Identifying how much disk space is used for restore points in Windows Vista

Beta testers and even MS employees often ask us why restore points take up so much disk space and whether this can be adjusted. I also see the opposite problem reported—testers are surprised that so few restore points are being kept on the system. The best way to see what’s going on is to use the vssadmin tool from an elevated command prompt. I’ll walk you through how to do this. 

But first, let me clarify some terminology: I use the terms shadow copy and restore point throughout this article. Restore points are a special type of shadow copy because they store specific information needed during a system repair with System Restore. Restore points are created by:

• Windows Vista File Backup
• Complete PC Backup (in this case, a restore point is created on the source volumes, not the target volume)
• The daily scheduled System Restore task
• Application installations or driver installations 

Shadow copies created on the Complete PC target volume are not restore points. However, both types of shadow copies can exist in the same shadow copy storage area at the same time. 

Let’s take a look at how big the shadow copy storage areas are on my computer running Windows Vista. The shadow copy storage area is where shadow copies are stored on each volume.

I ran the vssadmin list shadowstorage command (from an elevated command prompt) to obtain this output:

V:\Windows\system32>vssadmin list shadowstorage

vssadmin 1.1 - Volume Shadow Copy Service administrative command-line tool

(C) Copyright 2001-2005 Microsoft Corp.

For volume: (C:)\\?\Volume{3ce0cbe2-57c2-11db-a712-806e6f6e6963}\   Shadow Copy Storage volume: (C:)\\?\Volume{3ce0cbe2-57c2-11db-a712-806e6f6e6963}\

   Used Shadow Copy Storage space: 1.335 GB

   Allocated Shadow Copy Storage space: 1.539 GB

   Maximum Shadow Copy Storage space: 4.395 GB

Shadow Copy Storage association

For volume: (V:)\\?\Volume{3ce0cbe3-57c2-11db-a712-806e6f6e6963}\   Shadow Copy Storage volume: (V:)\\?\Volume{3ce0cbe3-57c2-11db-a712-806e6f6e6963}\

   Used Shadow Copy Storage space: 12.643 GB

   Allocated Shadow Copy Storage space: 13.116 GB

   Maximum Shadow Copy Storage space: 14.649 GB

Shadow Copy Storage association

For volume: (D:)\\?\Volume{191fc6ee-5a69-4a34-bb81-80b7b46bba04}\   Shadow Copy Storage volume: (D:)\\?\Volume{191fc6ee-5a69-4a34-bb81-80b7b46bba04}\

   Used Shadow Copy Storage space: 500.266 MB

   Allocated Shadow Copy Storage space: 1.074 GB

   Maximum Shadow Copy Storage space: 14.648 GB

Before I go over each of these, here’s something to keep in mind: the determination of shadow storage size is made when the first shadow copy is created (typically when System Restore is enabled and creates a restore point during Setup) and is set to the minimum of 30% of free space or 15% of the volume. When System Restore is turned on right after Windows Vista is installed, the shadow copy storage area is most likely to be 15% of volume. In cases where System Restore is turned on much later, the 30% of free space formula might kick in, thus limiting the number of shadow copies you’ll have on your system. Also, these percentages don’t increase or decrease dynamically when more (or less) free space is available or after you adjust the size of the volume.

Here’s a quick analysis of these results:

• My C volume is a 29.3-GB volume where I have Windows Server 2003 R2 installed. The default 15% of my volume is set aside for shadow copies.
• My V volume is where Windows Vista is installed. It’s a 97.66-GB volume, and I’ve got 15% of the volume (14.649 GB) set aside for shadow copies. Since this is my busiest volume, I have 12.643 GB worth of shadow copies. 
• Volume D is a new volume where I am storing Complete PC Backup images. The volume is 48.83 GB, and I have 30% of the volume set aside for Complete PC Backup shadow copies. Why 30%, you ask? Because when a Complete PC image is saved to a volume, the shadow copy storage is set at 30%, not the usual 15%. (There is a good reason why we chose to make this larger—I’ll cover this in a later blog post. Stay tuned!) I should also quickly point out that I have a relatively small amount of used shadow copy storage (500.266 MB). This is because the first Complete PC Backup image is stored as a .vhd file, not as part of the shadow copy storage area. Only subsequent images have their differences added as shadow copies in the shadow copy storage area, and we optimize these to take up as little disk space in the storage area as possible. There can be some variation here, though. In my case they’re small chunks, but the space used can be much larger. More on that in a later post. 
   

It’s easy enough to decrease the shadow copy storage area, but doing could potentially delete older shadow copies. If you need the free space more than you need a long history of shadow copies, you can decrease the storage area size.

Let’s say I decide to decrease the storage space on my D volume to 10 GB. I would use the vssadmin resize shadowstorage command as follows:

V:\Windows\system32>vssadmin resize shadowstorage /on=D: /For=D: /MaxSize=10GB

vssadmin 1.1 - Volume Shadow Copy Service administrative command-line tool

(C) Copyright 2001-2005 Microsoft Corp.

Successfully resized the shadow copy storage association

If I re-run the vssadmin list shadowstorage command, I now have the following stats for D:

Shadow Copy Storage association

For volume: (D:)\\?\Volume{191fc6ee-5a69-4a34-bb81-80b7b46bba04}\

Shadow Copy Storage volume: (D:)\\?\Volume{191fc6ee-5a69-4a34-bb81-80b7b46bba04}\

   Used Shadow Copy Storage space: 500.266 MB

   Allocated Shadow Copy Storage space: 1.074 GB

   Maximum Shadow Copy Storage space: 10 GB

Next, let’s take a look at how many shadow copies I have. Typing vssadmin list shadows, I get the following condensed output:

Provider: 'Microsoft Software Shadow Copy provider 1.0'

         Type: ClientAccessibleWriters

         Attributes: Persistent, Client-accessible, No auto release, Differential, Auto recovered

Contents of shadow copy set ID: {b77797ad-2bef-4438-b843-8817eb76cf5d}

   Contained 2 shadow copies at creation time: 10/13/2006 5:00:21 PM

      Shadow Copy ID: {e68baeda-603a-42e2-b88c-1384e28fa6df}

         Original Volume: (C:)\\?\Volume{3ce0cbe2-57c2-11db-a712-806e6f6e6963}\

         Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy25

         Originating Machine: Jill-PC.contoso.com

         Service Machine: Jill-PC.contoso.com

         Provider: 'Microsoft Software Shadow Copy provider 1.0'

         Type: ClientAccessibleWriters

         Attributes: Persistent, Client-accessible, No auto release, Differential, Auto recovered

      Shadow Copy ID: {9071c059-8ac4-4a3d-983f-1e66ec7a530a}

         Original Volume: (V:)\\?\Volume{3ce0cbe3-57c2-11db-a712-806e6f6e6963}\

         Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy26

         Originating Machine: Jill-PC.contoso.com

         Service Machine: Jill-PC.contoso.com

         Provider: 'Microsoft Software Shadow Copy provider 1.0'

         Type: ClientAccessibleWriters

         Attributes: Persistent, Client-accessible, No auto release, Differential, Auto recovered

<snipped 12+ similar entries because they are very long!>

Contents of shadow copy set ID: {44a4a066-7ac2-4161-9537-dba9b6025a23}

   Contained 1 shadow copies at creation time: 10/20/2006 3:28:20 PM

      Shadow Copy ID: {449ce530-cf45-4f58-abcf-9c722dc56cec}

         Original Volume: (D:)\\?\Volume{191fc6ee-5a69-4a34-bb81-80b7b46bba04}\

         Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy44

         Originating Machine: Jill-PC.contoso.com

         Service Machine: Jill-PC.contoso.com

         Provider: 'Microsoft Software Shadow Copy provider 1.0'

         Type: DataVolumeRollback

         Attributes: Persistent, No auto release, No writers, Differential

A couple interesting things to note about the above output:

• In case you missed the note above, I cut out a lot of the output because it was so long.
• The amount of change that occurs on the volume determines how large the shadow copies are and thus how many can fit in the shadow copy storage area. We don’t show the size of individual shadow copies because they rely on each other, so the size of any one shadow copy is not meaningful.
• My system currently has two types of shadow copies, ClientAccessibleWriters and DataVolumeRollback. The ClientAccessibleWriters shadow copies (with the client-accessible attribute) are used for restore points created by File Backup, System Restore, and Complete PC Backup (on the source volume) and can be used to access previous versions of files. The literal meaning of client-accessible is that the shadow copy is visible via shares on the volume. The DataVolumeRollback shadow copy (with the No writers attribute) means this shadow copy is created by Complete PC on the backup target volume.
   

For those interested in Complete PC Backup, we are planning a “Power Users Guide to Complete PC Backup” for a later blog post. We’ll talk about sizing recommendations for shadow storage, scheduling Complete PC Backups (using the command-line tool Wbadmin), and more. Should be a good read!

 --Jill (with much input from Eduardo Laureano, Ivan Pashov, Jim Benton, Dinesh Haridas, and Dan Stevenson)