Jump to content

System restore points are missing


Recommended Posts

Storage Sense is disabled.

Yes I had deleted Malwarebytes & CCleaner.  I just removed Webroot and now using Windows Defender. Created a restore point and will check again around 6:30/7pm. Also just did a reboot (wonder if I should have done a full shutdown and then a start up).  Also removed Aomie Backerupper - just in case that was the culprit.

If then ALL good, then my problem is with Webroot and not sure where the setting within it might be that is removing restore points. 

 

Link to comment
Share on other sites

  • Moderators

TBH I suspect that this is one of those ocassional issues that crops up and then disappears again without anyone knowing (or admitting) why.

Most of the time it's something Microsoft, but it could be something that MS has changed and programme devs have not caught up with yet.

*** Out of Beer Error ->->-> Recovering Memory ***

Worried about 'Tracking Files'? Worried about why some files come back after cleaning? See this link:
https://community.ccleaner.com/topic/52668-tracking-files/?tab=comments#comment-300043

 

Link to comment
Share on other sites

Update:  I think the culprit is Webroot secure Anywhere.  I am not (yet?) convinced its a Windows OS issue.

Its now 7:30 and earlier restore points still showing.

So after removing :  Malwarebytes, Superantispyware, Aomei Backupper, CCleaner & running error checker, chkdsk /F C.
I then uninstalled the Webroot (now using Windows Defender).

My manually created restore points have NOT disappeared since uninstalling Webroot.  SO, there must have been a settiing within Webroot affecting System Restore and VSS.

I would like to think that Webroot a better A/V then Defender - so have asked Webroot Tech folks for a fix.

Oh and also last nite I changed the virtual memory/page file from system managed to mim of 16,384 and Max of 49,152  - I have 16GB or RAM.  But that did not seem to work.

 

Link to comment
Share on other sites

  • Moderators

Looks like progress.

That's the problem with troubleshooting things like this, it takes time.
To be sure you have to change only one thing at once then wait (24 hrs, a week?) to see what happens and be sure that one was the cause or not.
Then change the next one and wait..........

*** Out of Beer Error ->->-> Recovering Memory ***

Worried about 'Tracking Files'? Worried about why some files come back after cleaning? See this link:
https://community.ccleaner.com/topic/52668-tracking-files/?tab=comments#comment-300043

 

Link to comment
Share on other sites

On 7/4/2018 at 08:58, lmacri said:

I found some recent recent volsnap errors logged in my Windows Event Viewer, and according to the StackExchange SuperUser thread volsnap: The shadow copies of volume C: were aborted because of an IO failure on volume C: these Event 14 errors occur when there is no space left for shadow copies to function correctly (i.e., current usage has exceeded the maximum space allocated for system restore points)....

Just an update on my testing.  I've run four Threat Scans with Malwarebytes Free since 03-Jul-2018 (without running CCleaner v5.44 that entire time) and none of my system restore points created since then have been wiped. I haven't finished my testing yet but it looks unlikely now that Malwarebytes has anything do with my disappearing restore points.

5b423a388ed17_MBv3_5_1AllScansSince29Jun08Jul2018.png.9340d0d9edddeef5039290334aa52872.png

5b423a9db4f6a_CCleanerv5_44AllRestorePointsSince29Junasof08Jul2018.png.6d20f0d6194cb8e1349c83214cee1012.png

I ran a CCleaner disk clean this morning.  I'll wait for a day or so for my Vista SP2 to create a new (scheduled) restore point and see if this generates another volsnap error that wipes my restore points.
-----------
32-bit Vista Home Premium SP2 * Firefox ESR v52.9.0 * Norton Security Premium v22.14.2.13 * Malwarebytes v3.5.1-1.0.365 * CCleaner Portable 5.44.6575 * TreeSize Free Portable v4.1.2.407

Link to comment
Share on other sites

Ive been running the pc without ccleaner and malware bytes all week. Weds i “installed” this time the portable version of ccleaner.  Ran the cleaner and then the registry cleaner - but only deleted entries of the programs I uninstalled sine last weekend. Last nite installed and ran malware bytes - which reported pc being clean.

so far with all this testing, I dont think its any of the 3rd party programs or the antivirus program.  I had uninstalled webroot and began using Windows Defender - but even with Defender I was losing the restore points. 

How did you add “Scheduled Checkpoint” ?

I tried setting up so that a restore point would be created each time I boot up - but  cant. Its weird, its as if the system shows Restore points enabled but actually its not.  

Link to comment
Share on other sites

52 minutes ago, sethm1 said:

....How did you add “Scheduled Checkpoint” ?I tried setting up so that a restore point would be created each time I boot up - but  cant. Its weird, its as if the system shows Restore points enabled but actually its not.  

Hi sethm1:

I have a Vista SP2 OS which automatically schedules the creation of system restore points by default.  From my Task Scheduler (Task Scheduler Library | Microsoft | Windows | System Restore):

5b4258be1f80d_VistaSP2SystemRestoreTaskScheduler.png.ba9863c18d2a16a8989f7b60c5aa6d77.png

System Restore is disable on Windows 10 machines by default, and according to the Windows Central tutorial How to Use System Restore on Windows 10  if you enable System Restore on a Win 10 machine "a new restore point will be created automatically when an important system change occur, such as before an installation of a Windows 10 update" .

The Winaero support article Create System Restore Point on Schedule in Windows 10 and the TenForums tutorial How to Automatically Create System Restore Point on Schedule in Windows 10 both have instructions for creating scheduled restore points but please note that you must make an edit in your Win 10 registry before you create the scheduled task in your Win 10 Task Scheduler, so I wouldn't suggest you try this unless you have advanced troubleshooting skills and can undo these changes if anything goes wrong.
-----------
32-bit Vista Home Premium SP2 * Firefox ESR v52.9.0 * Norton Security Premium v22.14.2.13 * Malwarebytes v3.5.1-1.0.365 * CCleaner Portable 5.44.6575 * TreeSize Free Portable v4.1.2.407

Link to comment
Share on other sites

  • Moderators

I said I'd keep an eye on those RP's and the ones that I created the other day.

The oldest one of the 5 just got removed. The other 4 are still there.
It happened sometime this evening (about midnight?), 27 or 28 days after it had been created.

This suggests to me that it was Windows 10 that removed it after it became a 'month' old.
So my next oldest should dissapear in about 12 days?

I believe that the Windows default for removing old RP's was 90 days.
But maybe that has been reduced with Windows 10 Home because it does 'forced' Updates every Patch Tuesday?

It possibly could make sense to delete the oldest RP (if there are more than 2) shortly before Patch Tuesday creates a new one, of course the oldest would probably be from the last Patch Tuesday.

It will be interesting to see what happens after tomorrows Patch Tuesday Update.

Sorry I know that doesn't apply to Vista.

 

*** Out of Beer Error ->->-> Recovering Memory ***

Worried about 'Tracking Files'? Worried about why some files come back after cleaning? See this link:
https://community.ccleaner.com/topic/52668-tracking-files/?tab=comments#comment-300043

 

Link to comment
Share on other sites

  • Moderators

You may already have done this but-

Have you checked your registry to see if there has been a "RPLifeInterval" key created?
(HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore)

If it has been created then it sets the 'age' at which a RP will be removed, the time value is in seconds.

I don't have one so will be using the system default.
 

*** Out of Beer Error ->->-> Recovering Memory ***

Worried about 'Tracking Files'? Worried about why some files come back after cleaning? See this link:
https://community.ccleaner.com/topic/52668-tracking-files/?tab=comments#comment-300043

 

Link to comment
Share on other sites

5 hours ago, nukecad said:

...Have you checked your registry to see if there has been a "RPLifeInterval" key created? (HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore).  If it has been created then it sets the 'age' at which a RP will be removed, the time value is in seconds...

Hi nukecad:

My registry key at HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore\RPLifeInterval is set to the Vista default of 4294967295 sec (49701 days or 136 years) per the TechRepublic article Vista's SystemRestore Points Set to Delete After...136 years !!! so I doubt that my Vista SP2 OS is automatically deleting my Restore Points (RPs) because of their age.

5b43dca0730b8_VistaSP2RPLifeInterval09Jul2018.png.81c67c7b5245d9c7285afa1032cad06e.png

Here's an old screenshot I captured back in March 2017 with just a partial list of my RPs showing that it's normal for me to have a dozen or so RPs stored on my hard drive.  When I reach Vista's default max 15% disk space allotted for restore points (~33 GB of my 220 GB C:\drive as shown <here> when I run the vsssadmin list shadowstorage command) it's normal for me to see the oldest RP deleted to make room for a new RP. I currently have about 125 GB of free disk space on C:\ so lack of free disk space should not be an issue.

5b43e0a62bb05_CCleanerManageRestorePoints.png.bf0d3274a1c5f995bdac5c1c75796f81.png

Like the OP sethm1, my issue is not that the oldest system restore point is being deleted.  My issue is that every time I see one of these volsnap errors in my Event Viewer (which first appeared in mid-May 2018, around the same time that CCleaner v5.42 was released) every restore point is deleted except the most recent restore point created, as shown <here>.

Extended support for my Vista SP2 OS ended in April 2017 and I'm not receiving regular security updates on Patch Tuesdays anymore (aside from the occasional update for my Windows Defender definition set) so it's also unlikely that a recent update to my OS caused this problem.
-----------
32-bit Vista Home Premium SP2 * Firefox ESR v52.9.0 * Norton Security Premium v22.14.2.13 * Malwarebytes v3.5.1-1.0.365 * CCleaner Portable 5.44.6575 * TreeSize Free Portable v4.1.2.407

Link to comment
Share on other sites

I do not have a RPLifeInterval  entry.

Should I?  Will creating one correct my problem ?

Adding a screen shot of the System Restore folder.  The one item I am concerned with is the RestoreStatusDescription.  But what about the others?

And note the subfolder "Error Report files"  that was not there before all this started.

 

regedit screenshot.jpg

Link to comment
Share on other sites

On 7/8/2018 at 20:00, nukecad said:

...This suggests to me that it was Windows 10 that removed it after it became a 'month' old.  So my next oldest should dissapear in about 12 days?

I believe that the Windows default for removing old RP's was 90 days.  But maybe that has been reduced with Windows 10 Home because it does 'forced' Updates every Patch Tuesday?...

Hi nukecad:

My understanding is that after you enable System Protection in Windows 10:

  • A restore point is automatically created whenever user installs a software application, driver, or updates from Windows Update. In addition, Win 10 will automatically create a restore point if a new restore point has not been created for 7 days (see the TechJourney article <here>; the default for my Vista SP2 OS is 24 hours after the last created restore point ).
  • System restore points are automatically deleted if they are 17 days old (or older) when Win 10 performs a maintenance routine that runs during system idles (see bumboola's post <here> in the TenForums as well as the AskWoody.com discussion <here>).

This assumes that you allocated enough disk space to store your new restore points when you enabled System Protection on your C:\ drive.  The TenForums tutorial Windows 10: Turn On or Off System Protection for Drives in Windows 10 shows the user allocating 4% (10 GB) of their 250 GB hard drive, which might be a good starting point. Once that allocated disk space is used up older restore points will be deleted to make room for new ones.  There are additional links at the bottom of that article for related tutorials on how to manage restore points in Windows 10.
-----------
32-bit Vista Home Premium SP2 * Firefox ESR v52.9.0 * Norton Security Premium v22.14.2.13 * Malwarebytes v3.5.1-1.0.365 * CCleaner Portable 5.44.6575 * TreeSize Free Portable v4.1.2.407

Link to comment
Share on other sites

Neither of those 2 Windows 10 bullet points are what i am experiencing.

i have allocated 9% or 20.91 GB.  Now up until today the current usage was hovering around 3 GB. Tonite it shows 17.25 GB used but there are only 3 showing restore points. 

 

Link to comment
Share on other sites

  • Moderators

sethm1,
No you do not need to have the RPLifeInterval registry key. I don't have one as said above.
If you don't have one then Windows will just use the system default.

I also don't have the ErrorReportFiles or the Volatile that you show in your screenshot. (Maybe because I have had no errors?)
Neither do I have anywhere near that many entries (I have Firstrun, LastIndex, LastMainenanceTaskRunTimeStamp, RPSessionInterval, & SRInitDone).
Obviously our systems have been setup differently, is your Home or Pro?
I wouldn't mess unless you know what put them there in the first place.

Quote

Now up until today the current usage was hovering around 3 GB. Tonite it shows 17.25 GB used but there are only 3 showing restore points.  

Don't forget that it's Patch Tuesday, Windows 10 may be 'preparing' itself in the background?

Imacri,
I do get a RP created on Installs/Uninstalls, and with a Windows Update. But there also seems to be a 'Time since last RP created' involved too.
(If you look at my screenshot in an above post there was an RP created for uninstalling Softmaker 2016, but not when I installed Softmaker 2018 straight afterwards).

My Win 10 does not seem to be creating one every seven days, or removing them after 17 days.
Win 10 has had major changes at least twice since some of those articles were written, FCU and the April 2018 updates, which could explain that.
You find this quite a bit with Win 10, articles may be refering to older versions so it's best to check when they were written.

I've never used Vista myself, but was aware that Vista defaults to creating an RP everyday.

It does seem like your problem is related to those volsnap errors, if you can find out what is causing those....

*** Out of Beer Error ->->-> Recovering Memory ***

Worried about 'Tracking Files'? Worried about why some files come back after cleaning? See this link:
https://community.ccleaner.com/topic/52668-tracking-files/?tab=comments#comment-300043

 

Link to comment
Share on other sites

Its a Home version.

agree wont mess with those.

as noted previously - this has been a constant problem since putting 10 on this pc about 3 weeks ago.  I think any updating not the issue, that this is a deeper Windows issue.

 

Link to comment
Share on other sites

Further to my post <here> of 08-Jul-2018, I have more evidence that this problem could be associated with CCleaner v5.44.

I ran CCleaner v5.44 the mornings of 08-Jul-2018 and 09-Jul-2018.  I had ~98 GB of used disk space the morning of 10-Jul-2018 but when I checked again in the evening my used disk space had dropped by about 10 GB to 88 GB, there was another volsnap error in my Event Viewer, and the vssadmin list shadowstorage command showed 0 GB of my allotted 33 GB of disk space for restore points (RPs) was being used (i.e., all my RPs had been wiped).

5b4604b6d4a0a_CCleanerv5_44EventViewerVolsnapError10Jul2019.png.bb5357f962342afa71d927cdfff56962.png

5b4606ca0857e_CCleanerv5_44CommandVssadminListShadowstorage10Jul2018.png.fe78c649e8f8fa2115eb994a1776b9fb.png

I checked with CCleaner and confirmed that the 7 or 8 RPs that had been created the previous week (i.e., the week I stopped using CCleaner and ran Malwarebytes Threat Scans) had all disappeared, including the latest RP created.

5b4608818f4ac_CCleanerv5_44RestorePointsat10_39PM10Jul2018.png.7311650e7c2bf88bae4e9de7e1ecdc43.png

I don't know if it's relevant, but after cleaning my disk with CCleaner on 09-Jul-2018 I used the registry cleaner to remove one orphaned registry entry left over after an uninstall of WinRAR v5.50.  As a general rule I don't use any registry cleaners and only used CCleaner's to remove the last bits of WinRAR v5.50 to ensure I had a clean re-install of the new WinRAR v5.60.
-----------
32-bit Vista Home Premium SP2 * Firefox ESR v52.9.0 * Norton Security Premium v22.14.2.13 * Malwarebytes v3.5.1-1.0.365 * CCleaner Portable 5.44.6575 * TreeSize Free Portable v4.1.2.407 

Link to comment
Share on other sites

  • Moderators

I'm sure you have done your own searching on what could be causing these volsnap errors.

It does/did seem to be a common problem with these errors removing all restore points.
Dual booting systems seemed particularly prone to it.

This thread suggests that a defrag could be doing it: (His particular defragger was Auslogics, but some of the later threads suggest that Windows own defragger can also cause it).
https://www.dell.com/community/Virus-Spyware/Warning-Disk-Deframenters-can-quot-ruin-quot-System-Restore/td-p/4474855

That also suggests that any process moving lots of data around quickly could cause a volsnap error and wipe the RPs.
(Think disk backup utilities and the like?)

 

*** Out of Beer Error ->->-> Recovering Memory ***

Worried about 'Tracking Files'? Worried about why some files come back after cleaning? See this link:
https://community.ccleaner.com/topic/52668-tracking-files/?tab=comments#comment-300043

 

Link to comment
Share on other sites

3 hours ago, nukecad said:

...This thread suggests that a defrag could be doing it: (His particular defragger was Auslogics, but some of the later threads suggest that Windows own defragger can also cause it)...That also suggests that any process moving lots of data around quickly could cause a volsnap error and wipe the RPs..

Hi nukecad:

It's unlikely that disk defragmenters are part of my problem.  My automatic Windows disk defrags are disabled and I haven't run a manual disk defrag for several months.  Like registry cleaners, I believe that disk defrags do very little to improve system performance and can do more harm than good if they're run indiscriminately.

I'm aware of the known issue with third-party disk defragmenters and system restore points.  See my 2014/2015 thread Full Defrag Wipes All Restore Points about Piriform's own Defraggler wiping my system restore points. At that time Piriform Support couldn't replicate the problem on their test system so I stopped using Defraggler for full disk defrags on my Vista SP2 machine and I now use Vista's built-in Windows Disk Defragmenter (WDD) if I need to defrag. As an extra precaution, I always run a thorough Check Disk (chkdsk /r) first before running a WDD defrag just to make sure I don't have any bad sectors on my hard drive.  The fact that I've run into a similar problem with volsnap erros and disappearing restore points in the past with another Piriform product makes me even more suspicious that CCleaner is the culprit this time.

What ever other theories you come up with for my disappearing restore points would have to take into account that:

  • My latest volsnap errors (and disappearing restore points) only started after a recent CCleaner update.
  •  I didn't have a volsnap error the entire week I stopped using CCleaner.
  • My volsnap errors returned immediately after I resumed using CCleaner.

-----------
32-bit Vista Home Premium SP2 * Firefox ESR v52.9.0 * Norton Security Premium v22.14.2.13 * Malwarebytes v3.5.1-1.0.365 * CCleaner Portable 5.44.6575 * TreeSize Free Portable v4.1.2.407

Link to comment
Share on other sites

Windows 10 defrag/optimize was off.  I have an ssd.

i then opened Samsung Magician. On the Performance Optimize screen one was started but was stopped at 50%.  I reinitiated, so will see if any affect.

 

Link to comment
Share on other sites

On 7/11/2018 at 08:45, lmacri said:

...I ran CCleaner v5.44 the mornings of 08-Jul-2018 and 09-Jul-2018.  I had ~98 GB of used disk space the morning of 10-Jul-2018 but when I checked again in the evening my used disk space had dropped by about 10 GB to 88 GB, there was another volsnap error in my Event Viewer, and the vssadmin list shadowstorage command showed 0 GB of my allotted 33 GB of disk space for restore points (RPs) was being used (i.e., all my RPs had been wiped)....

Further to my post <here> of 11-Jul-2018 I have additional evidence that CCleaner v5.44 is wiping my system restore points (RPs) on my C:\ drive (but not my D:\ drive).

I haven't run CCleaner Portable v5.44 since 10-Jul-2018 and the last volsnap error logged in my Event Viewer occurred 10-Jul-2018 @ 5:49 PM.  The Privacy Eraser Portable v4.38 image below shows that the five RPs created for my C:\ drive since that date have not been deleted and the attached .txt file of the output from a vssadmin list shadows command shows that I also have 11 restore points dating back to 02-Jul-2018 for my D:\ drive (i.e., pre-dating the last time the RPs for my C:\ drive were wiped), so it appears that CCleaner Portable is only deleting the RPs for my C:\ drive and leaving the RPs for my D:\ drive (my HP_RECOVERY drive for emergency factory resets) untouched.

lmacri RPs C and D Drive Since 11 Jul 2018.txt

5b50c14371536_PrivacyEraserv4_38SystemRestorePoints19Jul2018.png.98b56a912b07044b932299682fac338e.png

The vssadmin list shadowstorage command shows ~ 10 GB of my allotted 33 GB of disk space is currently being used for RPs on my C:\ drive.

5b50c56ca2408_CCleanerv5_44VssadminListShadowstorage19Jul2018.png.4ed32a0a805982bf9ce1b17109a2e0cb.png

I'm beginning to wonder now if this issue only occurs with 32-bit operating systems or just the portable version of CCleaner.  When I update (unzip) a new version of CCleaner Portable on my USB thumb drive I normally copy the ccleaner.ini file from the previous version to the location of the new 32-bit ccleaner.exe executable.  Are CCleaner Portable users now required to create a new ccleaner.ini file and re-create all their custom settings every time the product is updated to avoid corruption of the ccleaner.ini file?

-----------
32-bit Vista Home Premium SP2 * Firefox ESR v52.9.0 * Norton Security Premium v22.14.2.13 * Malwarebytes v3.5.1-1.0.365 * CCleaner Portable 5.44.6575 * TreeSize Free Portable v4.1.2.407 

Link to comment
Share on other sites

My pc is 64 bit. I also have ccleaner portable on my desk top - guess it should be on a thumbdrive.

At this point though, i’ve pretty much given up and will live with the RP issue - but will certainly come back here in hopes seeing the responses and suggestions.

Link to comment
Share on other sites

  • 2 weeks later...
On 7/19/2018 at 12:10, lmacri said:

Further to my post <here> of 11-Jul-2018 I have additional evidence that CCleaner v5.44 is wiping my system restore points (RPs) on my C:\ drive (but not my D:\ drive)...

Good news.  I've been testing 32-bit CCleaner Portable v5.45 since 26-Jul-2018 and so far this latest version hasn't wiped any system restore points (RPs). I have a few more tests to run so I'll post back later if my RPs start disappearing again.

I haven't had any further volsnap errors in my Event Viewer since 10-Jul-2018 (i.e., since I stopped using v5.44) , none of the RPs created on my machine between 11-Jul-2018 and 28-Jul-2018 have been deleted and today's vssadmin list shadowstorage command shows that I've only used ~ 18 GB of the 33 GB max space allotted for RPs.

5b5cf078e246a_CCleanerv5_45Post-CleanPrivacyEraserRPs28Jul2018.png.06507b89358e8c1dfeab6737dd403efb.png

5b5ce7c846df8_CCleanerv5_45Post-CleanvssadminRPStorage28Jul2018.png.802e030d7e6e76e5d96307686199f77c.png

One thing I did differently this time is that when I unzipped ccsetup545.zip on my USB drive I did not copy over the ccleaner.ini file I was using with v5.44.  Instead, I ran CCleaner Portable v5.45 to generate a brand new ccleaner.ini file and then re-configured all my personalized settings from scratch.  Is it necessary (or at least a best practice standard) to create a new ccleaner.ini file every time CCleaner Portable is updated?  It's difficult for me know if there was a bug in v5.44 that was deleting my RPs and/or the registry keys that were pointing to my RPs when no one from Avast/Piriform has shown any interest in viewing a debug log.
-----------
32-bit Vista Home Premium SP2 * Firefox ESR v52.9.0 * Norton Security Premium v22.14.2.13 * Malwarebytes v3.5.1-1.0.365 * CCleaner Portable 5.45.6611 * TreeSize Free Portable v4.1.2.407

Edited by lmacri
Added Privacy Eraser image of RPs
Link to comment
Share on other sites

Ill give that a try.  Not quit a fan of the Privacy eraser.

i have been using my iPad much more than the desktop.  So my problem with restore points been less important.  I run Aleomi backerupper weekly, so if pc goes “south” I am not too concerned.

 

Link to comment
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
×
×
  • Create New...

Important Information

By using this site, you agree to our Terms of Use.