remove System Restore points individually?

LMiller7 said:

System Restore was designed as a means of quickly restoring the system to normal operation after a problem develops. It is best used as soon as possible after the problem occurs. It is not a long term solution. The further back you go the more likely that the restore will fail or cause more problems than it solves. On the few occasions I have used system restore it was always the most recent restore point.

If you want a long term backup you need an image backup. System Restore is not it.

I use the most recent point as well. However, if I wanted to "reinstall" the system without having to perform a factory reset, I may want to start from point A?

Layback Bear said:

Double said:

Layback Bear said:

Infection can and do get into restore points.

errr.. they do? you've made me paranoid before, but this..

Never underestimate the bad guys.

Good point

Kaktussoft said:

Creating a restore point is actually initiating a new Volume Shadow Set.
The longer a shadow set is active (so is the newest shadow set for that volume) the larger it will be. Read below... they are differential.

A rollback to a very old restore point is actually: A system restore to most recent restore point. After that a restore to restore point just prior to newest. etc.

So you can't do a system restore if some "needed" restore point is missing. If you delete a restore point you are actually merging two restore points.

Copy-on-Write (Differential Copy)

The copy-on-write method creates shadow copies that are differential rather than full copies of the original data. This method makes a copy of the original data before it is overwritten with new changes, as shown in the following table. When a change to the original volume occurs, but before it is written to disk, the block about to be modified is read and then written to a “differences area”, which preserves a copy of the data block before it is overwritten with the change. Using the blocks in the differences area and unchanged blocks in the original volume, a shadow copy can be logically constructed that represents the shadow copy at the point in time in which it was created.
The Copy-on-Write Method of Creating Shadow Copies


Time Source Data Contents Shadow Copy Contents T0
Original data
1 2 3 4 5
No copy
—
T1
Original data overwritten
1 2 3 4 5
Differences and index stored on shadow copy
3
The advantage of the copy-on-write method is that it creates shadow copies very rapidly because it is only writing the changes to disk. The disadvantage is that in order to fully restore the data, the original data must still be available. Without the original data, the shadow copy is incomplete and cannot be used. Another disadvantage is that the performance of copy-on-write implementations can affect the performance of the original volume.

Umm.. I still don't believe I understand, could you possibly summarize? Are you basically saying that I should remove all points and just create a new one today? It is starting to sound like restore points aren't as effective as I thought..

[QUOTE=Kaktussoft;2628607]

Double said:

So you cannot delete restore points somewhere in the middle... it is only possible if you merge them together. But that won't give you any extra space (only blocks that are rewritten in both restore points).

That was NOT correct under XP, and I doubt that you are correct under under Win7.

My recollection of XP was that each RP consisted of a single copy of the Registry Hives at the time the Point was created, and copies of all system Files that were either deleted or Windows feared they might vanish.

When CCLeaner "removed" Restore Points in the middle of an incremental series,
It did not damage the incremental series with simple deletion, instead, for each R.P. that the user chooses to delete,
CCleaner removes the non-incremental non-cumulative Registry Hives which will never again be used,
and this saves MOST of the space taken up by each R.P.,
and removes from User view the means of access to restore these points that no longer have registry hives,
but it leaves available all the copies of files and the logs that identify the original paths for each file,
hence Windows System Restore is still able to return to a very early data with a R.P. that still has its original Registry Hive,
and to see all the deleted and modified files in each of the "deleted" R.P. which are still present but concealed from the user.

Regards
Alan

It apparently is possible to arbitrarily delete any restore point. This would be done with the API function "SRRemoveRestorePoint" in which the only parameter is the sequence number of the restore point to be deleted. This function is accessible only by programs. What happens when this is done is not fully documented. Modification of restore points is to be done only with the system provided functions, of which there are only a few. Any direct manipulation of the files in the "System Volume Information" folder and you are in uncharted territory and results are unpredictable.

Microsoft has never fully documented the details of how system restore works. When low level details are documented developers will use this information and Microsoft is then obligated to maintain the behavior indefinitely or existing applications will break. That makes changes and upgrades more difficult.

System Restore was the first thing I turned off. Your system will be much faster with them off. I just create a system image using Windows 7 Pro Image/Backup tool.

With all due respect, I do not stand corrected.

CCleaner makes a tremendous improvement to the amount of Disk space used by Restore Points under XP.

You are probably correct,
but so am I in my statement of how Windows XP works and of how CCleaner deals with the R.P. within XP

R.P. were fallible on XP, therefore I had no trust in them never allowed them to exist on Windows 7.
Hence I have no experience of (or use for) R.P. in Windows 7.

I have seen the contents of XP R.P. within System Volume Information by scanning C:\ with the portable freeware version of TreeSize that is available from
https://www.jam-software.de/customer...0&language=EN&
I have seen and therefore know that each R.P. consisted of registry hives such as

Code:

C:\System Volume Information\_restore{F6EA6CAA-B744-447E-8F9E-B9A9507C7CB4}\RP1145\snapshot\_REGISTRY_MACHINE_SOFTWARE
F:\System Volume Information\_restore{F6EA6CAA-B744-447E-8F9E-B9A9507C7CB4}\RP1145\snapshot\Repository\FS\OBJECTS.DATA

and files such as

Code:

F:\System Volume Information\_restore{F6EA6CAA-B744-447E-8F9E-B9A9507C7CB4}\RP1145\A0285626.ini
F:\System Volume Information\_restore{F6EA6CAA-B744-447E-8F9E-B9A9507C7CB4}\RP1145\A0285627.mfl

CCleaner is compatible with XP through to Win 8.1
and I believe that Windows 7 users still expect CCleaner to increase free space when they remove intermediate Restore points.

I believe that the Piriform developers are quite clever,
and would NOT delete intermediate R.P. and still allow the user to activate restoration to a previous R.P. if that was doomed to failure.
I assume that they understand the differences between XP and Win7,
and if they still allow access to previous R.P. they have probably adapted their technique accordingly,
but exactly how Piriform do it I neither know nor care because I have no R.P.

Regards
Alan

Seven years ago I retired and started using a Laptop with XP.
Tried Dual Booting with Windows 7 and quickly decided it was not for me.
(Did NOT like UAC and did not like having to learn new ways to prevent Microsoft updates from updating and TRASHING Windows just when I was about to make a partition image backup of newly installed applications.)

When CCleaner first included the ability to remove intermediate R.P. I spent a day or two convinced that this would break the ability to restore to previous dates,
but then from my knowledge of previous observations of the contents of System Volume Information I guessed that all CC did was to remove the redundant non-cumulative registry hives and hide user access to them,
but retain all the cumulative files and change logs so that Windows Restore still had a valid chain of changes.

Two years ago my eldest son bought a new computer and passed on to me his old but powerful Desktop,
which unfortunately came with Windows 7.
I struggled with the pain of Windows 7 but persevered,
and since 2012 have never switched on the Laptop.

I am six years further into retirement than when I understood XP,

Thanks for the link to Vssadmin delete shadows
I am super thankful that the link does not explain in detail how it merges to retain a consistent chain
For me trying to understand VSS is a whole new world of pain

I am happy that Macrium Reflect imaging works for me and recognise that it use the "magic" of VSS.
I am more than happy that experts such as yourself are able to advise upon how the magic happens.

Regards
Alan