Restore points in XP

[James Silverton]

Hello, All!

Yesterday, I checked and I had 10 restore points. Today, I only
see one. Can someone please point me to an explanation? I *have*
done some searching and have seen listed conditions for creating
restore points but why would they disappear? Is it perhaps
because I installed a minor new (in my experience) program,
QuoteFix, for experimental purposes?


James Silverton
Potomac, Maryland, USA

 

[Jupiter Jones [MVP]]

Many things can cause loss of Restore Points.
The most common I see is something that causes a lot of hard drive activity.
More information about System Restore here:
http://bertk.mvps.org/

 

[Bert Kinney]

Hi,

Take a look at this page in particular.
Troubleshooting missing restore points:
http://bertk.mvps.org/html/missingrps.html

 

[James Silverton]

Bert wrote on Mon, 17 Jul 2006 17:05:53 -0400:

BK> Take a look at this page in particular.
BK> Troubleshooting missing restore points:
BK> http://bertk.mvps.org/html/missingrps.html

BK> --
BK> Regards,
BK> Bert Kinney MS-MVP Shell/User
BK> http://bertk.mvps.org

BK> "James Silverton" wrote
??>> Hello, All!
??>>
??>> Yesterday, I checked and I had 10 restore points. Today, I
??>> only see one. Can someone please point me to an
??>> explanation? I *have* done some searching and have seen
??>> listed conditions for creating restore points but why
??>> would they disappear? Is it perhaps because I installed a
??>> minor new (in my experience) program, QuoteFix, for
??>> experimental purposes?
??>>
??>> James Silverton
??>> Potomac, Maryland, USA

The page was very interesting but it does not fully answer the
question of what controls the establishment and removal of
restoration points. I am surprised that Microsoft does not have
information on this but I can't find it. Incidentally, my loss
of restoration points was worse than I thought and could have
been catastrophic! There was not one single point as I said;
there were *none* at all. IMO (not very humble), this should
never occur! The partition that is being monitored is only 50%
full and is formatted NTFS.

James Silverton.

 

[Bert Kinney]

Hi,

Bert wrote
BK> Take a look at this page in particular.
BK> Troubleshooting missing restore points:
BK> http://bertk.mvps.org/html/missingrps.html

BK> --
BK> Regards,
BK> Bert Kinney MS-MVP Shell/User
BK> http://bertk.mvps.org

BK> "James Silverton" wrote
??>> Hello, All!
??>>
??>> Yesterday, I checked and I had 10 restore points. Today, I
??>> only see one. Can someone please point me to an
??>> explanation? I *have* done some searching and have seen
??>> listed conditions for creating restore points but why
??>> would they disappear? Is it perhaps because I installed a
??>> minor new (in my experience) program, QuoteFix, for
??>> experimental purposes?
??>>
??>> James Silverton
??>> Potomac, Maryland, USA

The page was very interesting but it does not fully answer the
question of what controls the establishment and removal of restoration
points. I am surprised that Microsoft does not have information on
this but I can't find it. Incidentally, my loss of restoration points
was worse than I thought and could have been catastrophic! There was
not one single point as I said; there were *none* at all. IMO (not
very humble), this should never occur! The partition that is being
monitored is only 50% full and is formatted NTFS.

James Silverton.

If none of the causes on the page above are responsible for your missing
restore point then I suggest following the instruction on posting the
System Restore event logs so we can take a look.

 

[James Silverton]

Hi,



If none of the causes on the page above are responsible for
your missing restore point then I suggest following the
instruction on posting the System Restore event logs so we can
take a look.

I had a look at the logs (I think) with eventvwr.msc and also
via administrative tools and the only things that might be
significant in the time frame are reports that restore logging
has been suspended because of lack of space and that it will be
resumed when 200MB are available. However, the partition is
apparently about 50% empty. Can it be that restore needs
contiguous space? Defrag is reported as unnecessary.

Here's the content of the log at 10:00:25 PM on 7/16/06

The System Restore service has been suspended because there is
not enough disk space available on the drive
\\?\Volume{cff5b7f8-93b7-11d8-9fd1-0050bacc6602}\. System
Restore will automatically resume service once at least 200 MB
of free disk space is available on the system drive.



And, at 11:41:09 PM:

The System Restore service has resumed monitoring due to space
freed on the system drive.

These events occurred during and after a Retrospect full back-up
operation.

 

[Bert Kinney]

I had a look at the logs (I think) with eventvwr.msc and also via
administrative tools and the only things that might be significant in
the time frame are reports that restore logging has been suspended
because of lack of space and that it will be resumed when 200MB are
available. However, the partition is apparently about 50% empty. Can
it be that restore needs contiguous space? Defrag is reported as
unnecessary.

Here's the content of the log at 10:00:25 PM on 7/16/06

The System Restore service has been suspended because there is not
enough disk space available on the drive
\\?\Volume{cff5b7f8-93b7-11d8-9fd1-0050bacc6602}\. System Restore will
automatically resume service once at least 200 MB of free disk space
is available on the system drive.

And, at 11:41:09 PM:

The System Restore service has resumed monitoring due to space freed
on the system drive.

These events occurred during and after a Retrospect full back-up
operation.

Low disk space suspension will occur if any drive/partition that System
Restore is monitoring falls below 200mb's. Stop monitoring all
partitions other than the one Windows is installed on.

 

[James Silverton]

Low disk space suspension will occur if any drive/partition
that System Restore is monitoring falls below 200mb's. Stop
monitoring all partitions other than the one Windows is
installed on.

--
Regards,
Bert Kinney MS-MVP Shell/User
http://bertk.mvps.org

Thanks, I'll do just that and see what happens. There is no
particular need to monitor the Windows 98 partition (C or the
USB disc used for backup but they both seemed to have a lot of
free space when I checked.

 

[Bert Kinney]

The external drive can also be an issue. Take a look at the following
FAQ.
Tips Fixes & FAQs - Should I let System Restore monitor my external hard
drive?
http://bertk.mvps.org/html/tips.html

You will also want to make sure you don't make changes to the WinXP OS
while booted to the Win98 OS. Or the other way around if the Win98
partition is being monitored by SR. This can cause potential problems
with System Restore. This could cause a inconsistency in the SR log and
the files located in the SVI (System Volume Information) folder which in
turn will cause restore point corruption.

 

[James Silverton]

Bert wrote on Wed, 19 Jul 2006 14:50:35 -0400:




BK> The external drive can also be an issue. Take a look at the
BK> following FAQ.
BK> Tips Fixes & FAQs - Should I let System Restore monitor my
BK> external hard drive?
BK> http://bertk.mvps.org/html/tips.html

Have done and it's certainly an interesting site.

BK> You will also want to make sure you don't make changes to
BK> the WinXP OS while booted to the Win98 OS.

I'm not trying to be picky but what does making "a change to the
OS" mean?

Since my last post when I discontinued monitoring the W98
partition and the USB disc, 3 restore points have been set up
automatically. I have no idea why the particular times were
chosen.

Thanks again
James Silverton.

 

[Bert Kinney]

Hi James,

"James Silverton" wrote >

BK> The external drive can also be an issue. Take a look at the
BK> following FAQ.
BK> Tips Fixes & FAQs - Should I let System Restore monitor my
BK> external hard drive?
BK> http://bertk.mvps.org/html/tips.html

Have done and it's certainly an interesting site.

Thank you.

BK> You will also want to make sure you don't make changes to
BK> the WinXP OS while booted to the Win98 OS.

I'm not trying to be picky but what does making "a change to the OS"
mean?

Not picky at all. I will be glad to explain with this example:

In this dual boot or multi boot scenario, WinXP is set to monitor the
separate partition or drive where Win98 is installed. You boot to the
Win98 partition and make changes to any of the files (either on the
WinXP or Win98 partitions) which are monitored by System Restore. Such
as installing or uninstalling software in Win98. You boot out of Win98
and back into WinXP. When WinXP starts the System Restore filter driver
also starts and begins to keep track of monitored file types. At this
point it finds an inconsistency between these files and the log that was
created the last time WinXP was run. This inconsistency can cause
restore point corruption and cause System Restore to fail the next time
it is needed. So you can see, System Restore does not like it when
changes are made to monitored files while it is not able to track and
log the changes in real time.

I hope this explains it.

Since my last post when I discontinued monitoring the W98 partition
and the USB disc, 3 restore points have been set up automatically. I
have no idea why the particular times were chosen.

The changes you made, triggered the creation of the restore points.

 

[James Silverton]

Hi James,


In this dual boot or multi boot scenario, WinXP is set to
monitor the separate partition or drive where Win98 is
installed.

Hi Bert, thanks again for the scenario!

I am posting the rest of this mainly to clarify my own thoughts
but possibly others who are users rather than developers may
find it useful to know some hazards of dual (or multiple)
booting. The other paragraphs of this rather long post are
really only relevant to the hazards in the title. As I mentioned
in my previous post, since I set up restore to monitor only the
D: partition on which I have my usual Windows XP system, restore
points have been steadily added each day.

On two occasions, the restore facility has saved me a lot of
work and convinced me that it is extremely useful when I have
made ill-advised changes in system settings. I only wish
Microsoft had provided a relatively exhaustive listing of things
that are monitored. I guess my mental picture was that it
concerned itself with settings rather than files. For most of
the time, I think I only monitored the Windows XP partition
(D: ) but sometime recently, I mistakenly decided to include my
other partition and a USB hard disc.

When I started to use XP with my then new machine, I also
partitioned the disc and set up Windows 98 to deal with possible
incompatibilities and some programs that might be specific to
the older system or which I saw no point in installing like
older tax programs. In general, I have never written with one
version to the other partition. I have read files but generally
saved them to the working partition. The only problem with using
copied earlier files has been with permissions. I had not
noticed any unusual loss of restore points until my recent post.

I think my troubles began when I decided to experiment with
using Linux on my normal machine rather than the separate one
that had become slow (in present day terms) and also unreliable.
I had not had the time to use Linux much in the past year or
two. To refamiliarize myself, I have been using the Knoppix
version that boots from a CD rather than defining Linux
partitions for permanent installation. I set up a few permanent
files on the C: (Windows 98) partition and these were written to
under Linux. May I say that it is hard to express adequately my
admiration for Thomas Knopper's ingenuity in writing Knoppix;
its hardware recognition abilities alone are amazing! It was my
own fault but I managed to hang up Linux and thus not properly
close at least one of the C: permanent files. While Linux fixes
such things easily on a reboot, such is obviously not the case
for restore!

 

[Bert Kinney]

inline:

Hi Bert, thanks again for the scenario!

I am posting the rest of this mainly to clarify my own thoughts but
possibly others who are users rather than developers may find it
useful to know some hazards of dual (or multiple) booting. The other
paragraphs of this rather long post are really only relevant to the
hazards in the title. As I mentioned in my previous post, since I set
up restore to monitor only the D: partition on which I have my usual
Windows XP system, restore points have been steadily added each day.

On two occasions, the restore facility has saved me a lot of work and
convinced me that it is extremely useful when I have made ill-advised
changes in system settings. I only wish Microsoft had provided a
relatively exhaustive listing of things that are monitored.

What's Restored and What's Not

* Restored
o Registry (note: some current values will persist)
o Profiles (local only-roaming user profiles not impacted by
restore)
o COM+ DB
o WFP.dll cache
o WMI DB
o IIS Metabase
o Files with extensions listed in the Monitored File
Extensions list
* Not Restored
o DRM settings
o SAM hives (does not restore passwords)
o WPA settings (Windows authentication information is not
restored)
o Contents of the My Documents folder(s)
o Specific directories/files listed in the Monitored File
Extensions list
o Any file with an extension not listed in the Monitored File
Extensions list
o Items listed in both Filesnottobackup and KeysnottoRestore
(hklm->system->controlset001->control->backuprestore->filesnottobackup
and keysnottorestore)
o User-created data stored in the user profile
o Contents of redirected folders


List of files and folders System Restore monitors:
http://bertk.mvps.org/html/filesfolders.html