Disappearing Restore points

[Martin S]

Does anybody have an idea why any system restore point that I (or the system) create disappears as soon as my PC is restarted/rebooted?

I've read the relevant posts I can find within the forum but none help.

I'm not dual booting.
I'm not using Norton (am using Kaspersky and restore is in the list of trusted applications).
There is 300 gig spare on the HD.
Restore is enabled on my HD.
I couldn't see an answer in the "bertk" links posted on similar threads.

Any clues much appreciated.

 

[richc46]

Lets start with the basics. What are you looking at that tells you it has been deleted?

Are you saying that your back up drive has in excess of 300gb?

What is the size of just the back up drive not the entire HD?

 

[stoneys-nutz]

Hello Martin S,
You have probably done this, but it may save a bit of time if you haven't.
First, make sure auto-restore points are made by going to Start and right-clicking Computer. Then click advanced system settings.
Click the System Protection tab. Make sure a check is next to your main hard drive. Click apply and restart your computer.
You must then make sure that your hard drive has at least 15% or 300Mb free space.
As i said, i may well be stating the obvious, but better safe than sorry.
Hope this helps, good luck and post your results.

 

[Martin S]

Stoneys-nutz, thanks for the response. I can confirm that everything is set as you describe, but the restore points disappear whenever the pc restarts.

Richc46, ditto. I'm looking at the (non existent) list of restore points. Having just created another, my HD has allocated 3 gig storage space, a max of 70gig and an actual of 82 meg. I'm not putting the restore points on another drive.

As my pc starts up, I can see an error in the event log, source volsnap. "the shadow copies of volume C: were deleted because the shadow copy storage could not grow in time. Consider reducing the IO load on the system or choose a shadow copy storage volume that is not being shadow copied".

I don't know how to do the first part and I only use one drive.

 

[richc46]

What is the name of your drive that contains the OS? Is it C? Now what is the name of the drive with the restore? I ask because from your post it appears that you have only one drive, am I correct?

 

[Martin S]

Yes Richard, I use the C: drive for restore points. I know this used to work because I have restored in the past, but not for several months.

I do monthly full backups to an external hard drive.

 

[whs]

I have the feeling you guys are talking about 2 different things. Rich you talk about imaging to a different drive and i think Martin is talking about system restore points (shadows) that are written to the shadowstorage which MUST be on the same volume.
No idea yet, Martin, why your shadows disappear (unfortunately they sometimes do). I assume you have checked shadowstorage with vssadmin to see whether the allocations are correct. If this is what you read out of it after you created a shadow: " a max of 70gig and an actual of 82 meg " (I assume actual means used), then there is indeed a problem. A good shadow should have taken about 250MB to 1GB (depending on the size of your system).

 

[Martin S]

Hello WHS. Thanks for the reply.

I think you are correct re confusion over mirror copies v restore points.

I looked at vssadmin after I created a manual restore point. 82 meg was the used value. There isn't a lot on my C: drive - 416 gig free out of 465 gig capacity.

Yesterday I looked at some similar topics in Microsoft support. This led me to the Services/Volume Shadow Copy which was set to manual startup and stopped status. I changed it to auto and started, created a restore point and rebooted. The restore still disappeared. This morning I see the status has gone back to stopped.

Looking at my event log, I see that the volsnap errors started on a specific day but I can't see anything that I loaded or changed on that day.

It's a pity - restore points are very useful.

 

[stoneys-nutz]

Take a look at your Windows updates, check to see if any were installed on that date, its worth a look.

 

[whs]

stoneys-nutz has a good point. It could have been an update that changed the landscape. It is unlikely that a program would do that - unless it is a virus. A good virus scan is probably useful too.
I agree with you that restore points are useful. Problem is that many times a restore does not work because some program refuses to be restored (e.g. Norton is known for that). I suggest to use imaging instead. Here is a little tutorial I made for Macrium. The setup and use is extremely simple and it is very fast. All you need is an external disk, a second internal disk or a seperate disk partition.
Btw: the "manual" setting of the volume shadow copy service is correct. That's how it is supposed to be. But the disappearing restore points is not normal. There are many possible instances how that can happen - e.g. when something is tampering with your shadowstorage. Resize would do that. But for the time being I have no clue what's causing it.

 

[Martin S]

Stoneys-nutz/WHS,

Thanks again for sticking with this. I checked the Windows update history and the 2 prior updates related to daylight saving and non compatible programs - neither of which sound very relevant. I run a complete virus check each week with Kaspersky IS 2010.

I'm a bit of a techno dork - what is the basic difference between what is in the imaging you describe (10 mins to create) and the Windows standard backup I use (1 hour to create) each month?

Why do I need a bootable rescue disk? To tell my PC to load the mirror image from the external drive in the event of system/HD failure? If I simply wanted to restore to an earlier image, do I do it via the rescue disk or the Macrium program?

Re tampering with shadowstorage - if I have no restore points saved, how can I see what storage (if any) has been allocated? When I checked via the command prompt, I got no results until I created a restore point.

 

[whs]

1. In principle there is no real difference between the Windows imaging and imaging with Macrium. However, the Windows imaging does not always seem to work - especially for the recovery part. I know Macrium works in all cases, that's why I prefer to use it. I have recovered many times - for real and for testing.
Macrium is fast, but note that my 10 minute time is from an SSD to an internal HDD. If you image form an HDD to an external disk, you should expect it to run 20 +/- minutes depending on your size of C. I can do it in 17 minutes to an external disk - both system partition and data partition together.

2. The Recovery disk has nothing to do with your system per se. It is a Macrium (or any other) program running under Linux. It gets loaded via CD (need to change the BIOS boot sequence) and pulls the image you choose in. Reason is simple, if your system is dead in the water or if you had to swap the Sata because of a head crash, you have nothing on your disk with which you can work. The program running under Linux booted from the CD will do it for you.

3. If you want to look at your shadowstorage, open an elevated Command Prompt (run as admin) and type vssadmin list shadowstorage. That will give you 3 numbers for each disk partition - but you want to look for C
Allocated - that is the amount of RAM shadowstorage has currently grabbed
Used - this is the amount that was used up to this point for writing shadows (restore points)
Maximum - this is the maximum amount that shadowstprage will grab eventually before it starts reusing what it has - old out; new in.


Note: Points 1 and 2 refer to imaging. Point 3 refers to system restore which is (in principle) an automatic function of the system. A restore point is written every day and every time you install a program or an update. Restore points (shadows) vary in size from 250MB to 1GB (appr.).
Images must be written to another disk or another partition. Shadows are always written to the partition to which they apply.

Hope that clarifies your questions.

 

[Martin S]

Thanks, I understand the points you have made.

Re your note - as I put in the last part of my previous post (but worded it badly), that query via CLI finds nothing. "No item found that satisfies the query". It only returns a value when I create a restore point. Then of course, it disappears when I shut down. Is there a way to manually allocate the space required for shadow copies?

 

[whs]

Yes, you can manually allocate shadowstorage. Open an elevated Command prompt (run as admin) and paste this command in and hit Enter.
Note: This is for a shadowstorage of 5GB, but you can change it to more or less. But 300MB is the minimum. Remind you that restore points typically take 250MB to 1GB each.

vssadmin Resize ShadowStorage /For=C: /On=C: /MaxSize=5GB

 

[Martin S]

That command returns the following error message "the specified volume shadow copy storage association was not found".

Perhaps at this stage I should give up on restore points and hope that I never need one.

Many thanks to you stoney, rich and whs for your assistance.

Martin

 

[whs]

Martin,
Maybe your restore point creation is disabled by Group Policy. Try this registry fix:
Download srpol-clear.reg and save it to Desktop. Right-click on the file and choose Merge.

 

[Martin S]

I looked at the script and checked in the registry, I don't have HKEY_LOCAL_MACHINE \ Software \ Policies \ Microsoft \ Windows NT \ SystemRestore, either on bootup or after creating a restore point.

Er.. what does that mean?

Doing a search in the registry for systemrestore finds an entry in Local etc\components\canonicaldata\deployments but it's all gibberish to me.

 

[whs]

It probably means that you have Vista Home Premium or Vista Home Basic. Unfortunately there is no group Policy in those. So that does not work. Too bad. It was just another try.

 

[Martin S]

WHS, do you know

1. where restore points are located in Vista?

2. if it is possible to save/copy a restore "position" to an external source eg flash drive and then load/copy it back in?

 

[whs]

1. the restore points are stored in the shadowstorage. You can look at them with an elevated cmd using the command vssadmin list shadows. This is the only way to get at them.
2. No, there is no way of copying them. If you want to keep/select images at your own gusto, I suggest you use an imaging program. This is a good one, for free and easy to use. Have a look. You typically write your images to a predefined folder on an external drive and you can manage them with a simple "delete" in case you want to get rid of some.
I make an image every second day and after a while I weed them out and keep maybe one per week or per month.