Restore Points Vanished

Okay, thanks guys.

I turned off System Restore on all except the system (C) drive/partition.

I also reduced the interval in the registry for creation of automatic system checkpoints from 24 hours to 6 hours.

Also please note that I have 22.9 GB free space out of 45.1 GB total disk space on C, which is more or less 50% but ought to be sufficient, right?

So if this doesn't correct the problem, then I guess I need to reinstall System Restore. Just to reiterate on that score, do I merely need to find the SR.INF file and click "install" on it? I mean, I don't need to fuss with slipstreaming (whatever that is) do I?

Thanks again for continuing to offer advice on this weirdness.

 

The problem resturned, and I'm baffled.

First, to reitterate: I've done everything I can think of. I turned system restore off and then on again. I checked services -- they're fine. I checked my disk space, and it seems fine, too. (I've got 26.4 GB free space out of 45.1 GB on C; 7.49 GB free space out of 9.75 GB on D; 2.74 GB free space out of 9.75 GB on E; and 8.76 GB free space out of 9.75 on F).

I even reinstalled system restore.

But still today, at 1:07 PM, event viewer noted that system restore was suspended due to (supposedly) not enough disk space on the system drive, and that it would be restarted once 200 MB of space was freed up. Of course, all my restore points were erased. At 2:51 PM, system restore was started again, according to event viewer, because supposedly enough space was all of a sudden miraculously freed up on the system drive.

I didn't even come into the office and check the computer until just about that time -- about 2:50 PM today! So what could have possibly happened in the hour and 44 minutes between system restore shutting down and erasing my restore points and it starting up again and creating a new system checkpoint?

The only thing I saw on my screen when I arrived at my computer was Zone Alarm's anti-spyware scan results, which says the scan started at 12:30 PM today (When it completed, I don't know). The scan is supposed to take place once a week, but it seems that I can only get three or four days worth of restore points before system restore shuts down and erases them. Still, just to make sure the problem doesn't involve Zone Alarm's anti-spyware scanning, I have now disabled that.

But I should point out that NOTHING has changed on my computer from before this whole problem started two weeks ago -- when system restore started shutting down due to incorrect reporting of inadequate disk space -- and now. NOTHING has changed.

Any suggestions for what to do about this?

Incidentally, I use Norton Antivirus 2006, in case there are any conflicts with system restore I don't know about.

Also, I took one of Charlesvar's suggestions (from an April thread about system restore) and re-registered the jscript.dll and vbscript.dll files.

I am stumped, ladies and gentlemen. Stumped!

 

Hi Dave,

My suggestion would be to disable ZA and NAV one at a time. Both, depending on the versions, have been implicated in SR problems.

Tough to do because they're both critical apps.

You can substitute XP's firewall for ZA's. With the AV, you did mention that you shortened the timing to 6 hours - so my suggestion would be to stay off the internet for a day or two. Hard to do I know

Regards - Charles

 

Not sure whast you mean by the above, Charles, I was talking last week about shortening the interval for restore point creation to 6 hours (not changing my AV scans to 6 hours). But once I reinstalled SR, the interval went back to 24 hours.

So far I've just disabled the anti-spyware scan done by Zone Alarm, since that was most directly implicated (albeit maybe only coincidentally) in SR shutting down. But I have real doubts that this -- or that either ZA or NAV -- has anything to do with the SR problem, simply because I've been using both of these programs for two years and never had an SR problem before.

In any event, the real culprit here has got to be something that makes the system think disk space is low when it's not.

MS in one of its knowledge base articles says this can happen if a change, modify or delete action is taken on a file that is monitored by SR. What program might do that, and how could I find out?

 

Here's the first time System Restore shut down due to a supposed lack of space (not true) and erased all restore points, followed the next day by System Restore's restart. Can you glean anything from this information?

Event Type: Information
Event Source: SRService
Event Category: None
Event ID: 107
Date: 4/25/2007
Time: 2:43:01 AM
User: N/A
Computer: DKLINE
Description:
The System Restore service has been suspended because there is not enough disk space available on the drive \\?\Volume{4eae1930-a7da-11d6-a288-806d6172696f}\. System Restore will automatically resume service once at least 200 MB of free disk space is available on the system drive.


Event Type: Information
Event Source: SRService
Event Category: None
Event ID: 108
Date: 4/26/2007
Time: 12:19:59 PM
User: N/A
Computer: DKLINE
Description:
The System Restore service has resumed monitoring due to space freed on the system drive.

 

Hi Dave,

I did mean SR's interval - wasn't being clear

Is there a possibilty that one of your apps is creating huge temp files and then deleting them?

Regards - Charles

 

How would I tell if that was happening? The only apps I use with any frequency are Word, Outlook, & Powerpoint (Office 2003), plus Adobe Reader and IE. Once in a while I run Ad-Aware and Spybot. And the only programs I have loading at startup are Norton Anti-Virus and Zone Alarm.

But again, this was all true prior to April 25th, when System Restore for the first time thought it had run out of disk space and suspended itself.

Could the culprit be one of MS's critical updates? I don't know.

I'm really concerned about this issue because System Restore truly has saved my butt a few times and I rely upon those restore points as a critical safety net. I do have PC Backup, which supposedly will allow me to restore not just my data but my system state, but I just don't use it frequently enough to make me feel I can safely do without System Restore.

 

I just saw this on a Zone Alarm user forum -- does it relate to my problem?

The newest version of free version of ZA corrupts the IAMDB.RDB (holds all the program permissons info). Its not noticeable until you check your hardrive space and see that you are dwindling. In my case I have a lot of programs in ZA that totals about 8mb. Because the IAMDB.RDB is corrupted ZA writes to the System Volume Information/_Restore... /RPnn folder a copy of the IAMDB.RDB every 1 to 2 minutes! Over the course of 5 days my system restore folder jumped to 7gig. It appears that you have to go to Windows/Internet Logs and delete the IAMDB.RDB and the BACKUP.RDB (which can only be done after rebooting to safe mode without ZA running). This forces ZA to start a new database unfortunately. To reclaim your hardrive space you would need to stop system restore and restart it back.

 

Hey, I've got an idea: If I can't get System Restore to work properly again, what about installing that program called ERUNT?

Does that provide reliable system restore-type functions?

 

But doesn't backing up the registry essentially restore my system to the way it was before a problem occured? What's the difference between a registry backup via ERUNT and what System Restore does?

 

Okay, so it sounds like System Restore is better at bringing you back to the whole state your PC was in before a problem occured.

But if I can't get SR to work, then isn't ERUNT at least a partial solution that might save me in the event of a problem?

I mean, this whole mess has gotten me thinking about what I would, for example, if my PC suddenly didn't boot at all? I'm not sure I have a solution to that -- i.e., a bootable disk and a program to restore the registry.

But I'd at least like to have System Restore-type capabilities. And if SR isn't going to work for me and we can't figure out how to fix it, then wouldn't ERUNT at least be good to have around?

 

Hi Dave,

You did write that you have Drive Imaging/Backup software, that's a better solution. If your not sure it works or how it works, now's a good time to test it

Having a way to backup the registry is good to have, and you can do that manually as well - bring up regedit.exe from the run box > File > export. Double clicking on the exported reg file will restore it.

Regards - Charles

 

Just to play devil's advocate, here's what ERUNT's creator says about registry export:

The "Export registry" function in Regedit is USELESS (!) for
making a complete backup of the registry. Neither does it export the
whole registry (for example, no information from the "SECURITY" hive
is saved), nor can the exported file be used later to replace the
current registry with the old one. Instead, if you re-import the file,
it is merged with the current registry without deleting anything that
has been added since the export, leaving you with an absolute mess of
old and new entries.

And as for ERUNT vs. System Restore, isn't it true that ERUNT at least gives you the option of restoring the registry even if Windows doesn't boot? And as we know, System Restore can be buggy and unreliable. What's more, ERUNT's creator insists that "though System Restore backs up more than just the registry, the registry is essentially all you need to revert your system to a previous state. "

I'm wondering about a "third way" here: What if I use PC Backup (a true disaster recovery system that on my PC backs up to DVD) to simply create a "system state" backup every day, only occasionally backing up the whole drive to the 4 DVDs required to contain it? Would that essentially be the same as a System Restore/ERUNT backup combined?

 

Ok, I suggested the manual way as an additional means - for instance, if you make a change to the registry that's under a specific branch - you would only export that branch, not the whole thing. If ERUNT costs, I wouldn't bother with it.

As I wrote - that would be the best solution.

Regards - charles

 

Agreed. Thanks, Charles.

I have to tell you, though, that it bugs me ENORMOUSLY that I cannot figure out what's wrong with my System Restore. You'd think that after using PCs for 28 years now -- including lugging a 28 pound "portable" Osborne to Afghanistan to report on the war there -- that I'd have accepted the fact by now that sometimes software just goes bonkers for no reason known to God or man.

In fact, isn't that why God invented software (or at least Microsoft software) -- to teach us humility?

 

Forgot to suggest:

Get yourself another HD for backup purposes. Either another internal, or an external connected via USB. HD's cost less than a dollar a gig these days.

If an external - buying an ATA internal drive + the drive enclosure for it, generally costs less than a ready made external drive.

Regards - Charles