Windows 7 Forums

Welcome to Windows 7 Forums. Our forum is dedicated to helping you find support and solutions for any problems regarding your Windows 7 PC be it Dell, HP, Acer, Asus or a custom build. We also provide an extensive Windows 7 tutorial section that covers a wide range of tips and tricks.


Windows 7: remove System Restore points individually?

18 Dec 2013   #11
Layback Bear

Windows 7 Pro. 64/SP-1
 
 

Quote   Quote: Originally Posted by Double View Post
Quote   Quote: Originally Posted by Layback Bear View Post
Infection can and do get into restore points.
errr.. they do? you've made me paranoid before, but this..
Never underestimate the bad guys.


My System SpecsSystem Spec
.
19 Dec 2013   #12
Kaktussoft

Microsoft Community Contributor Award Recipient

Microsoft Windows 7 Home Premium 64-bits 7601 Multiprocessor Free Service Pack 1
 
 

Creating a restore point is actually initiating a new Volume Shadow Set.
The longer a shadow set is active (so is the newest shadow set for that volume) the larger it will be. Read below... they are differential.

A rollback to a very old restore point is actually: A system restore to most recent restore point. After that a restore to restore point just prior to newest. etc.

So you can't do a system restore if some "needed" restore point is missing. If you delete a restore point you are actually merging two restore points.

Copy-on-Write (Differential Copy)

The copy-on-write method creates shadow copies that are differential rather than full copies of the original data. This method makes a copy of the original data before it is overwritten with new changes, as shown in the following table. When a change to the original volume occurs, but before it is written to disk, the block about to be modified is read and then written to a “differences area”, which preserves a copy of the data block before it is overwritten with the change. Using the blocks in the differences area and unchanged blocks in the original volume, a shadow copy can be logically constructed that represents the shadow copy at the point in time in which it was created.
The Copy-on-Write Method of Creating Shadow Copies


Time Source Data Contents Shadow Copy Contents T0
Original data
1 2 3 4 5
No copy

T1
Original data overwritten
1 2 3 4 5
Differences and index stored on shadow copy
3
The advantage of the copy-on-write method is that it creates shadow copies very rapidly because it is only writing the changes to disk. The disadvantage is that in order to fully restore the data, the original data must still be available. Without the original data, the shadow copy is incomplete and cannot be used. Another disadvantage is that the performance of copy-on-write implementations can affect the performance of the original volume.
My System SpecsSystem Spec
19 Dec 2013   #13
Double

Windows 10 Home 64-bit
 
 

Quote   Quote: Originally Posted by LMiller7 View Post
System Restore was designed as a means of quickly restoring the system to normal operation after a problem develops. It is best used as soon as possible after the problem occurs. It is not a long term solution. The further back you go the more likely that the restore will fail or cause more problems than it solves. On the few occasions I have used system restore it was always the most recent restore point.

If you want a long term backup you need an image backup. System Restore is not it.
I use the most recent point as well. However, if I wanted to "reinstall" the system without having to perform a factory reset, I may want to start from point A?

Quote   Quote: Originally Posted by Layback Bear View Post
Quote   Quote: Originally Posted by Double View Post
Quote   Quote: Originally Posted by Layback Bear View Post
Infection can and do get into restore points.
errr.. they do? you've made me paranoid before, but this..
Never underestimate the bad guys.
Good point

Quote   Quote: Originally Posted by Kaktussoft View Post
Creating a restore point is actually initiating a new Volume Shadow Set.
The longer a shadow set is active (so is the newest shadow set for that volume) the larger it will be. Read below... they are differential.

A rollback to a very old restore point is actually: A system restore to most recent restore point. After that a restore to restore point just prior to newest. etc.

So you can't do a system restore if some "needed" restore point is missing. If you delete a restore point you are actually merging two restore points.

Copy-on-Write (Differential Copy)

The copy-on-write method creates shadow copies that are differential rather than full copies of the original data. This method makes a copy of the original data before it is overwritten with new changes, as shown in the following table. When a change to the original volume occurs, but before it is written to disk, the block about to be modified is read and then written to a “differences area”, which preserves a copy of the data block before it is overwritten with the change. Using the blocks in the differences area and unchanged blocks in the original volume, a shadow copy can be logically constructed that represents the shadow copy at the point in time in which it was created.
The Copy-on-Write Method of Creating Shadow Copies


Time Source Data Contents Shadow Copy Contents T0
Original data
1 2 3 4 5
No copy

T1
Original data overwritten
1 2 3 4 5
Differences and index stored on shadow copy
3
The advantage of the copy-on-write method is that it creates shadow copies very rapidly because it is only writing the changes to disk. The disadvantage is that in order to fully restore the data, the original data must still be available. Without the original data, the shadow copy is incomplete and cannot be used. Another disadvantage is that the performance of copy-on-write implementations can affect the performance of the original volume.
Umm.. I still don't believe I understand, could you possibly summarize? Are you basically saying that I should remove all points and just create a new one today? It is starting to sound like restore points aren't as effective as I thought..
My System SpecsSystem Spec
.

22 Dec 2013   #14
alan10

Windows 7 Ultimate 64 bit SP1 x64
 
 

[QUOTE=Kaktussoft;2628607]
Quote   Quote: Originally Posted by Double View Post
So you cannot delete restore points somewhere in the middle... it is only possible if you merge them together. But that won't give you any extra space (only blocks that are rewritten in both restore points).
That was NOT correct under XP, and I doubt that you are correct under under Win7.

My recollection of XP was that each RP consisted of a single copy of the Registry Hives at the time the Point was created, and copies of all system Files that were either deleted or Windows feared they might vanish.

When CCLeaner "removed" Restore Points in the middle of an incremental series,
It did not damage the incremental series with simple deletion, instead, for each R.P. that the user chooses to delete,
CCleaner removes the non-incremental non-cumulative Registry Hives which will never again be used,
and this saves MOST of the space taken up by each R.P.,
and removes from User view the means of access to restore these points that no longer have registry hives,
but it leaves available all the copies of files and the logs that identify the original paths for each file,
hence Windows System Restore is still able to return to a very early data with a R.P. that still has its original Registry Hive,
and to see all the deleted and modified files in each of the "deleted" R.P. which are still present but concealed from the user.

Regards
Alan
My System SpecsSystem Spec
22 Dec 2013   #15
LMiller7

Windows 7 Pro 64 bit
 
 

It apparently is possible to arbitrarily delete any restore point. This would be done with the API function "SRRemoveRestorePoint" in which the only parameter is the sequence number of the restore point to be deleted. This function is accessible only by programs. What happens when this is done is not fully documented. Modification of restore points is to be done only with the system provided functions, of which there are only a few. Any direct manipulation of the files in the "System Volume Information" folder and you are in uncharted territory and results are unpredictable.

Microsoft has never fully documented the details of how system restore works. When low level details are documented developers will use this information and Microsoft is then obligated to maintain the behavior indefinitely or existing applications will break. That makes changes and upgrades more difficult.
My System SpecsSystem Spec
22 Dec 2013   #16
Gary

Win 10 Pro 64
 
 

System Restore was the first thing I turned off. Your system will be much faster with them off. I just create a system image using Windows 7 Pro Image/Backup tool.
My System SpecsSystem Spec
23 Dec 2013   #17
Kaktussoft

Microsoft Community Contributor Award Recipient

Microsoft Windows 7 Home Premium 64-bits 7601 Multiprocessor Free Service Pack 1
 
 

[QUOTE=alan10;2632449]
Quote   Quote: Originally Posted by Kaktussoft View Post
Quote   Quote: Originally Posted by Double View Post
So you cannot delete restore points somewhere in the middle... it is only possible if you merge them together. But that won't give you any extra space (only blocks that are rewritten in both restore points).
That was NOT correct under XP, and I doubt that you are correct under under Win7.

My recollection of XP was that each RP consisted of a single copy of the Registry Hives at the time the Point was created, and copies of all system Files that were either deleted or Windows feared they might vanish.

When CCLeaner "removed" Restore Points in the middle of an incremental series,
It did not damage the incremental series with simple deletion, instead, for each R.P. that the user chooses to delete,
CCleaner removes the non-incremental non-cumulative Registry Hives which will never again be used,
and this saves MOST of the space taken up by each R.P.,
and removes from User view the means of access to restore these points that no longer have registry hives,
but it leaves available all the copies of files and the logs that identify the original paths for each file,
hence Windows System Restore is still able to return to a very early data with a R.P. that still has its original Registry Hive,
and to see all the deleted and modified files in each of the "deleted" R.P. which are still present but concealed from the user.

Regards
Alan
A "restore point" isn't file based. It's "cluster based". It hold the ORIGINAL SO OLD contents of clusters that CHANGED contents since creation of restore point. A restore point gets larger and larger over time.

Assume you have 2 restore points: one on 1 jan 2010 00:01 and one on 1 jan 2010 00:02

The first one is very small and covers all changes from 1 jan 2010 00:01 to 1 jan 2010 00:02, so only 1 minute.

The second one is large and covers all changes from 1 jan 2010 00:02 till now (23 dec 2013). That restore points has the ORIGINAL CONTENTS of changed blocks.

win7 can logically reconstruct the situation how situation was on 1 jan 2010 00:02 . After that it can even further back logically to 1 jan 2010 00:01. So it can logically reconstruct the situation of the disk at all "restore point creation times".

This logic is used for "system restore" and "previous versions of files".

Clear?
My System SpecsSystem Spec
23 Dec 2013   #18
alan10

Windows 7 Ultimate 64 bit SP1 x64
 
 

With all due respect, I do not stand corrected.

CCleaner makes a tremendous improvement to the amount of Disk space used by Restore Points under XP.

You are probably correct,
but so am I in my statement of how Windows XP works and of how CCleaner deals with the R.P. within XP

R.P. were fallible on XP, therefore I had no trust in them never allowed them to exist on Windows 7.
Hence I have no experience of (or use for) R.P. in Windows 7.

I have seen the contents of XP R.P. within System Volume Information by scanning C:\ with the portable freeware version of TreeSize that is available from
https://www.jam-software.de/customer...0&language=EN&
I have seen and therefore know that each R.P. consisted of registry hives such as
Code:
C:\System Volume Information\_restore{F6EA6CAA-B744-447E-8F9E-B9A9507C7CB4}\RP1145\snapshot\_REGISTRY_MACHINE_SOFTWARE
F:\System Volume Information\_restore{F6EA6CAA-B744-447E-8F9E-B9A9507C7CB4}\RP1145\snapshot\Repository\FS\OBJECTS.DATA
and files such as
Code:
F:\System Volume Information\_restore{F6EA6CAA-B744-447E-8F9E-B9A9507C7CB4}\RP1145\A0285626.ini
F:\System Volume Information\_restore{F6EA6CAA-B744-447E-8F9E-B9A9507C7CB4}\RP1145\A0285627.mfl
CCleaner is compatible with XP through to Win 8.1
and I believe that Windows 7 users still expect CCleaner to increase free space when they remove intermediate Restore points.

I believe that the Piriform developers are quite clever,
and would NOT delete intermediate R.P. and still allow the user to activate restoration to a previous R.P. if that was doomed to failure.
I assume that they understand the differences between XP and Win7,
and if they still allow access to previous R.P. they have probably adapted their technique accordingly,
but exactly how Piriform do it I neither know nor care because I have no R.P.

Regards
Alan
My System SpecsSystem Spec
23 Dec 2013   #19
Kaktussoft

Microsoft Community Contributor Award Recipient

Microsoft Windows 7 Home Premium 64-bits 7601 Multiprocessor Free Service Pack 1
 
 

I assume that they understand the differences between XP and Windows 7,
and if they still allow access to previous R.P. they have probably adapted their technique accordingly=>yes they are clever enough. They delete them using command explained here Vssadmin delete shadows

It's called a delete... but still... it actually is a merge!!

In winxp it's indeed working the way you told.
My System SpecsSystem Spec
23 Dec 2013   #20
alan10

Windows 7 Ultimate 64 bit SP1 x64
 
 

Seven years ago I retired and started using a Laptop with XP.
Tried Dual Booting with Windows 7 and quickly decided it was not for me.
(Did NOT like UAC and did not like having to learn new ways to prevent Microsoft updates from updating and TRASHING Windows just when I was about to make a partition image backup of newly installed applications.)

When CCleaner first included the ability to remove intermediate R.P. I spent a day or two convinced that this would break the ability to restore to previous dates,
but then from my knowledge of previous observations of the contents of System Volume Information I guessed that all CC did was to remove the redundant non-cumulative registry hives and hide user access to them,
but retain all the cumulative files and change logs so that Windows Restore still had a valid chain of changes.

Two years ago my eldest son bought a new computer and passed on to me his old but powerful Desktop,
which unfortunately came with Windows 7.
I struggled with the pain of Windows 7 but persevered,
and since 2012 have never switched on the Laptop.

I am six years further into retirement than when I understood XP,

Thanks for the link to Vssadmin delete shadows
I am super thankful that the link does not explain in detail how it merges to retain a consistent chain
For me trying to understand VSS is a whole new world of pain

I am happy that Macrium Reflect imaging works for me and recognise that it use the "magic" of VSS.
I am more than happy that experts such as yourself are able to advise upon how the magic happens.

Regards
Alan
My System SpecsSystem Spec
Reply

 remove System Restore points individually?




Thread Tools Search this Thread
Search this Thread:

Advanced Search




Similar help and support threads
Thread Forum
System Restore isn't creating (or saving?) restore points properly
For some reason my System Restore function isn't automatically creating (or isn't showing) System Restore points as it should be doing for "major" system events (e.g., isn't automatically creating restore points before/after Windows Updates and software/driver updates). I'm not sure if it isn't...
Backup and Restore
System Restore Error, Unable to Create Restore Points
Hello everyone, not sure why but I get an error every time I open the System Restore. I rarely have to use a restore point as I regularly maintain my computer and check for viruses and malware, but I would like to have the option just in case. When I open System Properties, and click the System...
Backup and Restore
System restore doesn't show any restore points - but they exist
After Tuesday's Windows update I couldn't boot into Windows and loaded my system repair disk planning to roll back to a restore point from the day before. But, the restore wizard couldn't find any restore points. I know my system does it daily and I did a manual one a week prior just to see if it...
Backup and Restore
Allocated System Restore space holds far fewer restore points now
I have 8gb of space allocated to System Restore, all monitoring my C partition only. This space is always at least 85-90% used according to the System Protection screen. In the past I have had at least 15 restore points to choose from after ticking "show more restore points." But today I went to...
Backup and Restore
System Restore Has Stopped Automatically Creating Restore Points
My last automatically System Restore Point automatically created by the passage of time was created 2013-01-23. No further automatic system restore points are being created (that means not ever, not daily, not weekly, simply no longer created automatically by the passage of time since last...
Backup and Restore
Can I Pause/Turn off System Restore WITHOUT losing restore points?
I work with a large software suite. The installer for this suite is really just a collection of many stand-alone installers. If SR is on when I run the installation, it takes a very long time. Additionally, since this is a collection of other installers, SR is somewhat useless to use as a...
Backup and Restore


Our Sites

Site Links

About Us

Find Us

Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd

All times are GMT -5. The time now is 23:23.

Twitter Facebook Google+



Windows 7 Forums

Seven Forums Android App Seven Forums IOS App