP so there's no "version" facility; I hope the
Vista
isn't making shadow copies of stuff I cant' use.

Last night a new restore point was created automatically ... and then
a
further 3 "oldest shadow copies" were deleted... which is why I
had
only
a
single 10hr old restore point this morning.

Using vssadmin I find today 7.4GB used of the allocated 7.9B
shadow
storage,
in which I have 2 restore points (the one created automatically
just
after
midnight and one I just created as a test), which looks
suspicously
like
2x
full system state images judging by the size of my Acronis System
State
backups. Somehow the space requirement for a restore point just
doesn't
seem
right. Never mind lasting 136 years I'd be happy if a restore
point
stuck
around for a week!

This is seriously, seriously annoying now as it is utterly useless the
way
it stands. Can anyone help out? Have looked at BertK's stuff and
checked
around but there's a bit of a fact famine on this topic when it comes
to
specifics...

TIA
--
Julian I-Do-Stuff

Some Vista stuff, but mostly just Stuff at
http://berossus,blogspot.com




--
Julian I-Do-Stuff

Some Vista stuff, but mostly just Stuff at
http://berossus,blogspot.com
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Top