System Restore Point Keeps Growing

dalchina said:

That's current usage - for all System Restore points, not an individual one. You need to show both the list of restore points and the size at the same time. I'v not seen clear evidence of one single restore point growing in size here.

OK, here you go then (well, partial evidence): I don't use SR, but started it earlier today and created a manual point. That showed up in the SR configuration screen as using 44MB. I don't have a screen-shot (I said it was partial). I did install ShadowExplorer 0.9, but it doesn't show the size of the RP, it just lists the 'snapped' files - which includes most Windows folders AFAICT. It does, for example, show my 3GB pagefile.sys file - so we can be sure that SR hasn't actually 'saved' that in any meaningful sense - and nor any of the other files, or so I believe.

I then booted Win10-XPE from a USB stick, and that showed the SVI folder occupied some 512MB - XPE can open the folder, presumably bacause my normal W10 is not protecting it. I then waited a while, and after doing nothing much the SR config screen showed it was using 291 MB. Note that this is still for a single RP. I then removed a bit of software (~70MB worth) and SR config went up to 295MB (I know, it doesn't add up). Booting to W10-XPE showed the 'true' size was now 516MB.

Then I did a disk cleanup on C: and it removed ~1GB, based on the change in used space. After that, SR-config showed usage was 612MB - at last, a screen-shot:

Attempting a restore (not done) confirmed there is just the one RP there:

and finally running Wiztree under W10-XPE shows that real usage has gone up to 1.1GB:


I can confirm that it is the {c2fc...} file that has grown. So at present I stand by my earlier post, where I speculated that the SR point will keep growing as stuff is changed. FWIW, when I checked the 'scan for affected programs', it did indeed show the name of the program I uninstalled. I will keep SR running for a while, in case anything interesting happens...

Martin the inquisitive

- - - Updated - - -

Note that Nirsoft's ShadowCopyView shows the 'contents' of RPs (in the same way as ShadowExplorer).

mngerhold said:

OK, here you go then (well, partial evidence): I don't use SR, but started it earlier today and created a manual point. That showed up in the SR configuration screen as using 44MB. I don't have a screen-shot (I said it was partial). I did install ShadowExplorer 0.9, but it doesn't show the size of the RP, it just lists the 'snapped' files - which includes most Windows folders AFAICT. It does, for example, show my 3GB pagefile.sys file - so we can be sure that SR hasn't actually 'saved' that in any meaningful sense - and nor any of the other files, or so I believe.

I then booted Win10-XPE from a USB stick, and that showed the SVI folder occupied some 512MB - XPE can open the folder, presumably bacause my normal W10 is not protecting it. I then waited a while, and after doing nothing much the SR config screen showed it was using 291 MB. Note that this is still for a single RP. I then removed a bit of software (~70MB worth) and SR config went up to 295MB (I know, it doesn't add up). Booting to W10-XPE showed the 'true' size was now 516MB.

Then I did a disk cleanup on C: and it removed ~1GB, based on the change in used space. After that, SR-config showed usage was 612MB - at last, a screen-shot:

Attempting a restore (not done) confirmed there is just the one RP there:

and finally running Wiztree under W10-XPE shows that real usage has gone up to 1.1GB:


I can confirm that it is the {c2fc...} file that has grown. So at present I stand by my earlier post, where I speculated that the SR point will keep growing as stuff is changed. FWIW, when I checked the 'scan for affected programs', it did indeed show the name of the program I uninstalled. I will keep SR running for a while, in case anything interesting happens...

Martin the inquisitive

- - - Updated - - -

Note that Nirsoft's ShadowCopyView shows the 'contents' of RPs (in the same way as ShadowExplorer).

Thanks, mngerhold. That is exactly what I'm talking about. I too tried Shadow Explorer but did not get any useful info from it. So I figure I'm not alone with this. Like I said in my earlier post, I wanted to know more out of interest what is going on rather than seeing it as a problem for me. Thanks again for your time and input as well as all others that have replied

@boatmaster:
I did use Shadow Explorer but did not find anything as far as this issue is concerned (unless I don't know how to properly use it).
After my January post I pretty much didn't think about it again until recently. I am about to install System Restore Explorer and see if I can figure out what's going on.
mngerhold (post# 21) said he did a SR test on his pc and sees the same kind of SR point growth that I have been talking about. I'll post back when I know more after using System Restore Explorer.

Macboatmaster said:

Cheers
If you install Shadow Explorer and reset the RP then make a record of what is shown for that RP on Shadow Explorer
Wait for the RP to increase in size and then go back and compare what was shown with what is shown, you should then hopefully find what is increasing

Thanks. I'll give it another shot.

mngerhold said:

I have tried System Restore Explorer - it seems to work much like ShadowExplorer and Nirsoft's ShadowCopyView: it shows a list of the files that are 'protected' - but they are certainly not all contained within the RP folder. It is possible to mount a RP and view, and even copy, the files - but one cannot tell which, if any, have changed, ie been edited, deleted or moved since the RP was made. AFAICT, the list will look the same, whatever changes are subsequently made to the disk. It will not grow with new installs, or shrink with deletions - it is a 'snapshot', as all the literature says. If a large file is deleted from the protected area, then the list will still show the file, but (based on my understanding and experience so far) a copy will be added to the RP so that it can be recovered if required. So the list does not show anything helpful about changes subsequent to the RP creation (sorry, I'm repeating myself).

I think the mechanics of what is going on are being effectively hidden by the Volume Shadow Copy service, so that we can only guess how it works (until someone in the know turns up). My RP is now up to 774MB.

- - - Updated - - -

A clue to what is going on is contained here: https://docs.microsoft.com/en-us/win...w-copy-service

It looks to me like SR uses the 'Copy-on-write' method. I know I've read this stuff before, but forgotten it.

@mngerhold:
I have just tried System Restore Explorer and also tried Shadow Copy Explorer again and made snapshots for my reference. However I can't see anything that is helping me to understand what's going on. Maybe it's beyond the scope of my understanding. My SR point from yesterday is now 1GB. So it seems that you and me are having the same experience with SR point growth. Also, thanks for the link. I will read it now.
Mark