Shadow Copy Ghosts

[seekermeister]

When viewing Hidden Devices in the Device Manager, under Storage Volume Shadow Copies, I have a long list of shadows that are ghosted. Is there any good reason that these should not be exorcised?

 

[rap33042]

You definitely do NOT want to remove anything related to the system!

If you show duplicates of old Graphics drivers, Audio drivers, etc, then that's OK.

Be very careful here- you can really screw things up...

Here's a link to a free TweakGuides System Guide (PDF).
I believe it has a section referring to your post: http://www.tweakguides.com/TGTC.html

Edit: Yep- it's on Page 70

 

[seekermeister]

Not meaning to contradict you, but it would seem that according to O&O Defrag Help file on this topic, that these are no longer usable by the system, because they have been replaced with newer shadow copies:

Conflicts with Shadow Copies during Defragmentation
The operating systems Windows 7, Windows Vista, Windows XP64, Windows Server 2003 and 2008 offer users the ability to create "Shadow Copies" for protecting their data. This new feature automatically creates copies of files currently in use at regular time intervals. Since Windows only captures changes in the files, not a lot of additional space is normally needed. Accidentally deleted files and folders or previous versions of documents can be easily restored using a convenient command accessible through the context menu. Simply right-click the object you want to restore and click "Restore Previous Versions".

At the moment of installation Windows Vista (or newer) the shadow copy mechanism is set as default. With Windows XP64 and Windows Server 2003/2008 systems it is deactivated by default.

During defragmentation, files on a volume get moved. Vista perceives this as a deletion and creates a new Shadow Copy for the moved file. Because defragmentation requires the moving of multiple files, many Shadow Copies are created, which in turn leads to the higher demand on disk space. This behaviour may overwrite older shadow copies with newer ones. Unfortunately, this can also lead to the deletion of the system recovery points! These consequences are most frequent when using the COMPLETE method.

Shadow copies are filed in the folder “System Volume Information” and cannot be defragmented. This can end up having a negative influence on the result of the defragmentation. There is, on the other hand, almost hardly any loss in performance caused by fragmented shadow copies. Although these files will be displayed as fragmented, they still have only a minimal influence on the operating speed of your system.

You could disable the shadow copies to achieve improved defragmentation results but you would then wind up losing the operating system’s built-in backup functionality. That’s why we recommend your leaving the shadow copies enabled.

Microsoft is already aware of this problem, as this issue also occurs in the Windows native defragmentation software. More details may be found in this article from Microsoft: Shadow copies may be lost when you defragment a volume

In Windows XP64 and Windows 2003 Server, this problem will not occur as long as storage volumes have been formatted with a cluster size of 16KB or larger. If this cannot be changed or Windows Vista is in use, this issue can be avoided by first performing a STEALTH defragmentation followed by a SPACE defragmentation.

Notes about background defragmentation enabled by default:

The background defragmentation packs all fragmented files quickly and effectively together. It is, however, designed to use the least amount of resources so that the system is only minimally burdened and the user can continue working undisturbed. It is, therefore, not possible for the background defragmentation, as a result of restructuring, to recreate the operating system’s prescribed optimal order of files on the hard disk. To guarantee optimal performance, we recommend that you also run a regular (for example, monthly) SPACE or complete method defragmentation.

Please note that under Windows Vista, Windows 2003 Server and Windows Server 2008, a complete restructuring defragmentation of drives backed-up through shadow copies might lead to the loss of older savesets. This is a problem known to Microsoft, and these drives are marked accordingly in O&O Defrag user interface. We therefore recommend letting only O&O Defrag background monitoring function run on these drives.

Therefore, I'm wondering if your comment is based on anything more than your personal perspective?

 

[rap33042]

seekermeister:
My reply to your post was based on what I have read in the guide I pointed you to- nothing more.

I don't have a perspective- I only know what I have read. It seemed like good, safe advice from someone whose information I trust and passed on to you.

It appears to me the Shadow Copies that are being described in the O&O article are not what we are discussing in your original post.

I don't think Shadow Copies and Hidden Devices are the same thing.

Edit:
Maybe I'm missing something here- I will open Device Manager to see what is 'hidden' there; haven't looked for a long time.
If I discover something that will help, I'll come back to this.

 

[seekermeister]

Maybe I wasn't clear enough, but my OP was specifically regarding Volume Shadow Copies, as is discussed in the O&O article. The Device Manager's Hidden Devices is merely where they are listed. As far as I can see, their existence doesn't do anything, except to occupy a lot of hard drive space, and interferes with defragmentation.

 

[rap33042]

OK- just for clarity's sake- here's a couple of shots:
The first from the TGTC and the second from my Device Manger Listing.
I guess we're not talking about the same thing, after all. Sorry- I'll stay out of this one...

 

[seekermeister]

It appears that we are talking about the same thing, but are somehow going in two different directions. The highlighted portion of the TGTC does indicate that they shouldn't be removed, as you said. However, I don't know that I agree with that. If a shadow copy is never going to be used again, I fail to see any advantage in letting it remain, but I'm attempting to find something more solid than my opinion. Like so many things regarding computers, one can usually find conflicting statements. If I can't find any clarity on this, I will probably run a backup image then delete the ghosts and see what happens.

 

[seekermeister]

I uninstalled ~51 shadow copies, leaving 7 active one behind. So far, I don't see that it has done any harm, because all seems well, and I still have the same 7 restore points available as I did before...but I can't see that it has done any good either, because the OS volume still has ~ the same amount of free space as it did before also. I did not note the exact amount of blocks that were locked with System Volume information before, but it appears that those number remains as before. I don't understand that, unless uninstalling the shadow copies from the Device Manager does not remove them from the partition as I thought that it would.

 

[rap33042]

Maybe they are just registry entries pointing to nowhere?

Hah! I'm really glad you did this, though.

After my next backup, I'm going to do it, too.
But, out of curiosity, I think I'll search the registry first to see if I find a difference.
There's a great little utility called RegShot that lets you take a before and after snapshot of the registry; and it will even do a comparison of the two for you afterwards! Quite handy.

Here's the link in case it interests you: Regshot - Download

 

[seekermeister]

Something that I'm pondering, is to turn shadow copies off altogether. The reason for this is that I do not use Windows Backup, and too often when I try to use a System Restore, I find that there are no restore points available, probably due to the fact that Windows has made a new shadow copy, overwriting those with the restore points.

In lieu of the Windows system, I'm already using Acronis True Image for backups, but I have not automated that process, either to create scheduled or nonstop backups. I'm not certain what impact that defragging might have on retaining data integrity on the TI system...would there be any? If not, then TI's nonstop backup service could replace the Windows system altogether, and the OS volume would not have any locked system volume (shadow copies) to take up space or intefere with defragging. As it is now, vssadmin shows that shadow copies are occupying 25.5 GBs, which could be freed for other purposes, and reduce the size of backup data.

EDIT: When I spoke of defragging effecting backup data, I didn't think about the fact that I keep that data on a non-OS volume, and do not defrag the backup volume, because I have been told that might have an adverse effect on it. I usually find that O&O's analysis of the backup volume shows very high fragmentation, but that doesn't seem to effect usage of it.

Therefore, the question is just how large of a volume is required for a nonstop backup to work properly?

EDIT 2: I noticed that there are 2 services that appear to be related "Microsoft Software Shadow Copy Provider" and "Volume Shadow Copy"...how do these differ?

 

[Ztruker]

I also use Acronis but I can't see disabling System Restore as it give me one more possible way to fix a problem that will not cause loss of personal data changes made since the last Acronis backup.

Leaving Shadow Copy active also allows you to use Shadow Explorer to extract single files or folders from the Shadow Copy backup data.

 

[seekermeister]

rap33042,

Here's the link in case it interests you: Regshot - Download

I noticed that the System Requirements of this program don't include either Vista or W7. Have you used this enough on W7 to be confident in it?

 

[seekermeister]

I also use Acronis but I can't see disabling System Restore as it give me one more possible way to fix a problem that will not cause loss of personal data changes made since the last Acronis backup.

Leaving Shadow Copy active also allows you to use Shadow Explorer to extract single files or folders from the Shadow Copy backup data.

I totally understand your perspective, and can't argue that redundancy isn't a good idea. However that redundancy is not without a price, and I'm weighing whether or not TI's nonstop backup would provide the needed reliability or not? I read that the nonstop backup permits one to pick any point in time to restore to, and if that is true, it sounds equal to System Restore.

 

[rap33042]

RegShot requires no installation.
It does not alter the registry in any way- it merely reads and makes a copy of it.
I have used it several times with no ill-effects.

 

[seekermeister]

RegShot requires no installation.
It does not alter the registry in any way- it merely reads and makes a copy of it.
I have used it several times with no ill-effects.

I was thinking more about the fashion in which it performs, rather than installation problems. I remember back when I first started using XP x64, that many registry programs wouldn't work properly, because of the dual design of the registry. Using some x32 registry cleaners wasn't advisable, because they didn't find a lot of registry keys.

 

[rap33042]

I see.
Well, I don't really know if RegShot picks up everything on a 64-bit system (how could I find that out?), but I can say with confidence that what it does do has not hurt my installation in any way. After all, it's only doing a read operation.

I can certainly understand what you are saying about the cleaners, though - I wouldn't trust them, either.

 

[seekermeister]

Just to update the situation, I deleted all of the shadow copies, so that I could do a complete defrag with O&O with it crossing horns with the shadows, then created a new shadow copy after the defrag completed. The defrag analysis looks better than it has in a long time. I shall not decide about replacing the shadows with TI nonstop system, until I learn more about it.

 

[rap33042]

This has been a learning experience.

If I find out anything more, I'll let you know...