System Restore Points Disappeared

[Guest]

Over the weekend I discovered that all system restores prior to 12/21
disappeared. While I was not aware of any activity the cause this I did find
several entries in the system Event Log. Expanding the information in the
logs, pointed to a MS article # KB888402 which seems to describe the prolem.
On 12/21 I did have a USB flash drive and a firewire external HDD connected
--apparently when the automatic system restore tried to take place. I
normally have system monitoring turned ON only for the C: drive (and disabled
for the D: E: F: internal drives), however disabling monitoring for
removable/external drives is not retained for those drives when they are
subsequently re-connected.

As noted in the logs below, several hours after the restore points where
apparently automatically deleted the system did automatically create a
restore point. Over the next several day additional automatic restore points
were properly created as was a manual 'test' restore point.

Curiously, the event log states that when the problem ocurred it stopped
monitoring on that particular disk, yet monitoring was apparently turned off
for ALL disks.

Also, is it really a valid approach to DELETE ALL previous restore points
(and presumed valid) when only the one currently being created might be
corrupted?

The OS is Win XP-Pro SP2.

The KB888402 article references a HOTFIX is seems to be a limited release
only is the problem is encountered. It further states that additional
testing may be done before the next SP release, and suggests waiting.

QUESTION?: Since this condition has only (knowingly) ocurred one time
should I request and install the HOTFIX at this time???

Event Log Excerpt:
Type Date Time Source Category Event User Computer

Information 12/21/2005 7:58:47 PM Service Control Manager None 7036 N/A DGBH
Information 12/21/2005 7:58:47 PM Service Control Manager None 7035 Nor DGBH
Information 12/21/2005 7:58:47 PM Service Control Manager None 7036 N/A DGBH
Information 12/21/2005 7:53:05 PM Service Control Manager None 7036 N/A DGBH
Information 12/21/2005 7:53:05 PM Service Control Manager None 7035 Nor DGBH
Information 12/21/2005 7:53:05 PM Service Control Manager None 7036 N/A DGBH
Information 12/21/2005 2:23:16 PM srservice None 108 N/A DGBH
Information 12/21/2005 12:11:02 PM srservice None 107 N/A DGBH
Information 12/21/2005 11:04:24 AM srservice None 107 N/A DGBH
Information 12/21/2005 11:04:22 AM srservice None 107 N/A DGBH
Error 12/21/2005 11:04:08 AM sr None 1 N/A DGBH
Information 12/21/2005 7:37:47 AM Service Control Manager None 7036 N/A DGBH
Information 12/21/2005 7:37:47 AM Service Control Manager None 7035 Nor DGBH
Information 12/21/2005 7:37:44 AM Service Control Manager None 7036 N/A DGBH
Information 12/21/2005 7:37:40 AM Service Control
Manager None 7035 SYSTEM DGBH
Information 12/21/2005 7:37:40 AM Service Control Manager None 7036 N/A DGBH
Information 12/21/2005 7:37:40 AM Service Control Manager None 7036 N/A DGBH


Event Log Details:
Event Type: Error
Event Source: sr
Event Category: None
Event ID: 1
Date: 12/21/2005
Time: 11:04:08 AM
User: N/A
Computer: DGBH
Description:
The System Restore filter encountered the unexpected error '0xC000007F'
while processing the file '20051213-034-i32.exe' on the volume
'HarddiskVolume6'. It has stopped monitoring the volume.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 06 00 00 00 04 00 4e 00 ......N.
0008: 00 00 00 00 01 00 00 c0 .......À
0010: 00 00 00 00 00 00 00 00 ........
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 00 00 00 00 00 00 00 ........




Event Type: Information
Event Source: SRService
Event Category: None
Event ID: 107
Date: 12/21/2005
Time: 11:04:22 AM
User: N/A
Computer: DGBH
Description:
The System Restore service has been suspended because there is not enough
disk space available on the drive
\\?\Volume{886eb886-5bab-11da-a7c1-0007e9c66922}\. System Restore will
automatically resume service once at least 200 MB of free disk space is
available on the system drive.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.


Event ID: 107 = 2 more times



Event Type: Information
Event Source: SRService
Event Category: None
Event ID: 108
Date: 12/21/2005
Time: 2:23:16 PM
User: N/A
Computer: DGBH
Description:
The System Restore service has resumed monitoring due to space freed on the
system drive.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

 

[Ken Blake, MVP]

Also, is it really a valid approach to DELETE ALL previous restore
points (and presumed valid) when only the one currently being created
might be corrupted?

Your only options are to delete all Restore points or all but the latest
one.

 

[Bert Kinney]

Hi,

Over the weekend I discovered that all system restores prior to 12/21
disappeared. While I was not aware of any activity the cause this I
did find several entries in the system Event Log. Expanding the
information in the logs, pointed to a MS article # KB888402 which
seems to describe the prolem. On 12/21 I did have a USB flash drive
and a firewire external HDD connected --apparently when the automatic
system restore tried to take place. I normally have system
monitoring turned ON only for the C: drive (and disabled for the D:
E: F: internal drives), however disabling monitoring for
removable/external drives is not retained for those drives when they
are subsequently re-connected.

You can try assigning the flash drive and external drive a permanent
drive letter. Then stop System Restore from monitoring the two drives.
It is normally best to only have SR monitor the partition Windows is
installed on. This should eliminate the low disk space and filter driver
problem.

 

[Guest]

I though I had assigned permanent drive letters to the (removable) drives
--they always re-appear as the same drive letter when either or both are
re-connected. Perhaps you could described the proper procedure to assign
permanent drive letters, just in case I did not do it correctly.

Also, what would your recommendation be regarding KB888402?
(ie QUESTION?: Since this condition has only (knowingly) ocurred one time
should I request and install the HOTFIX at this time???)

Hi,

You can try assigning the flash drive and external drive a permanent
drive letter. Then stop System Restore from monitoring the two drives.
It is normally best to only have SR monitor the partition Windows is
installed on. This should eliminate the low disk space and filter driver
problem.

 

[Bert Kinney]

Hi,

I though I had assigned permanent drive letters to the (removable)
drives --they always re-appear as the same drive letter when either
or both are re-connected. Perhaps you could described the proper
procedure to assign permanent drive letters, just in case I did not
do it correctly.

This should explain it.
How to change drive letter assignments in Windows XP
http://support.microsoft.com/kb/307844/en-us

Also, what would your recommendation be regarding KB888402?
(ie QUESTION?: Since this condition has only (knowingly) ocurred one
time should I request and install the HOTFIX at this time???)

Are you seeing this or any other error in Event Viewer under "sr" and
"srservice" source? If so post them here so we can take a look.

To do so, go to Start - Run and type eventvwr.msc and press enter.
Click on System in the left pane.
Click the gray title "Source" at the top of the source name column in
the right pane to sort by source name, look for "sr" and "srservice".
Double click on each of these events, then click on the button below the
two arrows in the upper right corner. This will copy the event
information to the clipboard. Paste the information for each of the two
event here. There's no need to post duplicate Event ID's.

How do I use the Event Viewer to search for System Restore logs?
http://bertk.mvps.org/html/tips.html#EventViewer

--
Regards,
Bert Kinney MS-MVP Shell/User
http://bertk.mvps.org

Hi,

You can try assigning the flash drive and external drive a permanent
drive letter. Then stop System Restore from monitoring the two
drives. It is normally best to only have SR monitor the partition
Windows is installed on. This should eliminate the low disk space
and filter driver problem.

 

[Guest]

Bert Kinney:
Thanks for you responses and suggestions, see comments below

Hi,



This should explain it.
How to change drive letter assignments in Windows XP
http://support.microsoft.com/kb/307844/en-us

This is how the external HDD (I was assigned. The Flash drive (J
probably just assumed the next drive letter when first plugged-in. However,
NEITHER drive remembers to keep monitoring 'turned off' even though I have
previously done that several times. Each time either drive is re-connected
the system restore eventually recognizes the drive and starts monitoring it.

Are you seeing this or any other error in Event Viewer under "sr" and
"srservice" source? If so post them here so we can take a look.

The event viewer logs were attached to my initial post (above), and as noted
this is the first/only time that I have encountered this problem. A search
of the entire eventlog revealed only the logs mentioned above.

To do so, go to Start - Run and type eventvwr.msc and press enter.
Click on System in the left pane.
Click the gray title "Source" at the top of the source name column in
the right pane to sort by source name, look for "sr" and "srservice".
Double click on each of these events, then click on the button below the
two arrows in the upper right corner. This will copy the event
information to the clipboard. Paste the information for each of the two
event here. There's no need to post duplicate Event ID's.

How do I use the Event Viewer to search for System Restore logs?
http://bertk.mvps.org/html/tips.html#EventViewer

< snip >
Thanks again.

 

[Plato]

Over the weekend I discovered that all system restores prior to 12/21
disappeared. While I was not aware of any activity the cause this I did find

http://www.bootdisk.com/xptop20.htm#15