Dealing with Drivers and Other Tales of Hardware Troubleshooting (part 3) - Go Back in Time with Restore Points and Shadow Copies

3. Go Back in Time with Restore Points and Shadow Copies

The System Restore service runs invisibly in the background, routinely backing up drivers, important system files, and certain Registry settings so that at some point, you can roll back some or all of your computer's configuration to an earlier time. Plus, if you're using the Business, Ultimate, or Enterprise edition of Vista, you can extend this feature to include your personal documents, forming what are called shadow copies.

There are several different ways to access restore points, each with its own purpose and scope:

Roll Back Driver

In Device Manager (devmgmt.msc), expand a category, right-click a device, and select Properties. Choose the Driver tab, and then click Roll Back Driver to replace the current driver with an earlier version. If the Roll Back Driver button is grayed out, then either you've loaded no earlier version of this driver, or the System Restore feature isn't operational (discussed later in this section). What's nice about this feature is that the scope of the change is crystal clear; when you click Roll Back Driver, only the driver files and settings for the current device are affected.

System Restore

To open the System Restore wizard, open the Start menu, type rstrui and press Enter. Click Next on the first page to show a list of the recent restore points, and then select an entry and click Next to revert your PC's system files and configuration to an earlier state. (If you don't see any restore points, read on to see how to enable this feature.)

It's best to think of this feature as neither an uninstall tool nor a time machine, but rather something in between. Windows makes a restore point when you install hardware drivers, when you install software (most of the time), and occasionally at regular intervals. (You can also create restore points manually in the System Protection window, described later in this section.) But it's never made clear what exactly changes when you restore a restore point, making this a potentially dangerous tool. The good news is that you can return to the System Restore wizard and undo your last change should something go wrong (assuming you can boot Windows thereafter).

If all you're trying to do is uninstall software, you should do so through the Programs and Features page in Control Panel. Likewise, to uninstall a hardware driver, open Device Manager (devmgmt.msc), right-click the device, and select Uninstall. With these features, at least the scope of your change will be easily predictable.

Last Known Good Configuration

If a recent driver or software installation has prevented Windows from loading, press F8 just after your PC powers up , and from the Advanced Boot Options menu that appears, select Last Known Good Configuration (advanced).

If you're lucky, the effect is more or less the same as choosing a recent restore point in the System Restore wizard, allowing you to subsequently start Windows. But in practice, this feature often has no effect, either because the scope of the change isn't great enough to fix whatever problem you're having, or because Vista wasn't set up to create restore points in the first place (more on that shortly).

Previous Versions

Right-click a document you've been working on recently, select Properties, and choose the Previous Versions tab. What you see in the File versions list here depends on several factors.

First, if you've used the Back Up Files wizard , and that backup included the file you right-clicked, you should see at least one entry marked Backup in the Location column. (Thus the usefulness of this feature relies on the scheduled backup system that comes with every edition of Vista except Home Basic.)

Next, if you have the Business, Ultimate, or Enterprise edition of Vista, and the file is on a drive protected by System Restore, you should see at least one entry marked Shadow copy in the Location column.

The biggest problem with the System Restore and Previous Versions features is that they often don't work. If they're not properly set up, the restore points on which they rely don't get made.

To fully enable restore points, start by opening the System Protection window. Open the Start menu, type SystemPropertiesProtection, and press Enter. (Or, open the System page in Control Panel, click the Advanced system settings link on the left, and choose the System Protection tab.) Here, place a checkbox next to drive C: and any other drive for which you want to create restore points, and then click Apply. Unless those checkmarks were already present, take this opportunity to save a restore point by clicking Create.

Next, open the Services window (services.msc), and find the Volume Shadow Copy entry in the list. If it doesn't say Started in the Status column, double-click the entry, and from the Startup type list, select Automatic. Click Start to get the service running, and then click OK. Do the same for the Microsoft Software Shadow Copy Provider service as well.

Lastly, check your PC for utilities that may not be fully compatible with Vista's restore points. For instance, some Registry "cleaners," like TuneUp Utilities and CCleaner, have been known to interfere with restore points (among other things). And Diskeeper 2007 (defragmenter software) and earlier versions were known to erase shadow copy data (Diskeeper 2008 fixes this problem). If you're having trouble getting shadow copies to work, try disabling any "fix-it" utilities on your PC until you track down the culprit.

3.1. Choose how space is allocated for restore points

Restore points can consume as much as 15% of your hard disk's total capacity; on a 320 GB drive, that means up to 48 GB can be sucked up by previous versions of your files, hardware drivers, and other detritus.

To find out how much space restore points are currently taking up, open a Command Prompt window in administrator mode , type this command:

vssadmin list shadowstorage

and press Enter to produce a report that looks like this:

vssadmin 1.1 - Volume Shadow Copy Service administrative command-line tool
(C) Copyright 2001–2005 Microsoft Corp.

Shadow Copy Storage association
   For volume: (C:)\\?\Volume{3b5ab54e-c86b-11cb-a2d6-306f6f6e7963}\
   Shadow Copy Storage volume: (C:)\\?\Volume{3b5ab54e-c86b-11cb-a2d6-
      306f6f6e7963}\
   Used Shadow Copy Storage space: 11.706 GB
   Allocated Shadow Copy Storage space: 12.286 GB
   Maximum Shadow Copy Storage space: 13.83 GB

Here, restore points and shadow copies consume about 12 GB. The files themselves are stored in the \System Volume Information folder, which is hidden in Windows Explorer unless you turn off the Hide protected operating system files option . (Regardless of the setting, Windows will never let you view the files therein directly.)

Whether the amount of space restore points consume on your hard disk is too much or not enough is up to you, but either way, it's easy enough to change. At the Command Prompt, type:

vssadmin resize shadowstorage /for=C: /on=C: /maxsize=5GB

(Replace C: with the drive you want to adjust, and 5GB with the actual amount of space you wish to allocate.) If you want to release the limit for shadow copy storage, omit the maxsize parameter, like this:

vssadmin resize shadowstorage /for=C: /on=C:

Now, you may have noticed that you need to indicate the drive letter twice. This permits a nifty little hack: it turns out you can allocate space on one drive to hold the shadow data from another drive. For instance, type:

vssadmin add shadowstorage /for=C: /on=D:

to have the shadow data for drive C: stored on drive D:. (If C: is your primary Windows drive, putting your shadow data on D: should improve performance.) To rescind this order, delete the shadow storage "association" with this command:

vssadmin delete shadowstorage /for=C: /on=D:

You can also delete shadow copy data without changing the associations:

vssadmin delete shadows /for=C: /all

Or, if you have a lot of drives and you want to clear the shadow data for all of them at once, use this WSH script :

Set oWMI=GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\
   cimv2")
Set cVolumes = oWMI.ExecQuery("Select * From Win32_ShadowCopy")
For Each oVolume in cVolumes
    oVolume.Delete
Next