ky331
7 Gold

Warning: Disk Deframenters can "ruin" System Restore

Volume Shadow Copy is a service that creates and maintains snapshots ("shadow copies") of disk volumes in Windows 7 and Vista. It is the "back-end" of the System Restore feature.

In the event disk I/O becomes "excessive", it can "overwhelm" the Shadow Copy process, generating a "VolSnap Error": Event-ID 25: Volsnap. The shadow copies of volume C: were deleted because the shadow copy storage could not grow in time.

And since System Restore resides within the Shadow Copy Service area, the result of a VolSnap Error can be the total loss of all System Restore points!

Under most normal usage, this shouldn't happen.  But I've recently discovered a major exception:  Disk Defragmenters.

Some disk defragmenters have become so "timewise efficient" at their task of moving data around that the resulting volume of I/O processed is sufficiently massive & fast so as to cause a VolSnap error!

I have been using Auslogics Disk Defrag (Free) for many years now, and have been happy with the results. I never had any issue with it on WinXP --- which does not have a Volume Shadow Copy service. And while unfortunately, I have regularly been a victim of "disappearing" System Restore points on one of my Win7 systems, I never understood why --- until now: The excessively-"efficient" RATE of disk I/O during Auslogic's defragging process generated VolSnap errors, deleting the "shadow copies" of my C: drive, thereby eradicating all my System Restore points emoticon.TongueTied.title .

Fortunately, there is a simple solution in this particular case: start the Auslogics program, select SETTINGS, then PROGRAM SETTINGS, the ALGORITHMS tab, CHECK the box to "Defragment in VSS compatible mode", and click OK.   Hopefully, that has fixed the issue for me... only time will tell.

It seems the impact of checking this box is for Auslogics to run at a more "moderate" pace: for example, it may now take two or three minutes to defrag the disk, rather than one. But if this minor slowdown can keep System Restore "alive", it's definitely worth it.

Please emphasize that this should not be viewed as a specific condemnation of the Auslogics program, as my understanding is that several other disk defragmenters can likewise have the same negative impact. So if any of you ever encounter the issue of System Restore points mysteriously "disappearing", this is one possible cause that you should be aware of, to take into consideration.

[Disclaimer: On a separate note, I believe Joe53 stopped using Auslogics due to some PUPs that recent versions/installers have included, which inadvertently got installed on his system.   Always be sure to read-through the various installation screens of ANY program, keeping an eye-out for any boxes/offers (be they pre-checked or unchecked!]

Free Internet Security - WOT Web of Trust       Use OpenDNS       MalwareBytes Anti-Malware


Windows 10 Pro (64-bit), Panda DOME 18.7.4, MBAM4 Pro, Windows Firewall, OpenDNS Family Shield, SpywareBlaster, MVPS HOSTS file, MBAE Premium, MCShield, WinPatrol PLUS, SAS (on-demand scanner), Zemana AntiLogger Free, Microsoft EDGE, Firefox, Pale Moon, uBlock Origin, CryptoPrevent.


[I believe computer-users who sandbox (Sandboxie) are acting prudently.]

0 Kudos
8 Replies
msgale
5 Tungsten

RE: Warning: Disk Deframenters can "ruin" System Restore

Maybe using the built defragmenter would also solve the problem

0 Kudos
joe53
6 Gallium

RE: Warning: Disk Deframenters can "ruin" System Restore

msgale, I'm with you on this one.

I dumped Auslogics because it installed malware (not just PUPs) on my system. It was probably my bad for not paying more attention during the installation.

Nonetheless, I have zero tolerance for 3rd party programs that stoop to bundling malware such as Conduit, and browser hijacks.

I have had good results using Win 7's native defragmenter. I can't think of a single reason not to use it.

_________________________________________


Dell Forum Member since 2,000


 Use OpenDNS   MalwareBytes' Anti-Malware Free


Windows 10 Pro (64- Bit): Malwarebytes 4.x Premium, Windows Defender AV, Windows Firewall, WinPatrol PLUS, Emsisoft Emergency Kit Free and HitmanPro Free (on-demand scanners), OpenDNS, MVPS Hosts file, SpywareBlaster, Pale Moon web browser, Sandboxie, CCleaner Free.


"In the future, everyone will be anonymous for 15 minutes" - Banksy

0 Kudos
ky331
7 Gold

RE: Warning: Disk Deframenters can "ruin" System Restore

Here's a reference to at least one (two?) individuals who --- if correct in their analysis/assessment --- are having Restore Points disappear even when using Win7's native defragmenter:   http://www.answers.microsoft.com/en-us/windows/forum/windows_7-performance/windows-7-defrag-is-delet...

And how's this for another "goody":  Windows 7 deletes all System Restore Points upon reboot http://www.support.microsoft.com/kb/2533911

=========================

Whether one uses Win7's native defragger... and all the more so, one of the many 3rd-party defragmenters... the point of this post is to alert users that the loss of System Restore points is a real possibility.   This is something that should NOT be happening.

Free Internet Security - WOT Web of Trust       Use OpenDNS       MalwareBytes Anti-Malware


Windows 10 Pro (64-bit), Panda DOME 18.7.4, MBAM4 Pro, Windows Firewall, OpenDNS Family Shield, SpywareBlaster, MVPS HOSTS file, MBAE Premium, MCShield, WinPatrol PLUS, SAS (on-demand scanner), Zemana AntiLogger Free, Microsoft EDGE, Firefox, Pale Moon, uBlock Origin, CryptoPrevent.


[I believe computer-users who sandbox (Sandboxie) are acting prudently.]

0 Kudos
msgale
5 Tungsten

RE: Warning: Disk Deframenters can "ruin" System Restore

Here is another thought.  Having read both referenced articles, I decided to check how many restore points I have.  Much to my surprise I have only three (6/7/2010, 6/8/2010, and 9/5/2014) Further investigation revealed that the first two were from the initial installation of Windows 7.  I subsequently turned off system protection but did not remove old restore points.  What I have been unable to figure out is how the 9/5/2014 restore point got created.  Remember restore point are created first-in first-deleted.  If you have insufficient space allocated to restore points, and your restore points are large, you may only have one store point available.

Keeping with the philosophy of “simpler is better”, I would first consider checking the “System Protection” settings before looking at VSS or page file fragmentation.

0 Kudos
ky331
7 Gold

RE: Warning: Disk Deframenters can "ruin" System Restore

Under System Protection, it shows that System Restore is ON/enabled for my C: (System) drive.   The restore configuration setting is to be able to "restore system settings and previous versions of files".   Current Usage is 0 bytes (as all restore points have been deleted).   I used to keep Max Usage at only 1% (= 4.51 GB) --- which should be sufficiently large to hold "a handful" of restore points --- but recently increased it to 2% (= 9.01 GB).

The problem is not the creation of Restore Points.   They are successfully created during the Windows Update process... and I can also MANUALLY create a restore point whenever I wish.   The problem is that something is causing a Volsnap error, after which all restore points vanish.

By the way, while I thought it was the defragger causing the problem, I just noticed that the most recent Volsnap error occurred two days AFTER my last defrag.   And as best as I can tell, it was at bootup.   Meaning the VSS/defragger may not be the problem after all.   (I have not looked into the page file fragmentation possibility).

Free Internet Security - WOT Web of Trust       Use OpenDNS       MalwareBytes Anti-Malware


Windows 10 Pro (64-bit), Panda DOME 18.7.4, MBAM4 Pro, Windows Firewall, OpenDNS Family Shield, SpywareBlaster, MVPS HOSTS file, MBAE Premium, MCShield, WinPatrol PLUS, SAS (on-demand scanner), Zemana AntiLogger Free, Microsoft EDGE, Firefox, Pale Moon, uBlock Origin, CryptoPrevent.


[I believe computer-users who sandbox (Sandboxie) are acting prudently.]

0 Kudos
joe53
6 Gallium

RE: Warning: Disk Deframenters can "ruin" System Restore

Here's a reference to at least one (two?) individuals who --- if correct in their analysis/assessment --- are having Restore Points disappear even when using Win7's native defragmenter: 

...

And how's this for another "goody":  Windows 7 deletes all System Restore Points upon reboot

Interesting links, ky.

In Win 7 Home Premium/64 bit/sp1 I have not seen this problem with the native Defrag.

I have at least about 20 restore points going back to July, and System Protection is enabled. They were created during Windows Updates, or prior to a system imaging using the Win 7 native imaging program.Throughout this time I have rebooted several times . I have Windows native defrag set to run once a week, and invariably an analysis shows 0% defrag on my C drive. I do not have Windows  Automatic Updates enabled.

All that said, I must admit I've seldom felt the need to use System Restore with Win 7, if at all. I tend to trust my weekly system image backups. But after my fiasco with Auslogics back in January,  I now always create a restore point prior to installing a new program/version, in case I need a "quick fix" for a bad installation. It's much quicker to recover from a bad installation using a Restore Point than using a System Image from an external HD (or MBAM or AdWCleaner scans, for that matter).

Thanks for bringing this defrag/System Restore conflict to the forum's attention. I will watch closely what happens to my restore points after tomorrow's "Patch Tuesday".


_________________________________________


Dell Forum Member since 2,000


 Use OpenDNS   MalwareBytes' Anti-Malware Free


Windows 10 Pro (64- Bit): Malwarebytes 4.x Premium, Windows Defender AV, Windows Firewall, WinPatrol PLUS, Emsisoft Emergency Kit Free and HitmanPro Free (on-demand scanners), OpenDNS, MVPS Hosts file, SpywareBlaster, Pale Moon web browser, Sandboxie, CCleaner Free.


"In the future, everyone will be anonymous for 15 minutes" - Banksy

0 Kudos
ky331
7 Gold

RE: Warning: Disk Deframenters can "ruin" System Restore

Joe,

I'm glad to bring this issue to the forum's attention.   Hopefully, it's rare, and no one (else) is impacted by it.   Regardless, by "publicizing" this, [more] people will be aware of it, should they ever experience it in the future.

I find it fascinating that a commonly accepted tool --- a disk defragmenter --- can have widespread distribution knowing that it can possibly wipe-out one's System Restore points.   It would be a simple enough matter for a program (such as Auslogic's) to determine the O/S on which it's being installed, and then, either to default to VSS-copy-mode if it's a Vista/Win7/8 system... or at least, prompt the user about the option/recommendation to do so.

Having used Auslogic's for years, I don't know that I looked into potential differences between its behavior on Win7 vs. XP.   In fact, the last I checked, there is no VSS-copy-mode option listed in the XP version (since VSS is not a part of XP).   If anything, one would have assumed Win7 to be a better/"smarter" system.   Go figure.  

The fact that this allegedly can happen even with the native defragmenter is unconscionable.

The fact that a page-file, under Windows control (which is recommended and the default) can become so fragmented over time that restore points can be deleted upon reboot, is mind boggling as well.

Like you, I rarely (if ever) have found the need to actually use System Restore.   In fact, one of the reasons why I intentionally set a very small percentage quota on System Restore is that I don't believe in using "ancient" restore points:  going back a day or two --- perhaps a week at most --- is one thing... but a month?  Or a year??   No way!

But even though I haven't actually used System Restore, I had always taken some comfort knowing the feature was available (just in case).   To find that it's not reliable [on my system, at least] is not a good feeling.

Free Internet Security - WOT Web of Trust       Use OpenDNS       MalwareBytes Anti-Malware


Windows 10 Pro (64-bit), Panda DOME 18.7.4, MBAM4 Pro, Windows Firewall, OpenDNS Family Shield, SpywareBlaster, MVPS HOSTS file, MBAE Premium, MCShield, WinPatrol PLUS, SAS (on-demand scanner), Zemana AntiLogger Free, Microsoft EDGE, Firefox, Pale Moon, uBlock Origin, CryptoPrevent.


[I believe computer-users who sandbox (Sandboxie) are acting prudently.]

0 Kudos
joe53
6 Gallium

RE: Warning: Disk Deframenters can "ruin" System Restore

I agree with all you say.

"VSS is supported on Microsoft Windows XP and later. For information about run-time requirements for a particular programming element, see the Requirements section of the documentation for that element."

http://msdn.microsoft.com/en-us/library/windows/desktop/bb968832%28v=vs.85%29.aspx

_________________________________________


Dell Forum Member since 2,000


 Use OpenDNS   MalwareBytes' Anti-Malware Free


Windows 10 Pro (64- Bit): Malwarebytes 4.x Premium, Windows Defender AV, Windows Firewall, WinPatrol PLUS, Emsisoft Emergency Kit Free and HitmanPro Free (on-demand scanners), OpenDNS, MVPS Hosts file, SpywareBlaster, Pale Moon web browser, Sandboxie, CCleaner Free.


"In the future, everyone will be anonymous for 15 minutes" - Banksy

0 Kudos