Win7 Can Delete All System Restore Points On Reboot

An anonymous reader writes "Astonishingly, the so-called system restore feature in Windows 7 deletes restore points without warning when the system is rebooted. This forum thread on answers.microsoft.com shows some of the users who have experienced the problem. Today I did a clean install of Windows 7 Ultimate 32-bit (no dual boot), and noticed that whenever the machine rebooted after installing an application or driver, the disk churned for several minutes on the 'starting Windows' screen. Turns out that churning was the sound of my diligently created system restore points being deleted. Unfortunately I only found this out when Windows barfed at a USB dongle and I wanted to restore the system to an earlier state. This is an extraordinarily bad bug, which I suspect most Windows 7 users won't realise is affecting them until it's too late."

Comments

How prevalent?

[valros]

So wait, how prevalent is this?

Re:How prevalent?

[wdsci]

I would temper the grandparent's statement by saying it depends on which data you're talking about. I mean, /tmp is supposed to be a temporary storage location - even the name tells you so. The whole point of it existing is so that you (well, the OS) can cache things there and trust that they're not going to sit around forever hogging disk space without having to remember to delete them explicitly. So I would expect that to be wiped on boot. (Same applies to temporary folders in Windows or any other system) Other data, though, I would generally expect to be kept. Especially System Restore points, which are pretty much useless if your last one is going to get deleted automatically.

Re:How prevalent?

[jhoegl]

Well just this week we had someone with a corrupted explorer.exe, it kept crashing.
After checking everything we figured it was an unseen virus or something and went to look at restore points
The restores were set to 0KB (seriously, they had KB as an option for a restore point on a Win7 install), so that was our evidence.
However, Im wondering if this is not somehow part of the bug. Ill wait and see what MS finds

Re:How prevalent?

[DeadboltX]

It makes perfect sense to remove the oldest restore point when there is not enough room to create a new one. No matter how much disk space you allocate to System Restore at some point you are going to fill it up. Having it prompt the user would cause it to prompt every time after that. For people who don't understand System Restore very well this kind of prompt might lead to more harm than good. If someone gets a warning saying their system restore space is full, they might clear it out completely, especially if they were getting this message on a regular basis.

Re:How prevalent?

[Anonymous Coward]

Using temp for storage is like getting angry when people flush your shit down a toilet.

Last year a co-worker of mine had to replace the computer of our PHB of IT. When he set up her Outlook again he took the liberty of emptying her Deleted Items since it appeared a lot had accumulated there. When PHB found out she was irate and demanded he get the contents of the folder restored. She said she stores things there for safekeeping.

Don't jump the gun blaming Win7

[MSTCrow5429]

I've used System Restore on my Win7 64-bit systems. If Win7 really had a habit of deleting System Restore points, it would have been detected and harped upon within hours of its release, 32-bit or 64-bit. Whatever the problem is, it's hard to believe it's Windows' fault.

Re:Not That It Matters Much...

[ls671]

The only time I used system restore is when I couldn't reboot with new installed components or service packs so maybe MS decided that if you rebooted successfully, then you do not need the restore data anymore, hehe... ;-))

Probably not a Win 7 bug...

[ghostis]

Given the recent similar issue with supposedly buggy Windows updates, I say this is an undetected root kit cleaning up after itself.

Re:System restore stinks. Image your disk

[gandhi_2]

My man,

the beauty of windows isn't windows.

it's active directory and all the other systems that ms puts together for fleet management.

i'll slap the shit out of the next person who says openldap. it is pretty easy to do stuff like point an entire OU to a WSUS server and specify how updates are done.

they've built an impressive system for enterprise setups that would take a shitload of work in linux. pushing down group policies to a fleet of macs?

Re:Stop preaching Linux

[scrib]

Yeah, it's great, which is why I run Windows in a VM on Linux. I keep a snapshot of a working XP virtual disk handy.

Why? I'm the go-to geek in the family and I've had to call Microsoft registration many times to reactivate XP after an upgrade or salvaging a drive from a dead MB. They're always polite and friendly, and reading the seven sets of six digits over the phone and typing in the response only takes about 10-15 minutes. But...
What about when that 800 number goes dead? Or they stop giving out activations for older XP systems? Or they finally say "sir, that's an OEM license and only valid for the broken machine, not the new MB."

Ironically, what I need the Windows VM for the most is iTunes. Thanks, Apple!

Linux issues can be fixed.
Windows can be reinstalled. Probably. Or you can buy a new version and migrate your data. Perhaps.

Re:Don't rely only on system restore

[shutdown -p now]

The irony is that Acronis boot media is Linux-based.

Re:Stop preaching Linux

[Anonymous Coward]

"Why? I'm the go-to geek in the family and I've had to call Microsoft registration many times to reactivate XP after an upgrade or salvaging a drive from a dead MB."

There are numerous tools available to disable WGA and alternate ways to get system updates. All my XP licenses are legitimate but I've *never* called Microsoft or gone through any of that DRM nagging. While I am technically breaking the EULA I'd like to see them try to legally enforce it when I've paid my money for the product and number of machines == number of licenses. Save the headache. It's a waste of your time and WGA is one more way for the system to fail.

Yeah

[SmallFurryCreature]

And they erase all my memory too! All of it just gone, empty blank state every time I pull the power! And when I took out my HD and cleaned it under the tap to get the dirty bits out, Gentoo totally failed to work with my freshly cleaned drive!!!

And to remain on topic, anyone actually use system restore? Always disable that as fast as possible.

Re:Can't be affecting all users

[Blakey Rat]

but come on, if the defragmentation utility does not play nice with the system restore utility,

He didn't say it was "the" defragmentation utility (that is, the one that ships with the OS.) He said it was "a" defragmentation utility (that is, one that was written by a retard in 20 minutes for Windows 98 and still ships because if it doesn't actually crash it *must* work correctly still, right?"

why should a filesystem even fragment in the first place?

It doesn't, actually. Unless disk space is critically low, but in that case you have bigger problems. I just opened the Disk Defragmenter on my mostly vanilla Windows 7 install: C: 0% fragmentation. D: 0% fragmentation. I don't even know why they include that utility anymore, frankly.

But most people, like regular folk, they probably would want it on (because they've probably heard (wrongly) it provides them with more space),

Maybe that's why Microsoft still ships it: placebo effect.

So the bug may not be 'extraordinary', but it is stupid. Is what.

You still haven't demonstrated the bug has anything to do with Microsoft's code.

I'd bet a hundred bucks it's an ancient third-party defrag utility that hasn't been updated to understand the concept of shadowcopy. (Just because a disk block shows as unused doesn't mean there's nothing useful there.) It's particularly shameful because shadowcopy has been around since Windows XP.

Or it may be malware trying to cover its tracks. If a piece of malware knows it can be defeated by System Restore, I could see it removing restore points at boots to prevent that.

Either way, it's nothing that ships on the OS DVD.

Re:1 thing the mods here understand, is this... ap

[Blakey Rat]

P.S.=> Are they actually DOING that (fostering this type of sentiment around here)? I don't know, but, it would make a LOT of sense from the site owner's perspective @ least, to actually do so, for the purposes of monetary gain via website page hits adbanner monetary generation! apk

My guess is that they're too incompetent to be doing it on purpose, but they might luck into it.

Re:Not That It Matters Much...

[hoggoth]

Take a look at fsarchiver. All the benefits of a dd image, with many advantages.

It only clones blocks that in use, it compressed the image, and it can restore to a different sized partition.