none
Following system restore point after creation until its deletion RRS feed

  • Question

  • Which log allows you to view when the deletion of a system restore point?

    For example system restore points may disappear sooner than expected.

    The end user wants to investigate what triggered the deletion.

    Monday, January 6, 2020 8:15 PM

All replies

  • You can see all available restore points in Control Panel / Recovery / Open System Restore

    Physically, the system restore point files are located in the root directory of your system drive (as a rule, it is C:), in the folder System Volume Information. However, by default users don’t have access to this folder. To go to this directory, you should first make it visible, and then get special rights.

    To do it:

    Open Control Panel / Recovery / File Explorer Options / Folder Views.

    Uncheck the box next to «Hide protected operating system files» and click Apply. As you do it, the folder System Volume Information will appear in the root directory of disk C:, but access will be denied.

    To get access to the folder System Volume Information do the following:

    Right-click on the folder and select Properties / Security / Advanced.

    Click Continue to get access permission to Windows system folder which contains system restore point files.

    Click Add and enter the name of the user which should be granted access rights. Click OK.

    Check the box in Basic permissions next to «Full control» and click OK.


    S.Sengupta,Microsoft MVP Windows and Devices for IT, Windows Insider MVP

    Tuesday, January 7, 2020 1:57 AM
  • Hi,

    If the system restore point disappear sooner, I suspect it would got any corruption during create a system restore point or have an configured task to delete the restore point, if not it will not disappear sooner.

    We could check the event viewer\Windows log\system for more related information about deleting action. 

    We could audit the system volume information folder by right click it and choose "Properties\Security\Advanced\Auditing" after we take owner of this folder.

    Bests, 


    Please remember to mark the replies as answers if they help. If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Tuesday, January 7, 2020 2:19 AM
    Moderator
  • Not able to follow the access method.

    1) When viewing control panel > recovery > advanced recovery tools what are the next steps to get access to the applicable folder(s)?  create a recovery drive, open system restore, configure system restore


    If file explorer is opened then view is clicked the hidden items box is checked.

    Please list the step by step to get access to system volume information  (currently displaying location is not available > access is denied

    There was no corruption reported in this thread:

    https://www.tenforums.com/backup-restore/146930-restore-points-being-deleted.html

    So looking for methods to track system restore points after they have been created.

    2) Which log file and which entry would display the early deletion?

    3) Where would you look for the cause of the early deletion?


    Tuesday, January 7, 2020 7:01 AM
  • Hi, 

    Go to  control panel > recovery > advanced recovery tools > configure system restore to configure details settings about system restore folder.
    As we are not provide log analysis, if you want to know more information about monitor log about system restore point folder, please create a ticket with the link below.
    https://support.microsoft.com/en-us/supportforbusiness/productselection

    Bests,


    Please remember to mark the replies as answers if they help. If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Monday, January 13, 2020 9:44 AM
    Moderator
  • Please post another method to view system volume information as I could not follow the earlier post.
    Monday, January 13, 2020 9:55 AM
  • Hi,

    What's the detail error when you follow the earlier suggestion?

    Bests,


    Please remember to mark the replies as answers if they help. If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Tuesday, January 14, 2020 2:26 AM
    Moderator