New
#11
Sounds OK Bear, though I am now near totally confused from all th kind and honest input
Sounds OK Bear, though I am now near totally confused from all th kind and honest input
Easiest is to use this little program from a Swiss friend. It is completely safe. It shows you all restore points on any partition and you can even recover anything from those restore points.
ShadowExplorer - Recover Lost Files and Folders
Btw: Kari's command is:
vssadmin list shadows
The output looks like this. Not easy to read for a layman, LOL.
Shadow Copy ID: {12edb509-5a62-4c72-a0b2-f2851f340142}
Original Volume: (E:)\\?\Volume{f4916598-31b0-11e1-a4e9-d4bed98cc025}\
Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy21
Originating Machine: whs-PC
Service Machine: whs-PC
Provider: 'Microsoft Software Shadow Copy provider 1.0'
Type: ClientAccessibleWriters
Attributes: Persistent, Client-accessible, No auto release, Differential, Auto recov
ered
Contents of shadow copy set ID: {fed1d352-0e19-4514-85fd-29a634d8d98c}
Contained 2 shadow copies at creation time: 12/29/2013 5:30:33 PM
Shadow Copy ID: {4b812476-cdfc-405b-b267-858d3d736719}
Original Volume: (E:)\\?\Volume{f4916598-31b0-11e1-a4e9-d4bed98cc025}\
Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy22
Originating Machine: whs-PC
Service Machine: whs-PC
Provider: 'Microsoft Software Shadow Copy provider 1.0'
Type: ClientAccessibleWriters
Attributes: Persistent, Client-accessible, No auto release, Differential, Auto recov
ered
Contents of shadow copy set ID: {7331e75b-96ba-4191-a3c8-8649eb92ae78}
Contained 2 shadow copies at creation time: 12/29/2013 5:30:40 PM
Shadow Copy ID: {8b9fa698-8e51-44d2-af7f-2bf21d7c840c}
Original Volume: (E:)\\?\Volume{f4916598-31b0-11e1-a4e9-d4bed98cc025}\
Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy23
Originating Machine: whs-PC
Service Machine: whs-PC
Provider: 'Microsoft Software Shadow Copy provider 1.0'
Type: ClientAccessibleWriters
Attributes: Persistent, Client-accessible, No auto release, Differential, Auto recov
ered
Contents of shadow copy set ID: {9cfdca9b-18b5-45b2-aa02-2db126fab529}
Contained 2 shadow copies at creation time: 12/29/2013 5:32:21 PM
Shadow Copy ID: {c6ee9054-26cc-41cb-a552-70542fbb1001}
Original Volume: (E:)\\?\Volume{f4916598-31b0-11e1-a4e9-d4bed98cc025}\
Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy24
Originating Machine: whs-PC
Service Machine: whs-PC
Provider: 'Microsoft Software Shadow Copy provider 1.0'
Type: ClientAccessibleWriters
Attributes: Persistent, Client-accessible, No auto release, Differential, Auto recov
ered
Contents of shadow copy set ID: {a876be82-8bae-4412-b04c-4320ba461634}
Contained 2 shadow copies at creation time: 1/1/2014 11:44:25 AM
Shadow Copy ID: {fb739b8e-e105-40b7-8a85-4c218b280c35}
Original Volume: (E:)\\?\Volume{f4916598-31b0-11e1-a4e9-d4bed98cc025}\
Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy25
Originating Machine: whs-PC
Service Machine: whs-PC
Provider: 'Microsoft Software Shadow Copy provider 1.0'
Type: ClientAccessibleWriters
Attributes: Persistent, Client-accessible, No auto release, Differential, Auto recov
ered
Contents of shadow copy set ID: {1bab2ae3-c9c5-499f-99a3-fd9832798a55}
Contained 2 shadow copies at creation time: 1/2/2014 8:33:35 PM
Shadow Copy ID: {fe89a19f-1695-4c9f-bb30-cac806425e9d}
Original Volume: (E:)\\?\Volume{f4916598-31b0-11e1-a4e9-d4bed98cc025}\
Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy26
Originating Machine: whs-PC
Service Machine: whs-PC
Provider: 'Microsoft Software Shadow Copy provider 1.0'
Type: ClientAccessibleWriters
Attributes: Persistent, Client-accessible, No auto release, Differential, Auto recov
ered
Contents of shadow copy set ID: {df3836a5-8a33-4821-9efe-6ed628394e3e}
Contained 2 shadow copies at creation time: 1/2/2014 10:19:08 PM
Shadow Copy ID: {f3128f8d-b79f-415b-bbc9-48a391279afe}
Original Volume: (E:)\\?\Volume{f4916598-31b0-11e1-a4e9-d4bed98cc025}\
Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy27
Originating Machine: whs-PC
Service Machine: whs-PC
Provider: 'Microsoft Software Shadow Copy provider 1.0'
Type: ClientAccessibleWriters
Attributes: Persistent, Client-accessible, No auto release, Differential, Auto recov
ered
Contents of shadow copy set ID: {6cec3d18-2062-4645-952d-541e5f6919fc}
Contained 2 shadow copies at creation time: 1/2/2014 10:29:43 PM
Shadow Copy ID: {06d0b395-2ffa-41b4-a45c-a62ec29a53ed}
Original Volume: (E:)\\?\Volume{f4916598-31b0-11e1-a4e9-d4bed98cc025}\
Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy28
Originating Machine: whs-PC
Service Machine: whs-PC
Provider: 'Microsoft Software Shadow Copy provider 1.0'
Type: ClientAccessibleWriters
Attributes: Persistent, Client-accessible, No auto release, Differential, Auto recov
ered
Contents of shadow copy set ID: {28a7d9cb-37b3-4518-a389-15556c51bb78}
Contained 2 shadow copies at creation time: 1/2/2014 10:31:23 PM
Shadow Copy ID: {834d82df-9945-4851-b0d3-1e1f97276564}
Original Volume: (E:)\\?\Volume{f4916598-31b0-11e1-a4e9-d4bed98cc025}\
Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy29
Originating Machine: whs-PC
Service Machine: whs-PC
Provider: 'Microsoft Software Shadow Copy provider 1.0'
Type: ClientAccessibleWriters
Attributes: Persistent, Client-accessible, No auto release, Differential, Auto recov
ered
Contents of shadow copy set ID: {2b9c69b0-9e85-4097-8998-183002277ba7}
Contained 2 shadow copies at creation time: 1/2/2014 10:32:55 PM
Shadow Copy ID: {b15016ad-1394-4373-8fcc-547210e8d0a8}
Original Volume: (E:)\\?\Volume{f4916598-31b0-11e1-a4e9-d4bed98cc025}\
Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy30
Originating Machine: whs-PC
Service Machine: whs-PC
Provider: 'Microsoft Software Shadow Copy provider 1.0'
Type: ClientAccessibleWriters
Attributes: Persistent, Client-accessible, No auto release, Differential, Auto recov
ered
Contents of shadow copy set ID: {f649f0a3-17f2-487e-a23d-5dde1b052af4}
Contained 2 shadow copies at creation time: 1/2/2014 10:41:50 PM
Shadow Copy ID: {638a7269-6352-4cd4-a778-42b587e4a403}
Original Volume: (E:)\\?\Volume{f4916598-31b0-11e1-a4e9-d4bed98cc025}\
Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy31
Originating Machine: whs-PC
Service Machine: whs-PC
Provider: 'Microsoft Software Shadow Copy provider 1.0'
Type: ClientAccessibleWriters
Attributes: Persistent, Client-accessible, No auto release, Differential, Auto recov
ered
Contents of shadow copy set ID: {2c0c7d5b-2836-42c1-a6b0-d65d50ace895}
Contained 3 shadow copies at creation time: 1/4/2014 5:07:12 PM
Shadow Copy ID: {d40fb5a2-79e4-443c-9e43-5b422fee7b83}
Original Volume: (E:)\\?\Volume{f4916598-31b0-11e1-a4e9-d4bed98cc025}\
Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy32
Originating Machine: whs-PC
Service Machine: whs-PC
Provider: 'Microsoft Software Shadow Copy provider 1.0'
Type: ClientAccessibleWriters
Attributes: Persistent, Client-accessible, No auto release, Differential, Auto recov
ered
Contents of shadow copy set ID: {2b09df5a-8eb6-4208-8f2f-6f2dd050d7d0}
Contained 2 shadow copies at creation time: 1/5/2014 10:13:08 AM
Shadow Copy ID: {089c96eb-e6d5-46f1-aa0f-af9c063a69b4}
Original Volume: (E:)\\?\Volume{f4916598-31b0-11e1-a4e9-d4bed98cc025}\
Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy33
Originating Machine: whs-PC
Service Machine: whs-PC
Provider: 'Microsoft Software Shadow Copy provider 1.0'
Type: ClientAccessibleWriters
Attributes: Persistent, Client-accessible, No auto release, Differential, Auto recov
ered
Contents of shadow copy set ID: {596e5ffa-538b-439d-85b5-7927094b88d5}
Contained 2 shadow copies at creation time: 1/7/2014 8:07:51 PM
Shadow Copy ID: {2f89b7d1-1ae5-45d2-8e39-0d6ffb5c9440}
Original Volume: (E:)\\?\Volume{f4916598-31b0-11e1-a4e9-d4bed98cc025}\
Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy35
Originating Machine: whs-PC
Service Machine: whs-PC
Provider: 'Microsoft Software Shadow Copy provider 1.0'
Type: ClientAccessibleWriters
Attributes: Persistent, Client-accessible, No auto release, Differential, Auto recov
ered
Shadow Copy ID: {6bfeb6fc-39a2-41a9-b567-b7500f3a73f5}
Original Volume: (C:)\\?\Volume{d6637946-33eb-11e1-8bdf-806e6f6e6963}\
Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy43
Originating Machine: whs-PC
Service Machine: whs-PC
Provider: 'Microsoft Software Shadow Copy provider 1.0'
Type: ClientAccessibleWriters
Attributes: Persistent, Client-accessible, No auto release, Differential, Auto recov
ered
Contents of shadow copy set ID: {d55390b5-ab9f-4c17-963e-2a9785411f14}
Contained 2 shadow copies at creation time: 1/7/2014 8:08:00 PM
Shadow Copy ID: {48f2ff39-394b-4be5-876f-a7c994a9bca8}
Original Volume: (E:)\\?\Volume{f4916598-31b0-11e1-a4e9-d4bed98cc025}\
Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy36
Originating Machine: whs-PC
Service Machine: whs-PC
Provider: 'Microsoft Software Shadow Copy provider 1.0'
Type: ClientAccessibleWriters
Attributes: Persistent, Client-accessible, No auto release, Differential, Auto recov
ered
Shadow Copy ID: {2f83876b-eedc-4dff-bd85-ed2b29ef5272}
Original Volume: (C:)\\?\Volume{d6637946-33eb-11e1-8bdf-806e6f6e6963}\
Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy44
Originating Machine: whs-PC
Service Machine: whs-PC
Provider: 'Microsoft Software Shadow Copy provider 1.0'
Type: ClientAccessibleWriters
Attributes: Persistent, Client-accessible, No auto release, Differential, Auto recov
ered
Contents of shadow copy set ID: {94814f64-6ad3-4eaa-ad05-f2080358ef1b}
Contained 2 shadow copies at creation time: 1/7/2014 8:09:26 PM
Shadow Copy ID: {b8736550-7e8e-4062-a9e0-dd0303d9d993}
Original Volume: (E:)\\?\Volume{f4916598-31b0-11e1-a4e9-d4bed98cc025}\
Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy37
Originating Machine: whs-PC
Service Machine: whs-PC
Provider: 'Microsoft Software Shadow Copy provider 1.0'
Type: ClientAccessibleWriters
Attributes: Persistent, Client-accessible, No auto release, Differential, Auto recov
ered
Shadow Copy ID: {44795531-90c0-4809-be41-b2885365590c}
Original Volume: (C:)\\?\Volume{d6637946-33eb-11e1-8bdf-806e6f6e6963}\
Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy45
Originating Machine: whs-PC
Service Machine: whs-PC
Provider: 'Microsoft Software Shadow Copy provider 1.0'
Type: ClientAccessibleWriters
Attributes: Persistent, Client-accessible, No auto release, Differential, Auto recov
ered
Contents of shadow copy set ID: {15037187-8a2a-459d-9af0-946361e372c5}
Contained 2 shadow copies at creation time: 1/7/2014 8:54:30 PM
Shadow Copy ID: {0581f61f-076d-46c9-8f44-94bc09238efa}
Original Volume: (E:)\\?\Volume{f4916598-31b0-11e1-a4e9-d4bed98cc025}\
Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy38
Originating Machine: whs-PC
Service Machine: whs-PC
Provider: 'Microsoft Software Shadow Copy provider 1.0'
Type: ClientAccessibleWriters
Attributes: Persistent, Client-accessible, No auto release, Differential, Auto recov
ered
Shadow Copy ID: {749a77d7-dc7d-4a17-ae95-48a1fb39f6e2}
Original Volume: (C:)\\?\Volume{d6637946-33eb-11e1-8bdf-806e6f6e6963}\
Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy46
Originating Machine: whs-PC
Service Machine: whs-PC
Provider: 'Microsoft Software Shadow Copy provider 1.0'
Type: ClientAccessibleWriters
Attributes: Persistent, Client-accessible, No auto release, Differential, Auto recov
ered
Contents of shadow copy set ID: {773d1c63-e7c1-45e2-a45a-96681529e362}
Contained 2 shadow copies at creation time: 1/8/2014 11:37:01 AM
Shadow Copy ID: {5e3afe63-bb90-459a-b021-69690da62dfd}
Original Volume: (E:)\\?\Volume{f4916598-31b0-11e1-a4e9-d4bed98cc025}\
Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy39
Originating Machine: whs-PC
Service Machine: whs-PC
Provider: 'Microsoft Software Shadow Copy provider 1.0'
Type: ClientAccessibleWriters
Attributes: Persistent, Client-accessible, No auto release, Differential, Auto recov
ered
Shadow Copy ID: {27a3f999-6a3b-486c-b7da-d9a3f755031f}
Original Volume: (C:)\\?\Volume{d6637946-33eb-11e1-8bdf-806e6f6e6963}\
Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy47
Originating Machine: whs-PC
Service Machine: whs-PC
Provider: 'Microsoft Software Shadow Copy provider 1.0'
Type: ClientAccessibleWriters
Attributes: Persistent, Client-accessible, No auto release, Differential, Auto recov
ered
Contents of shadow copy set ID: {54474f7b-5b34-4aa8-ba47-7734239df9fb}
Contained 1 shadow copies at creation time: 12/3/2013 10:39:15 PM
Shadow Copy ID: {3d109055-d62d-44a0-a818-43e5d9f47f05}
Original Volume: (L:)\\?\Volume{ae2372b7-778e-11e2-b064-005056c00008}\
Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy40
Originating Machine: whs-PC
Service Machine: whs-PC
Provider: 'Microsoft Software Shadow Copy provider 1.0'
Type: DataVolumeRollback
Attributes: Persistent, No auto release, No writers, Differential
Contents of shadow copy set ID: {43ef62dc-bed8-4e2c-9ce7-54700b0e3d3a}
Contained 1 shadow copies at creation time: 12/3/2013 11:02:18 PM
Shadow Copy ID: {ce72d2ee-cc17-461b-b24a-b50785848707}
Original Volume: (L:)\\?\Volume{ae2372b7-778e-11e2-b064-005056c00008}\
Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy41
Originating Machine: whs-PC
Service Machine: whs-PC
Provider: 'Microsoft Software Shadow Copy provider 1.0'
Type: DataVolumeRollback
Attributes: Persistent, No auto release, No writers, Differential
Contents of shadow copy set ID: {41c4350a-be87-4a14-9364-ac730d481128}
Contained 1 shadow copies at creation time: 1/4/2014 5:11:57 PM
Shadow Copy ID: {da9111cd-2609-4a05-bef0-c469fce1dbdd}
Original Volume: (L:)\\?\Volume{ae2372b7-778e-11e2-b064-005056c00008}\
Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy42
Originating Machine: whs-PC
Service Machine: whs-PC
Provider: 'Microsoft Software Shadow Copy provider 1.0'
Type: DataVolumeRollback
Attributes: Persistent, No auto release, No writers, Differential
C:\Windows\system32>
C:\Windows\system32>
I did Kari cmd vssadmin list shadows and got the same thing you got whs. A list of shadow copies and compared the dates with restore points in Ccleaner and they were the same.
That cmd vssadmin list shadows is a neat command.
Yes.
When you create a Restore Point, it creates a so called snapshot of the system. This snapshot is called a Shadow Copy Set. The Set contains individual Shadow Copies of each drive which have protection turned on (Restore Points enabled).
The command to manage these snapshots is called Vssadmin, which is short of Volume Snapshot Service Administrator (or Volume Shadow Copy Service). I told about List Shadows switch which as the name says lists the Shadow Copy Sets. Here's the complete list of available switches:
Informationvssadmin 1.1 - Volume Shadow Copy Service administrative command-line tool
(C) Copyright 2001-2013 Microsoft Corp.
---- Commands Supported ----
Delete Shadows - Delete volume shadow copies
List Providers - List registered volume shadow copy providers
List Shadows - List existing volume shadow copies
List ShadowStorage - List volume shadow copy storage associations
List Volumes - List volumes eligible for shadow copies
List Writers - List subscribed volume shadow copy writers
Resize ShadowStorage - Resize a volume shadow copy storage association
Look here:
I created a Restore Point just now for the purpose of a screenshot, a bit after 4 AM here in Leipzig, and when the restore point was created I gave the command Vssadmin List Shadows. As the screenshot shows, the newly created Shadow copy Set contains a Shadow Copy of my drives C: and E:.
Kari
I hope I'm not getting in the way but I have seen so many post with problems with Restore Points I thought a good understand of how it works would help. Thanks for the help whs and Kari.
My Restore points have always worked for me but I never understood the under the hood workings until now.
There are some more neat commands. To show how much shadowstorage is uase, allocated and maximum use
vssadmin list shadowstorage
To resize the shadow storage, use
vssadmin resize shadowstorage /For=C: /On=C: /MaxSize=xxGB - you can also use xx%
This is the example for C but it works, of course, for any drive letter.
A shame that the IMO most practical usage of vssadmin command only works on Windows Server systems. With the command vssadmin add shadowstorage /for=C: /on=X: on Windows Server you can set the Shadow Copy of C: to be created and located on X:.
Do this for all your protected drives and you can "collect" Restore Points for each drive on a specific Restore Point drive, freeing storage on all other drives.
I don't understand either why it would be left out of any Windows 7 other than maybe Starter.
It's been a good learning day for me and hopefully it was helpful to Diligent .