System Restore folder using enormous amount of memory

[Bert Kinney]

Hi Wilf,

Bert Kinney said ...
Hi Bert. I re-started restore and confined it to c: only. Before
booting, there was a RP1 directory under _restore. This had a few
files in it and directories snapshot/repositories/fs. All not very
large.

Good this is normal.

After reboot, the subdirectories are as were but RP1 now has about a
dozen more files in it mostly of the form A000000x.yyy where x is a
digit or digits and yyy is sys or ini or RDB etc. Other files include
restorepointsize
rp.log
change.log
change.log.1
A0000001.RDB (2811KB)
A0000012.RDB (also 2811KB)


Most of the the A-----.ini files contain this text

"
[.ShellClassInfo]
[email protected],-21774
"

But one ini file contains a whole lot more - it's long and I have
reproduced below this message.

The largest file is A0000006.sys which is 785,348KB.

Right click on this file and select Properties. Confirm the size of the
file. On the view tab click on Original File name. Make note of the name
of the file along with it's size and post them here.

If I reboot I'll get a whole set more of similar files with another
file of the form A-----.sys at around the same 785MB.

Is 785MB correct, or should it be 785 *KB* ?

Right click on these files and find there name and size then post that
information here.

There is no catalog.wci
Good.

My PC is a HP t660-uk with 512MB memory and Win XP Home SP2.

=======
Contents of A0000010.ini

This should not be a problem. What was it's size?

 

[Wilf]

Bert Kinney said ...

Hi Bert. I re-started restore and confined it to c: only. Before
booting, there was a RP1 directory under _restore. This had a few
files in it and directories snapshot/repositories/fs. All not very
large.

Good this is normal.

After reboot, the subdirectories are as were but RP1 now has about a
dozen more files in it mostly of the form A000000x.yyy where x is a
digit or digits and yyy is sys or ini or RDB etc. Other files include
restorepointsize
rp.log
change.log
change.log.1
A0000001.RDB (2811KB)
A0000012.RDB (also 2811KB)


Most of the the A-----.ini files contain this text

"
[.ShellClassInfo]
[email protected],-21774
"

But one ini file contains a whole lot more - it's long and I have
reproduced below this message.

The largest file is A0000006.sys which is 785,348KB.

Right click on this file and select Properties. Confirm the size of the
file. On the view tab click on Original File name. Make note of the name
of the file along with it's size and post them here.

Size is 766MB that is megabytes. I can't see a view tab in the
properties window - only General and Summary

Is 785MB correct, or should it be 785 *KB* ?

It _is_ megabytes

Right click on these files and find there name and size then post that
information here.

A-----10.ini is about 13KB


I wonder if there is a snapshot of memory being taken at each boot????

 

[Bert Kinney]

Bert Kinney said ...

Hi Bert. I re-started restore and confined it to c: only. Before
booting, there was a RP1 directory under _restore. This had a few
files in it and directories snapshot/repositories/fs. All not very
large.

Good this is normal.

After reboot, the subdirectories are as were but RP1 now has about a
dozen more files in it mostly of the form A000000x.yyy where x is a
digit or digits and yyy is sys or ini or RDB etc. Other files
include restorepointsize
rp.log
change.log
change.log.1
A0000001.RDB (2811KB)
A0000012.RDB (also 2811KB)


Most of the the A-----.ini files contain this text

"
[.ShellClassInfo]
[email protected],-21774
"

But one ini file contains a whole lot more - it's long and I have
reproduced below this message.

The largest file is A0000006.sys which is 785,348KB.

Right click on this file and select Properties. Confirm the size of
the file. On the view tab click on Original File name. Make note of
the name of the file along with it's size and post them here.

Size is 766MB that is megabytes. I can't see a view tab in the
properties window - only General and Summary

Is 785MB correct, or should it be 785 *KB* ?

It _is_ megabytes

OK, now go to Start - Search - All files and folder and type *.sys in
"All or part of the file name:"

Look in Drive C:

Expand "What size is it?"

Select "Larger (more that 1mb)

Expand "More advanced options" and put a check beside these selections:
Search system folders
Search hidden files and folders
Search subfolders

Click Search.

When complete, click View - Details

If "Hide protected operating system files is unchecked you should see
the tile in question twice. Once in the SVI folder and it's original
location. Right click the original, and in Properties look for any
information on which application owns this file and also note the folder
it is located in along with it's path. Post that information here.

 

[Bert Kinney]

Bert Kinney said ...

Hi Bert. I re-started restore and confined it to c: only. Before
booting, there was a RP1 directory under _restore. This had a few
files in it and directories snapshot/repositories/fs. All not very
large.

Good this is normal.

After reboot, the subdirectories are as were but RP1 now has about a
dozen more files in it mostly of the form A000000x.yyy where x is a
digit or digits and yyy is sys or ini or RDB etc. Other files
include restorepointsize
rp.log
change.log
change.log.1
A0000001.RDB (2811KB)
A0000012.RDB (also 2811KB)


Most of the the A-----.ini files contain this text

"
[.ShellClassInfo]
[email protected],-21774
"

But one ini file contains a whole lot more - it's long and I have
reproduced below this message.

The largest file is A0000006.sys which is 785,348KB.

Right click on this file and select Properties. Confirm the size of
the file. On the view tab click on Original File name. Make note of
the name of the file along with it's size and post them here.

Size is 766MB that is megabytes. I can't see a view tab in the
properties window - only General and Summary

That should have been the Version Tab. Sorry.

It _is_ megabytes

OK, now go to Start - Search - All files and folder and type *.sys in
"All or part of the file name:"

Look in Drive C:

Expand "What size is it?"

Select "Larger (more that 1mb)

Expand "More advanced options" and put a check beside these selections:
Search system folders
Search hidden files and folders
Search subfolders

Click Search.

When complete, click View - Details

If "Hide protected operating system files is unchecked you should see
the tile in question twice. Once in the SVI folder and it's original
location. Right click the original, and in Properties look for any
information on which application owns this file and also note the folder
it is located in along with it's path. Post that information here.

A-----10.ini is about 13KB


I wonder if there is a snapshot of memory being taken at each boot????

ini files are configuration setting that SR monitors and that change
from session to session.

 

[Wilf]

Bert Kinney said ...

OK, now go to Start - Search - All files and folder and type *.sys in
"All or part of the file name:"

Look in Drive C:

Expand "What size is it?"

Select "Larger (more that 1mb)

Expand "More advanced options" and put a check beside these selections:
Search system folders
Search hidden files and folders
Search subfolders

Click Search.

When complete, click View - Details

If "Hide protected operating system files is unchecked you should see
the tile in question twice. Once in the SVI folder and it's original
location. Right click the original, and in Properties look for any
information on which application owns this file and also note the folder
it is located in along with it's path. Post that information here.

ok.

Search results show A0000006.sys at 785,348KB only in SVI. Right
clicking it shows it's a system file with unknown application.

However, in the search results is also Pagefile.sys in C:\, and it's
exactly the same size (really exactly at 785,348KB). Pagefile.sys has
timestamp of 12/12/2005 16:33 whilst A0000006.sys has timestamp 16:29.

I have rebooted once since enabling system restore this afternoon at
around 16:30.

Looks to me as if each time I reboot another copy is taken of
pagefile.sys and that is why I keep losing so much space. This doesn't
look suspicious (maybe?) but a damn nuisance. Maybe with this info you
nowhave more to go on? Why is my system reproducing pagefile.sys
everytime it re-boots?

 

[Wilf]

Wilf said ...

ok.

Search results show A0000006.sys at 785,348KB only in SVI. Right
clicking it shows it's a system file with unknown application.

However, in the search results is also Pagefile.sys in C:\, and it's
exactly the same size (really exactly at 785,348KB). Pagefile.sys has
timestamp of 12/12/2005 16:33 whilst A0000006.sys has timestamp 16:29.

I have rebooted once since enabling system restore this afternoon at
around 16:30.

Looks to me as if each time I reboot another copy is taken of
pagefile.sys and that is why I keep losing so much space. This doesn't
look suspicious (maybe?) but a damn nuisance. Maybe with this info you
nowhave more to go on? Why is my system reproducing pagefile.sys
everytime it re-boots?

I just did a second reboot. Now among the various ini files etc in SVI,
there is a second .sys file. The first is as before, timestamped 16:29.
The second is timestamped 16:33 as per the original pagefile.sys. Now,
pagefile.sys in c:\ is timestamped 17:48 - i.e. about the time I did the
latest reboot. All three have exactly the same size. These .sys files
in SVI certainly seem to be copies of pagefile.sys.

 

[Bert Kinney]

Bert Kinney said ...
ok.

Search results show A0000006.sys at 785,348KB only in SVI. Right
clicking it shows it's a system file with unknown application.

However, in the search results is also Pagefile.sys in C:\, and it's
exactly the same size (really exactly at 785,348KB). Pagefile.sys has
timestamp of 12/12/2005 16:33 whilst A0000006.sys has timestamp 16:29.

Good, now we know what file it is.

Is Virtual Memory set to "System Managed Size"? If not what?

I have rebooted once since enabling system restore this afternoon at
around 16:30.

Looks to me as if each time I reboot another copy is taken of
pagefile.sys and that is why I keep losing so much space. This
doesn't look suspicious (maybe?) but a damn nuisance. Maybe with
this info you nowhave more to go on? Why is my system reproducing
pagefile.sys everytime it re-boots?

The page file is regenerated at each boot. This is normal.

Virtual Memory in Windows XP
http://www.aumha.org/win5/a/xpvm.php

It is not normal for SR to be monitoring it! We will have to figure out
why it is!

 

[R. McCarty]

If I could suggest a couple of things. First I would turn off the Pagefile.
Reboot in Safe mode, Administrator account and then recreate a new
Pagefile.Sys. Reboot back to Safe Mode and check ownership of the
Pagefile and it's attributes for Hidden & System. Also, I don't believe
it gets physically re-created on each boot. I just checked creation date
for mine and has the correct date when XP was installed.

 

[Wilf]

Bert Kinney said ...

Good, now we know what file it is.

Is Virtual Memory set to "System Managed Size"? If not what?

Yes - System managed and currently 766MB

 

[Wilf]

R. McCarty said ...

If I could suggest a couple of things. First I would turn off the Pagefile.
Reboot in Safe mode, Administrator account and then recreate a new
Pagefile.Sys. Reboot back to Safe Mode and check ownership of the
Pagefile and it's attributes for Hidden & System. Also, I don't believe
it gets physically re-created on each boot. I just checked creation date
for mine and has the correct date when XP was installed.

I've now done all this - I first stopped system restore, then did the
above then restarted system restore. I still have the same problem with
copies of pagefile appearing in the restore folder after reboot.

 

[R. McCarty]

Sorry it didn't help out. Very unusual problem. I know that SR does
monitor .Sys extension files - but didn't think it would track/backup
the Pagefile as part of it's point creation. Beside maybe reinstalling
SR.Inf, I'm at loss what to suggest to help you. Good Luck with it.

 

[Wilf]

R. McCarty said ...

Sorry it didn't help out. Very unusual problem. I know that SR does
monitor .Sys extension files - but didn't think it would track/backup
the Pagefile as part of it's point creation. Beside maybe reinstalling
SR.Inf, I'm at loss what to suggest to help you. Good Luck with it.

Thanks - if there's no solution (and I still hope that perhaps Bert may
have an answer for me), I'll just switch off SR again - but i don't want
to do that unless it's strictly necessary.

 

[Bert Kinney]

System Restore is only monitoring the drive Windows is installed on,
correct?

I would suggest deleting the pagefile.sys and start over. To do so, go
to Safe Mode - Administrator.
Right click on My Computer - Properties - Advanced Tab - Setting under
Performance - Advanced Tab - Change - Select "No paging file" then Set.
Check all other drive to make sure they have no page file either. Close
out of there and reboot the system to normal mode.

Check to make sure there is not Pagefile.sys anywhere on the system. If
one is found delete it.

If there was one to delete, reboot the system. If not, in normal mode
set paging to "System managed size" and reboot. Reboot the system and
recheck the SVI folder for a file the same size as the page file.

 

[Bert Kinney]

If I could suggest a couple of things. First I would turn off the
Pagefile. Reboot in Safe mode, Administrator account and then
recreate a new Pagefile.Sys. Reboot back to Safe Mode and check
ownership of the Pagefile and it's attributes for Hidden & System.
Also, I don't believe it gets physically re-created on each boot. I
just checked creation
date for mine and has the correct date when XP was installed.

I was under the impression it was after reading this article. After
testing this with a page file monitoring tool I confirmed that the
Pagefile.sys file size does not change, but the pagefile usage does. So
as the pagefile size does not change, the pagefile usage does on reboot.

Virtual Memory in Windows XP
http://www.aumha.org/win5/a/xpvm.php

The pagefile monitoring tools I was referring to (
WinXP-2K_Pagefile.zip ) can be downloaded here.

Windows Tweaks & Tips - Bill James, Microsoft MVP
http://billsway.com/notes_public/WinXP_Tweaks/

 

[R. McCarty]

Thanks for the info, I'll take a look at the tool.

 

[Wilf]

Wilf said ...

Bert Kinney said ...

Yes - System managed and currently 766MB

Ok, I've switched off SR, I've moved the pagefile to the D: drive and
turned on SR only on C: - this was ok and the pagefile was not copied to
SVI on reboot. I them put a pagefile on both drives and that one which
was on C: was copied to SVI on reboot. I give up and have turned off
SR. A pity but I see no alternative. Surely there must be some simple
reason why my pagefile is getting reproduced within SVI on each boot? I
don't suppose it could be something to d owith my startup and recovery
settings? Since a few months ago, I noticed that on booting, instead of
just running windows XP, the system sits for a few seconds offering the
option of booting into Windows or Windows Recovery console - I don't
recall it always doing that. After 3 seconds or so, it automatically
then boots into Windows. Don't know if this could be relevant?

 

[Bert Kinney]

Wilf, by change is there any Norton products installed on the system?