Best wishes, Andrew.

Logically a Shadow Copy or Snapshot is everything on the disk (except free space and swap file) as it existed at that point in time. However it is not a backup – obviously there is no way you can store a duplicate copy of a 500 Gb hard drive in a 2 Gb Shadow Copy file. Instead (to simplify a little) the logical “snapshot” when first created simply points to the contents of the actual drive. Then, only when a block on the drive is written to, it copies the original version of that block to the shadow copy file (sometimes called a “diffs” file).

The Volsnap service (VSS) allows you to mount a shadow copy (almost) as if it were a real disk drive. You can create a drive letter, mount point or symbolic link. Google “Dosdev” for information. Unfortunately Windows Explorer won’t read this “pseudo-drive” but the shareware program Total Commander will. When you read a shadow copy VSS reads the block from the real drive if it hasn’t changed, or from the diffs file if it has. So what you see are the blocks on disk as they existed at the time of the “snapshot”.

Shadow copy works purely in terms of 16k physical drive blocks. It knows nothing about the file system. However those drive blocks include the NTFS file system (Master File Table etc.) and since reading the shadow copy returns the blocks in the MFT as they were at the “snapshot” time, the system will see the files and folder structure as they were at that time and each of these recreated MFT entries will point to the content of the clusters it occupied as they were at that time.

When system protection creates a new shadow copy, the diffs file is frozen and subsequent changes are written to a new diffs file. So to see the drive as it was at the time of an earlier restore point, you need to use the diffs for the snapshot you want and for all later snapshots. So a snapshot is dependent on later restore points but not on earlier ones.

It would be valuable to have the confusing point highlighted by Paul Mullen cleared up. I quote Paul:

“Finally there is just one point in your long post which must be wrong or at least confusing. In one place you said each restore point is a snapshot of files as they were at that particular time. In another you say that changed blocks are written to the last Restore Point file before they are overwritten. If this latter statement is correct, then a Restore Point for a particular date will [only] contain changes since that time. Furthermore, since this will be an incremental process…”

A clarification will also decide whether a restore point is independent of others (a complete snapshot in itself) – or dependent on previous restore points.

With thanks, Andrew.

Any chance of a follow up article (or private email to me as I am trying to research these topics).

Thanks Paul

Would I be right to conclude that a system restore is AS clean a restore to a previous time (for system settings and critical files) AS a restore from a system image (although this is fuller).

I am aware that a system image is of ALL the C drive – whereas a system restore is only for certain file extensions and locations (Actually, on my Windows 7 x64 system all user folders, Downloads, My Documents, Pictures etc. are on a separate partition – except for App Data).

More specifically for the registry: does a system restore replace the registry to exactly as it was at the restore point – or are there overlaps, redundant entries and duplication introduced by the restore.

I am asking because I believe in Windows XP a system restore simply overlay the newer (now dated) registry with the older system restore dated one – so expanding and complicating the registry; at least this is what the developer of ERUNT said.

So given a situation where all I want to restore is an EXACT image of critical system settings and programs at a given time in the past am I making the right choice in doing a system restore – which is very fast.

Will doing multiple system restores (over time) to different periods complicate or confuse the system as time goes on?

I need to decide whether to normally and frequently rely on system restores (I test a lot of programs) without this frequent use complicating my system over time. If system restores are clean and exact restores to a previous time then I would only use my Macrium Reflect full system images when absolutely needed (say, in the case of a virus, or a disk defrag gone wrong, or other situations when system restore may not work).

I would greatly appreciate some feedback on this. Thank you.

Looking at one of the tutorials: on Windows Seven Forums about deleting system restore points: System Protection Restore Points – Delete > http://www.sevenforums.com/tutorials/336-system-protection-restore-points-delete.html

Options 3 and 4 of the tutorial cover deleting system restore points SELECTIVELY with CCleaner or System Restore Explorer.
My questions about doing such selective deletions of restore points with these utilities are:

1. Is there any risk in deleting restore points at various arbitrary points. Are they interdependent? Will deleting some cause a risk of others not working? Tomasz, in the article above says: “The second important fact is that shadow copies are incremental”. I asked this question on the Windows 7 forum and Brink (Shawn), the tech expert on this replied: “restore points are not interdependent on other restore points. Each restore point is a full and separate restore point” – and so selective deletion is possible.

2. Does selective deletion of restore points with CCleaner etc.,actually save any disk space; or is it simply cleaning up a list so that after the deletion of unneeded ones only the restore points considered useful are presented in the list – whereas system restore disk usage and the physical restore points are left unaffected. I asked this on the same forum and the response was: Deleting the points [selectively, with CCleaner or System Restore Explorer] does recover disk space.

I am hoping someone can clarify these issues for me. Can I selectively delete restore points without affecting the use of the ones I allow to remain. Will it recover disk space used by system restore?

Thank you.