phantom system restore points?

[jchap1590]

I have 2 drives setup in my System Protection; C: (OS - Windows 7 Pro, 64bit) and F: (file storage)

the scheduled task to create restore points is set with the following triggers: on connection to (any) user session, on idle, and on startup. now, I don't restart this machine often and as I'm the only user I also don't log out/in often either. but the machine DOES idle at the very least once a day.

the task history suggests it has been (successfully) triggered and completed 4 times in the last 24 hours alone, but my most recent available restore point is from 3 days ago.. where are my restore points going?

I'll attach my exported SR scheduled task, but the only attributes I altered were the triggers and uncheck "only run on AC power" and "only start if idle for". I assume setting that last one will trigger the task immediately after the PC becomes idle, unless I've missed something and that's my issue.

I would appreciate any insight, I've never encountered this before

 

[ICIT2LOL]

jchap mate I am just curious as to why the restore points are being triggered so often is it just that you want it set that way?

Anyway have you tried the sfc and chkdsk yet? if not then try running them as a starting point at least

http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html

http://www.sevenforums.com/tutorials/433-disk-check.html < use the /f and /r options in Option2 if necessary

 

[jchap1590]

jchap mate I am just curious as to why the restore points are being triggered so often is it just that you want it set that way?

Anyway have you tried the sfc and chkdsk yet? if not then try running them as a starting point at least

check disk and SFC both came back empty handed

I have them set to be triggered so much because I'm playing around with robocopy and need frequent points I can restore from

EDIT: it seems like restore points ARE being created before installing Windows updates and/or applications and when creating a system image for scheduled backups. I can manually create a system restore point under the system protection settings, but I cannot force a restore point to be created by manually running the scheduled task even though it says it completes successfully.

 

[ICIT2LOL]

Sorry for late reply mate but my partners has been to surgery today and have been caught up.
Now as this is very strange behaviour I don't think it would do any harm and certainly will not take a lot of time but run these even just to eliminate any obvious malware. They are not real heavy duty scans as such but I find they pick up stuff on my own machines that my trusted Kaspersky doesn't see.

http://www.superantispyware.com/

http://www.malwarebytes.org/products/malwarebytes_free/

http://www.bleepingcomputer.com/download/adwcleaner/

download from bleeping computer – delete any rubbishthese find.

 

[whs]

Run this command:

vssadmin list shadows

it will show you all restore points

 

[jchap1590]

Sorry for late reply mate but my partners has been to surgery today and have been caught up.
Now as this is very strange behaviour I don't think it would do any harm and certainly will not take a lot of time but run these even just to eliminate any obvious malware. They are not real heavy duty scans as such but I find they pick up stuff on my own machines that my trusted Kaspersky doesn't see.

http://www.superantispyware.com/

http://www.malwarebytes.org/products/malwarebytes_free/

http://www.bleepingcomputer.com/download/adwcleaner/

download from bleeping computer – delete any rubbishthese find.

I'm going to try restoring the system drive back to the last point (5 days ago). I remember now that I was wiping out registry keys to get rid of pesky remnants, maybe I accidentally deleted something pertaining to system restore. I'll try the malware scans if that turns up fruitless.

 

[jchap1590]

Run this command:

vssadmin list shadows

it will show you all restore points

shouldn't that list be exactly the same as the one in the system restore wizard ("show more restore points")? is it possible for them to be out of sync?

 

[whs]

This is the safest method to see all restore points. And yes, the wizard does not always show them all. Why don't you try it - takes only 2 minutes.

 

[jchap1590]

This is the safest method to see all restore points. And yes, the wizard does not always show them all. Why don't you try it - takes only 2 minutes.

it's the same list as in the wizard

 

[jchap1590]

looking at my event log, there are some errors corresponding at roughly the same time the SR is set to run. I had removed all the triggers from the task and added daily schedules so I can tell when a restore point should have been created.

I've attached the event logs for those instances (VDS Basic Provider) but I'm not sure if they pertain to my issue discussed here. the KB article on VDS Basic Provider suggests the error only occurs under a "guest operating system". I'm not even sure what a guest operating system is.

There are other events for 'source: volsnap' which says "the oldest shadow copy was deleted to keep disk usage.. on C: below the user defined limit". I can confirm that the current usage on C: is encroaching upon the limit, but that still doesn't explain why newer restore points are not showing up.

are restore points prioritized at all? maybe it's keeping the restore points created for backups/critical updates and deleting the oldest scheduled restore point? I don't know, I'm taking shots in the dark

 

[whs]

This is the safest method to see all restore points. And yes, the wizard does not always show them all. Why don't you try it - takes only 2 minutes.

it's the same list as in the wizard

Good, at least you know now that the data is correct.

 

[ICIT2LOL]

Hmm just on that registry key point mate I always do a back up of the registry directly after a clean install of an OS and before I do ANY changes because there is always the chance you may delete the wrong key/s - so easily done if you are not paying attention or get distracted.
http://www.sevenforums.com/tutorials/4230-registry-backup-restore.html takes about a minute to do - is it worth the risk??

 

[jchap1590]

Hmm just on that registry key point mate I always do a back up of the registry directly after a clean install of an OS and before I do ANY changes because there is always the chance you may delete the wrong key/s - so easily done if you are not paying attention or get distracted.
http://www.sevenforums.com/tutorials/4230-registry-backup-restore.html takes about a minute to do - is it worth the risk??

I try not to make a habit of going into regedit but when I do, I manually create a restore point before altering anything.

 

[jchap1590]

all the restore points for my F: drive are now gone for some reason. there are 3 available points for the C: drive from today, 2 were created due to critical updates and the third was created in the process of doing a system restore.

is there anything I should be looking for in the event log that could give a hint as to why scheduled restore points are not being created?

EDIT: I'm going to try the following steps

1. Clear all current restore points
2. disable system protection on all drives
3. reboot
4. enable system protection
5. manually create a restore point
6. reboot

I'll see if the failure to create restore points persists after that and update the thread

Thanks for the help ICit2lol and whs, I really appreciate it

 

[ICIT2LOL]

Ok mate but for the time taken backing up the registry is the best thing to do for it but just keep it in mind for future use I am not saying restore points are no good but if the registry has been part wrecked then no restore points anyone creates are going to get those back as you only restore to any given point and where the registry is not right.
I am not real sure but even recovery programs like Recuva will get those back. Just as a curiosity I wonder what Recuva would do for you - isn't going to cost anything and who knows what you might get back??
https://www.piriform.com/recuva < download from piriform

 

[jchap1590]

Ok mate but for the time taken backing up the registry is the best thing to do for it but just keep it in mind for future use I am not saying restore points are no good but if the registry has been part wrecked then no restore points anyone creates are going to get those back as you only restore to any given point and where the registry is not right.
I am not real sure but even recovery programs like Recuva will get those back. Just as a curiosity I wonder what Recuva would do for you - isn't going to cost anything and who knows what you might get back??
https://www.piriform.com/recuva < download from piriform

oh, I'm not missing any data that I "need" to use a restore point. I'm experimenting with robocopy and I need to be able to restore directories after they've been moved and I happened to noticed that the scheduled task was not creating points.

 

[ICIT2LOL]

I was just thinking maybe it might just pick up those phantom restore points ot am I reading this wrong?

 

[jchap1590]

I'm a little confused by the results of performing the steps I listed above

why isn't there a creation time for ShadowCopy3? and I don't understand why my backup drive is mentioned in ShadowCopy4

 

[jchap1590]

I was just thinking maybe it might just pick up those phantom restore points ot am I reading this wrong?

I guess I'm just under the assumption that the scheduled task is not executing properly, and not that the restore points are in fact being created but are being deleted/lost somehow.

I'm running a deep scan on 'all places' for 'all files'