What are these files doing on my C Drive?

[BlueAcolyte]

The culprits

I am getting the feeling these are related to System Restore, which I have turned off.
Some change size occasionally, some are deleted, and sometimes Vista will just regurgitate all of the space at once. Virus scans are clean.

 

[bsobel]

Why would you turn of system restore? And yes, this directory is related to system management functions (such as system restore, indexes, etc).

 

[Cutthroat]

I also have system restore turned off, I make regular images with Acronis instead. On my system that directory is empty, 0 bytes, and I don't have access to view the folder. I'm running Vista HP x64 with UAC on.

 

[thegorx]

Originally posted by: Cutthroat
I also have system restore turned off, I make regular images with Acronis instead. On my system that directory is empty, 0 bytes, and I don't have access to view the folder. I'm running Vista HP x64 with UAC on.

actually if you don't have access it shows at 0 bytes anyway. It could be full of stuff

Originally posted by: BlueAcolyte
The culprits

I am getting the feeling these are related to System Restore, which I have turned off.
Some change size occasionally, some are deleted, and sometimes Vista will just regurgitate all of the space at once. Virus scans are clean.

yeah, it looks like you got some shadow copies there, there must be an overlooked service still running. I haven't really looked into shutting it off.


System Restore in Vista looks like it might actually work well, although I haven't tested it. I may just have to see what happens if I delete say the system32 folder or install a crappy program like Norton AV make a restore point and then uninstall it. Then restore back to before I uninstalled it and see if it will run or uninstall afterwards.

Thanks for the idea, I've been meaning to see what it can and can't do.


I guess the system32 folder has system restore in it and it can't find any restore points,
so I'm just going to see if it can restore system32\config

well it can't find the path
I'll try system32\config\system

Well it seems to work fine at restoring the individual System Hive file.
Just for that I'd say it might be worth keeping enabled

I emptied the system32\config folder and it restored it back so it booted back into Vista

I install norton 360 then made a restore point, uninstalled norton 360, restored it back but norton 360 would not run and would not uninstall, which I kind of expected. So it still causes problems like that in programs that were either recently install or uninstalled.

 

[BlueAcolyte]

It says system restore is turned off on drive C: (I have 2 partitions) so I'll turn it on later (using Linux right now) on both partitions and see if I can delete those restore points.

 

[thegorx]

It looks like some of those files are current
My thinking is that even though system restore is disabled it still is making shadow copies.

 

[BlueAcolyte]

Yea, I went to disk cleanup and deleted all but the last restore point. Suddenly, 6GB of space on my C: drive is clear.

 

[Smilin]

System volume information is used by system restore, shadow copies, VSS.

Be sure that when you granted yourself permission to view that folder that you didn't inadverntently strip other permissions that were already there. Messing with files in system volume information can cause problems and that's why you don't have access by default.

You should also leave system restore on even if you have nightly backups/images. The two are not substitutes for one another.

 

[thegorx]

You don't need to change permissions in Vista to view it.
Just run a third party file manager as Admin

I don't think someone that wants to disable system restore and is creating full back ups is going to cause any problems no matter what they do to the system volume information folder.

In fact clean it and see if you can deny the System access. Make a back up first just in case you type the wrong folder or better yet write it out first, don't type on the fly.

 

[Smilin]

Creating backups leverages "system volume information" during the creation of the backup even though the final storage location of the backup is elsewhere. This is done by VSS (which essentially handles open files during backups).

If you are using a 3rd party run as admin to view this folder then I believe your app is altering the permissions as admins do not have access to it by default.

You can certainly get away with messing with items in system volume information. However if you are posting a question on the interwebs asking what it is then it's probably best you don't.

Definately leave system restore on. It consumes disk space but will shrink itself if you get low. It also consumes essentially 0 CPU or Memory during day to day operation.

 

[BlueAcolyte]

No, wait guys, I solved the problem by using Disk Cleanup. Whether to turn system restore on or off is something I'll figure once I configure two different Linux OSes to run on two drives while coexisting with windows and not screwing up. (IE, maybe never)

 

[Smilin]

Always leave system restore on.

The only reason it was taking a lot of space is because you have a lot of space. If you go partition out some room for Linux and have less available it will use less.

 

[Cutthroat]

The reason I don't use system restore is it is not 100% reliable. I've had many occasions in the past when I tried to use it only to be told after a reboot that it was unable to do the restore. I probably only had a 90% success ratio with it. Also a minor annoyance of system restore is the pause created when you install new software or drivers and it insists on making a restore point first.

With Acronis TI my images are 100% reliable, and they are exact copies of the way I left it. With my organization system there is nothing on my root drive except the OS and apps, so if I mess something up it's really easy to restore an image and be right back where I left off.

 

[Smilin]

Your annoyance is that like 2 second pause it takes to give you the ability to basically rollback anything?? Ouch. I'd take 10-20 seconds for a feature such as that. Beats a 15 minute trip into recovery console to disable a newly loaded driver (if that's all that's needed).

 

[Cutthroat]

I did say it was a minor annoyance. I did run with both system restore and Acronis TI for a year or so, but as I said I found Acronis TI more reliable than system restore. There is no point in leaving it on if I'm not going to use it. I haven't rolled back a driver since I've owned Acronis because I would rather use that.

Think of this scenario, you install a bad driver and it leaves your system unbootable. Without an image your options are limited to recovery console or trying system restore from the OS disk, which may or may not work, and is not really easy. With Acronis TI I could load an image and be running again in 5 minutes.