remove System Restore points individually?

[Double]

Hi, I just used System Restore a couple days ago to recover from a bad Windows Update install. It has saved my hide a few times.

These 'points' have accumulated over time and are about to reach its capacity (75GB). After it reaches this threshold, I fear my manual updates are going to be eaten away. Is there any way to keep the manual points I've made, but remove the points Windows has automatically generated?

 

[C-11]

Option three using CCleaner.

System Protection Restore Points - Delete - Windows 7 Help Forums

 

[Kaktussoft]

Hi, I just used System Restore a couple days ago to recover from a bad Windows Update install. It has saved my hide a few times.

These 'points' have accumulated over time and are about to reach its capacity (75GB). After it reaches this threshold, I fear my manual updates are going to be eaten away. Is there any way to keep the manual points I've made, but remove the points Windows has automatically generated?

"restore points" are actually the "old state" of blocks on disk. They are used to be able to rollback the disk to an earlier state. So "restore points" are incremental!!

So you cannot delete restore points somewhere in the middle... it is only possible if you merge them together. But that won't give you any extra space (only blocks that are rewritten in both restore points).

 

[Kaktussoft]

Hi, I just used System Restore a couple days ago to recover from a bad Windows Update install. It has saved my hide a few times.

These 'points' have accumulated over time and are about to reach its capacity (75GB). After it reaches this threshold, I fear my manual updates are going to be eaten away. Is there any way to keep the manual points I've made, but remove the points Windows has automatically generated?

System Restore Explorer - View, Delete and Browse Inside System Restore Points

 

[Double]

"restore points" are actually the "old state" of blocks on disk. They are used to be able to rollback the disk to an earlier state. So "restore points" are incremental!!

So you cannot delete restore points somewhere in the middle... it is only possible if you merge them together. But that won't give you any extra space (only blocks that are rewritten in both restore points).

System Restore Explorer - View, Delete and Browse Inside System Restore Points

Wow, thanks for the link! But umm.. didn't you just contradict yourself? You said that deleting restore points in the middle wasn't possible? ...that they can only be merged together?

I thought creating a restore point just took a snapshot of the registry and took note of any changed installs?

 

[Kaktussoft]

"restore points" are actually the "old state" of blocks on disk. They are used to be able to rollback the disk to an earlier state. So "restore points" are incremental!!

So you cannot delete restore points somewhere in the middle... it is only possible if you merge them together. But that won't give you any extra space (only blocks that are rewritten in both restore points).

System Restore Explorer - View, Delete and Browse Inside System Restore Points

Wow, thanks for the link! But umm.. didn't you just contradict yourself? You said that deleting restore points in the middle wasn't possible? ...that they can only be merged together?

I thought creating a restore point just took a snapshot of the registry and took note of any changed installs?

I "restore point" is a snapshot of registry and files.... just everything on disk volume. Actually it's the OLD contents of disk blocks.

You can delete a restore point... just like creating it never happened. But if it never happened... the previous restore point would be larger. Larger because it is kind of a merge.

 

[Double]

I "restore point" is a snapshot of registry and files.... just everything on disk volume. Actually it's the OLD contents of disk blocks.

You can delete a restore point... just like creating it never happened. But if it never happened... the previous restore point would be larger. Larger because it is kind of a merge.

What do you mean the previous restore point would be larger? It almost sounds like a restore point would be corrupt if it were "merged" with another? These restore points will still function as they always have, won't they?

For example.. lets say I encounter a virus, System Restore, and a month later decide to remove the restore point containing the virus. Are you saying that removing the point would actually merge that point with an adjacent point, potentially resurrecting the virus if the adjacent point was chosen as a restore point at a later time? I hope that makes sense.

I installed and tried the freeware you mentioned and it worked well. It seems that removing the auto-generated points freed up less gigabyte space than I expected. Are manual points any larger than auto-generated ones?

 

[Layback Bear]

I also use Ccleaner to remove unwanted restore points. Exactly how it does it I don't know.
After removing a infection I use Windows to remove all restore points and create a new one.
Infection can and do get into restore points.

 

[Double]

Infection can and do get into restore points.

errr.. they do? you've made me paranoid before, but this..

 

[LMiller7]

System Restore was designed as a means of quickly restoring the system to normal operation after a problem develops. It is best used as soon as possible after the problem occurs. It is not a long term solution. The further back you go the more likely that the restore will fail or cause more problems than it solves. On the few occasions I have used system restore it was always the most recent restore point.

If you want a long term backup you need an image backup. System Restore is not it.

 

[Layback Bear]

Infection can and do get into restore points.

errr.. they do? you've made me paranoid before, but this..

Never underestimate the bad guys.

 

[Kaktussoft]

Creating a restore point is actually initiating a new Volume Shadow Set.
The longer a shadow set is active (so is the newest shadow set for that volume) the larger it will be. Read below... they are differential.

A rollback to a very old restore point is actually: A system restore to most recent restore point. After that a restore to restore point just prior to newest. etc.

So you can't do a system restore if some "needed" restore point is missing. If you delete a restore point you are actually merging two restore points.

Copy-on-Write (Differential Copy)

The copy-on-write method creates shadow copies that are differential rather than full copies of the original data. This method makes a copy of the original data before it is overwritten with new changes, as shown in the following table. When a change to the original volume occurs, but before it is written to disk, the block about to be modified is read and then written to a “differences area”, which preserves a copy of the data block before it is overwritten with the change. Using the blocks in the differences area and unchanged blocks in the original volume, a shadow copy can be logically constructed that represents the shadow copy at the point in time in which it was created.
The Copy-on-Write Method of Creating Shadow Copies


Time Source Data Contents Shadow Copy Contents T0
Original data
1 2 3 4 5
No copy
—
T1
Original data overwritten
1 2 3 4 5
Differences and index stored on shadow copy
3
The advantage of the copy-on-write method is that it creates shadow copies very rapidly because it is only writing the changes to disk. The disadvantage is that in order to fully restore the data, the original data must still be available. Without the original data, the shadow copy is incomplete and cannot be used. Another disadvantage is that the performance of copy-on-write implementations can affect the performance of the original volume.

 

[Double]

System Restore was designed as a means of quickly restoring the system to normal operation after a problem develops. It is best used as soon as possible after the problem occurs. It is not a long term solution. The further back you go the more likely that the restore will fail or cause more problems than it solves. On the few occasions I have used system restore it was always the most recent restore point.

If you want a long term backup you need an image backup. System Restore is not it.

I use the most recent point as well. However, if I wanted to "reinstall" the system without having to perform a factory reset, I may want to start from point A?

Infection can and do get into restore points.

errr.. they do? you've made me paranoid before, but this..

Never underestimate the bad guys.

Good point

Creating a restore point is actually initiating a new Volume Shadow Set.
The longer a shadow set is active (so is the newest shadow set for that volume) the larger it will be. Read below... they are differential.

A rollback to a very old restore point is actually: A system restore to most recent restore point. After that a restore to restore point just prior to newest. etc.

So you can't do a system restore if some "needed" restore point is missing. If you delete a restore point you are actually merging two restore points.

Copy-on-Write (Differential Copy)

The copy-on-write method creates shadow copies that are differential rather than full copies of the original data. This method makes a copy of the original data before it is overwritten with new changes, as shown in the following table. When a change to the original volume occurs, but before it is written to disk, the block about to be modified is read and then written to a “differences area”, which preserves a copy of the data block before it is overwritten with the change. Using the blocks in the differences area and unchanged blocks in the original volume, a shadow copy can be logically constructed that represents the shadow copy at the point in time in which it was created.
The Copy-on-Write Method of Creating Shadow Copies


Time Source Data Contents Shadow Copy Contents T0
Original data
1 2 3 4 5
No copy
—
T1
Original data overwritten
1 2 3 4 5
Differences and index stored on shadow copy
3
The advantage of the copy-on-write method is that it creates shadow copies very rapidly because it is only writing the changes to disk. The disadvantage is that in order to fully restore the data, the original data must still be available. Without the original data, the shadow copy is incomplete and cannot be used. Another disadvantage is that the performance of copy-on-write implementations can affect the performance of the original volume.

Umm.. I still don't believe I understand, could you possibly summarize? Are you basically saying that I should remove all points and just create a new one today? It is starting to sound like restore points aren't as effective as I thought..

 

[alan10]

So you cannot delete restore points somewhere in the middle... it is only possible if you merge them together. But that won't give you any extra space (only blocks that are rewritten in both restore points).

That was NOT correct under XP, and I doubt that you are correct under under Win7.

My recollection of XP was that each RP consisted of a single copy of the Registry Hives at the time the Point was created, and copies of all system Files that were either deleted or Windows feared they might vanish.

When CCLeaner "removed" Restore Points in the middle of an incremental series,
It did not damage the incremental series with simple deletion, instead, for each R.P. that the user chooses to delete,
CCleaner removes the non-incremental non-cumulative Registry Hives which will never again be used,
and this saves MOST of the space taken up by each R.P.,
and removes from User view the means of access to restore these points that no longer have registry hives,
but it leaves available all the copies of files and the logs that identify the original paths for each file,
hence Windows System Restore is still able to return to a very early data with a R.P. that still has its original Registry Hive,
and to see all the deleted and modified files in each of the "deleted" R.P. which are still present but concealed from the user.

Regards
Alan

 

[LMiller7]

It apparently is possible to arbitrarily delete any restore point. This would be done with the API function "SRRemoveRestorePoint" in which the only parameter is the sequence number of the restore point to be deleted. This function is accessible only by programs. What happens when this is done is not fully documented. Modification of restore points is to be done only with the system provided functions, of which there are only a few. Any direct manipulation of the files in the "System Volume Information" folder and you are in uncharted territory and results are unpredictable.

Microsoft has never fully documented the details of how system restore works. When low level details are documented developers will use this information and Microsoft is then obligated to maintain the behavior indefinitely or existing applications will break. That makes changes and upgrades more difficult.

 

[Gary]

System Restore was the first thing I turned off. Your system will be much faster with them off. I just create a system image using Windows 7 Pro Image/Backup tool.

 

[Kaktussoft]

So you cannot delete restore points somewhere in the middle... it is only possible if you merge them together. But that won't give you any extra space (only blocks that are rewritten in both restore points).

That was NOT correct under XP, and I doubt that you are correct under under Win7.

My recollection of XP was that each RP consisted of a single copy of the Registry Hives at the time the Point was created, and copies of all system Files that were either deleted or Windows feared they might vanish.

When CCLeaner "removed" Restore Points in the middle of an incremental series,
It did not damage the incremental series with simple deletion, instead, for each R.P. that the user chooses to delete,
CCleaner removes the non-incremental non-cumulative Registry Hives which will never again be used,
and this saves MOST of the space taken up by each R.P.,
and removes from User view the means of access to restore these points that no longer have registry hives,
but it leaves available all the copies of files and the logs that identify the original paths for each file,
hence Windows System Restore is still able to return to a very early data with a R.P. that still has its original Registry Hive,
and to see all the deleted and modified files in each of the "deleted" R.P. which are still present but concealed from the user.

Regards
Alan

A "restore point" isn't file based. It's "cluster based". It hold the ORIGINAL SO OLD contents of clusters that CHANGED contents since creation of restore point. A restore point gets larger and larger over time.

Assume you have 2 restore points: one on 1 jan 2010 00:01 and one on 1 jan 2010 00:02

The first one is very small and covers all changes from 1 jan 2010 00:01 to 1 jan 2010 00:02, so only 1 minute.

The second one is large and covers all changes from 1 jan 2010 00:02 till now (23 dec 2013). That restore points has the ORIGINAL CONTENTS of changed blocks.

win7 can logically reconstruct the situation how situation was on 1 jan 2010 00:02 . After that it can even further back logically to 1 jan 2010 00:01. So it can logically reconstruct the situation of the disk at all "restore point creation times".

This logic is used for "system restore" and "previous versions of files".

Clear?

 

[alan10]

With all due respect, I do not stand corrected.

CCleaner makes a tremendous improvement to the amount of Disk space used by Restore Points under XP.

You are probably correct,
but so am I in my statement of how Windows XP works and of how CCleaner deals with the R.P. within XP

R.P. were fallible on XP, therefore I had no trust in them never allowed them to exist on Windows 7.
Hence I have no experience of (or use for) R.P. in Windows 7.

I have seen the contents of XP R.P. within System Volume Information by scanning C:\ with the portable freeware version of TreeSize that is available from
https://www.jam-software.de/customers/downloadTrial.php?article_no=80&language=EN&
I have seen and therefore know that each R.P. consisted of registry hives such as

C:\System Volume Information\_restore{F6EA6CAA-B744-447E-8F9E-B9A9507C7CB4}\RP1145\snapshot\_REGISTRY_MACHINE_SOFTWARE
F:\System Volume Information\_restore{F6EA6CAA-B744-447E-8F9E-B9A9507C7CB4}\RP1145\snapshot\Repository\FS\OBJECTS.DATA

and files such as

F:\System Volume Information\_restore{F6EA6CAA-B744-447E-8F9E-B9A9507C7CB4}\RP1145\A0285626.ini
F:\System Volume Information\_restore{F6EA6CAA-B744-447E-8F9E-B9A9507C7CB4}\RP1145\A0285627.mfl

CCleaner is compatible with XP through to Win 8.1
and I believe that Windows 7 users still expect CCleaner to increase free space when they remove intermediate Restore points.

I believe that the Piriform developers are quite clever,
and would NOT delete intermediate R.P. and still allow the user to activate restoration to a previous R.P. if that was doomed to failure.
I assume that they understand the differences between XP and Win7,
and if they still allow access to previous R.P. they have probably adapted their technique accordingly,
but exactly how Piriform do it I neither know nor care because I have no R.P.

Regards
Alan

 

[Kaktussoft]

I assume that they understand the differences between XP and Windows 7,
and if they still allow access to previous R.P. they have probably adapted their technique accordingly=>yes they are clever enough. They delete them using command explained here Vssadmin delete shadows

It's called a delete... but still... it actually is a merge!!

In winxp it's indeed working the way you told.

 

[alan10]

Seven years ago I retired and started using a Laptop with XP.
Tried Dual Booting with Windows 7 and quickly decided it was not for me.
(Did NOT like UAC and did not like having to learn new ways to prevent Microsoft updates from updating and TRASHING Windows just when I was about to make a partition image backup of newly installed applications.)

When CCleaner first included the ability to remove intermediate R.P. I spent a day or two convinced that this would break the ability to restore to previous dates,
but then from my knowledge of previous observations of the contents of System Volume Information I guessed that all CC did was to remove the redundant non-cumulative registry hives and hide user access to them,
but retain all the cumulative files and change logs so that Windows Restore still had a valid chain of changes.

Two years ago my eldest son bought a new computer and passed on to me his old but powerful Desktop,
which unfortunately came with Windows 7.
I struggled with the pain of Windows 7 but persevered,
and since 2012 have never switched on the Laptop.

I am six years further into retirement than when I understood XP,

Thanks for the link to Vssadmin delete shadows
I am super thankful that the link does not explain in detail how it merges to retain a consistent chain
For me trying to understand VSS is a whole new world of pain

I am happy that Macrium Reflect imaging works for me and recognise that it use the "magic" of VSS.
I am more than happy that experts such as yourself are able to advise upon how the magic happens.

Regards
Alan