Mark said:
I thought only the changed files were stored, so the only extra stuff
is the minimal information needed to indicate that a new restore point
was made.
I find that long before the (not reserved) space that restore points
use is filled up, something happens that makes Windows (XP, at least)
decide to delete all of the restore points.
There are differences between how System Restore works in Windows XP
versus Windows Vista/7; however, old restore points do get deleted. It
may be that restore points are delta backups usable only for rollback.
That is, you use the recorded changes to revert the state of a host.
You are walking backwards. That is not the same as starting with a full
backup and walking forward through a differential or through multiple
incrementals. With a restore from full backup through incrementals, you
ensure you end up with a coherent fileset. With rollback, the fileset
may no longer be coherent because the delta backup only recorded some of
the changes, not all of them. XP was worse for this because it was very
limited as to what files it would monitor for changes and where they
were. Vista/7 is more encompassing of files in other locations but does
NOT include all changed files. Even in Vista/7, you could rollback and
end up with an incoherent fileset. System Restore does NOT replace
doing image backups to get the host back EXACTLY to a prior state.
Under Windows XP, a maximum amount of allocated disk space (for
potential use but not immediately reserved) would limit how many restore
points could be saved. A registry value (RPLifeInterval) defined the
maximum age to keep a restore point (default = 90 days). Has this
changed in Vista/7?
I know only from what I've read of Microsoft's explanation of System
Restore on how it works, and that isn't as technically detailed as I
would like. Of course, there might be something over at MSDN that would
probably quickly go over my head to understand. System Restore can be a
godsend to repair a host but it can also lead to problems that aren't
found until later (so much so that typically the user won't associate
the problem with having done a restore point recover a long time ago).
I prefer image backups to ensure that I really do recover a partition
back to a specific state.
If System Restore were a delta backup (for rollback only or walking
backward to restore host state), what happens when you select to use a
restore point that isn't the latest one? The files have still changed
after that restore point (as evidenced by the later restore point) but
they won't be recorded in the prior restore point (because those files
changed later, not before the restore point was saved). I don't recall
there was interdependence on restore points that you must have the later
restore points after the one you select (so the rollback would track
through all the changes to then unchange them all). If some files were
tracked by restore point #1 and different files were tracked by restore
point #2 and you selected to restore back to restore point #1, what
about all the changed files that only restore point #2 knows about? I
know that old restore points get deleted (from expiration or lack of
disk space).
I don't know if System Restore has a weak point in that later restore
points must exist to select and use an earlier restore point. What
happens if a restore point is lost, deleted, or corrupted? Obviously
you can't use that restore point but does that also mean you cannot use
any of the earlier restore points, too? This weakness may be why
Microsoft doesn't expose restore point management to users. If they
deleted a restore point then none of the earlier ones would be usable.
I see in CCleaner that they let the user pick a specific restore point
to delete. Well, if that doesn't corrupt the restoration process (a big
*if*) then that makes it appear (this author believes) that restore
points are independent and that would mean they are full backups, not
incrementals; i.e., for them to be independent (not used together to
rollback across several restore points) would mean each has to record
everything (of what they do record). I've never use CCleaner to delete
a specific restore point and then test if I can use an earlier restore
point - and get a valid restore). If I deleted a later restore point
and there were only delta backups, a restore to an earlier restore point
wouldn't revert the changed files that were recorded in the now deleted
restore point. If the restore points are delta backups, it sure looks
like there would be a mess of files that got restored if any restore
points leading back to the selected one were missing. If the restore
points are full backups then they are independent and deleting a restore
point won't affect the ability to use another one.