Shadowprotect Puzzle

[PaulB]

I did a complete image backup of my system after installing Shadowprotect 4.1.0 last week. My C: (system and programs) partition is about 44 GB. Image backups using Shadowprotect 4.0.5 averaged about 36 GB in size at standard (recommended) compression. The image backup using 4.1.0 was 17 GB in size at standard compression. The image backups for my D: (data) partition were similar enough in size using either version that I'm not too concerned about them.

I repeated the image backups. Same results. I ran "Verify Image" assuming that it would compare the backup image to the original and flag any errors. Completed without errors.

I have (and place) a lot of confidence in Shadowprotect, but cannot find a reasonable explanation for this discrepancy. Have any Shadowprotect users in the Lounge experienced similar results?

[Rebel]

I also did a complete backup with 4.1. The image (using standard compression) was approximately 70% the size of the original partition. I checked the size of images made with earlier versions of SP, and although I don't know the exact size of the original partitions at those earlier times, the size of those images seem to be consistent with the size of the new 4.1 image.

[PaulB]

OK, now I'm concerned. I will have to look into this much more closely. Thanks, John.

[Bigaldoc]

OK, now I'm concerned. I will have to look into this much more closely. Thanks, John.

Seems to me, Paul, that one thing I'd try would be to mount the image you're concerned about and try looking around in Windows Explorer and samplings of files to see if you can spot anything amiss. I guess at that stage you could also do a "properties" of the mounted drive AND the original C: to see how that compares. Still thinking...

(I haven't installed it yet. Waiting for my weeklies to end and will install it tomorrow.)

[PaulB]

That's good advice, Big Al. I'm gonna try that this weekend. Good luck with your install.

[Bigaldoc]

That's good advice, Big Al. I'm gonna try that this weekend. Good luck with your install.

I did my install last night, Paul, and will be doing my weekly full backups later today. I'll check my results with a couple of previous to see how the file sizes compare. More later, and keep us posted if you discover anything.

PS The only "trouble" I had was burning the CD - and it was not a SP problem. I just happened to hit TWO bad CDs in a row. The third one burned just fine, booted and tested as well.

[Bigaldoc]

Paul, I did my weekly full image of three partitions as usual and don't see anything that looks like a problem, given a week's worth of adding and deleting software like mad! One of the things that I thought might have caused this week to be slightly smaller than last week was the Fx cache, but that doesn't seem to be the case. Normally, while my backup is running, I continue surfing but this week I didn't do that. So, I mounted last week's image and don't see the browser cache. Shadow Protect must not image the browser's cache but I haven't checked into that yet. I checked the compression level of the C: drive from last week to this and it's about the same. Here's a graphic of my three partitions.

Edited to add: Just to clarify, I looked in the wrong folder. In my C: full image from Feb. 26 the Firefox cache had lots of files in it because I was still surfing as the backup was running. Yesterday, I emptied the cache and didn't browse while the backup was running. That accounts for a small part of the reduction from week to week. All looks well to me.

[PaulB]

I did as Big Al suggested. I mounted the last image of my C: partition taken with Shadowprotect 4.0.5 and compared it to the first image of C: taken with 4.1.0. All folders present on one image were present on the other image - nothing lost there. Of all the folders for which I could display properties, there were no significant differences in size or number of files save for the Windows folder. The newer Windows folder contained many more files and was significantly larger than the older (~0.9 GB), despite the fact that the newer image was about half the size of the older image. I attributed this to the installation of Win 7 SP1. I believe these are the SP1 uninstall files.

I think this is a clue. I took an image with 4.0.5 immediately prior to installing SP1. My next image (post SP1) was taken with 4.1.0. I seem to recall reading that installing a service pack will erase all system restore points. I have a rather large System Volume Information folder (62 GB) where I believe the restore points and other system protection information is stored. I think that having this folder erased may explain why my most recent images are significantly smaller than the older ones. I cannot, however, prove this because I do not know how to display the size of the SVI folder. Displaying its properties returns 0 bytes, 0 files and 0 folders.

[HansV]

It's correct that installing Windows 7 SP1 deletes all system restore points from before the update. This could well have reduced used disk space significantly.

[Rebel]

I seem to recall reading that installing a service pack will erase all system restore points. I have a rather large System Volume Information folder (62 GB) where I believe the restore points and other system protection information is stored. I think that having this folder erased may explain why my most recent images are significantly smaller than the older ones.

That may be the answer Paul. In my case, prior to making a complete image, I always perform a disk cleanup and I always delete all but the most recent restore point. If you haven't been in the habit of doing this, then SP1's removal of all system restore points may explain the drastic reduction in image size that you saw.

[Bigaldoc]

Sounds like you've done some good Columbo work, Paul.

[PaulB]

Columbo?? No, don't think so... maybe more like Inspector Clouseau!

[PaulB]

...removal of all of all system restore points may explain the drastic reduction in image size that you saw.

It's the "may" that bothers me. I can see how much disk space is allocated to the System Volume Information folder. I can easily find information explaining how to increase or decrease the allocation. What I cannot find is how to determine the actual disk space being used. This would enable me to prove or refute my hypothesis.

Can anyone tell me how to find out how much disk space is being used by the System Volume Information folder?

[JoeP]

Change the advanced security on the folder so your login ID has access. Then just use Windows Explorer as with any other folder.

Joe

[Argus]

First, I'm not a Shadowprotect user; but I am a Windows user. Apart from things that have been mentioned, browser cache, if that one isn't flushed before a backup, which probably would be a good idea, and anyhow it's usually around some 50-200 MB or something, not much, there are some other possible explanations for differences, and even if Paul's case is solved, and even if he use another OS than I do in the case mentioned below, I mention it since we are in the Security and Backup forum, and people might use different operating systems, but still the same backup software.

If one uses AU (Automatic Updates) and/or MSE (Microsoft Security Essentials) one might suddenly find that the Download folder in C:\Windows\SoftwareDistribution (WinXP) is quite large. Around the net one can find people asking if it is possible to empty that folder etc. In my opinion there's no need for that (if one hasn't severe problems with updates, but that's a different matter). As time goes Windows will automatically remove some files, and that can result in a difference of some hundred megabytes or perhaps even more, and that can explain some of the difference. And as mentioned, removing SR points can also result in quite a change ... 10 %, or what is used, is always 10 %, so it doesn’t matter if GB or MB it will be a quite considerable amount of the drive used or removed.

I had noticed changes over time in the Windows folder since the quite recent installation, and I know what explains most of that, in my case; the above mentioned downloads. If I mount an image from the day after I did the February updates, some weeks ago, I find that the Windows folder is larger than in a later image from a few days ago, and larger than it is today, ceteris paribus, i.e. all other things being equal, as far as possible. That image, after the Feb. updates, also includes some "cached" updates from when the system was installed since it is a quite fresh install, some weeks before the February updates, and during the post installation update process I used both AU and previously downloaded files. I had already most of the updates downloaded, but still, during the first weeks the Download folder mentioned above grew quite a bit, but is now around 13 MB.

Ifold.PNG

Also, I don't use Shadowprotect, as mentioned, and thus I don't know how it works with compression, but I have noticed over time, and it comes as no surprise to most of us I think, that there is a lot that can be compressed quite a bit on a usual system partition. And as you said Paul, if one image with the older software was ante SP1 and the other image with the newer version was post SP1, well, then there's a lot of things that has been going on, that has nothing to do with the backup software, as the RPs you mentioned, among other things.

As for looking at the SVI folder; on XP I probably would have launched a command prompt with local privilege escalation, but I don't think that works in Windows 7, so have to use the usual change access rights on the security tab.

Seems like the whole thread was an OS thread instead.

[Argus]

Sorry for going off topic; but I came to think about how another software works with these things:
Just for your information, since we are speaking about backup software and RPs among other things; another one Macrium Reflect is quite "intelligent" when it comes to what to copy and not. Obviously, if not in "clone mode" it excludes the swap file and hibernation file (if used). However, it also, on the latest operating systems, after Windows XP, excludes restore points from disk images, by default. (They have a small tool to enable RPs in images, if one want to change this setting.)