RPV: Win7’s least-known data-protection system

Topic

New Reply

	TOP STORY RPV: Win7’s least-known data-protection system
	By Fred Langa You deleted a file yesterday; now you really need it back. Your Windows recycle bin is empty — what now? Your next-best option is the Restore Previous Versions tool — a truly great, automatic data-protection feature buried in Win7.

---

The full text of this column is posted at windowssecrets.com/top-story/RPV:-Win7s-least-known-data-protection-system/ (paid content, opens in a new window/tab).

Columnists typically cannot reply to comments here, but do incorporate the best tips into future columns.[/td]

[/tr][/tbl]

Reply | Quote

Replies

I’m reminded of the features that were available in the days of time sharing computers, (PDP-10, VAX ), and the PDP-11 and probably many others where a backup version of a changed file was automatically created . These were sitting in the same directory (folder) as the original, were readily available, and – when one was in a tidying mood could be removed with a purge command.
“Nothing new under the sun ..”
Speaking of time sharing: it’s amusing to see all the hype about the “cloud” – which is essentially the time sharing industry of the 1970’s with better communications.

Reply | Quote

Well, thanks to a good man for digging into more of Micosoft’s hidden “features”. I use quotes because often one man’s feature is another man’s bug. And, some of these bugs, ahem…”features”, often come with a new set of issues (perhaps that is why they are not documented very well by Microsoft).

In my case, I looked at the my documents folder and checked for recent versions. There were 6 recent versions, including today (16 JUN 2011), OF THE ENTIRE FOLDER – 795 files & folders, 511 megabytes in each copy! Each copy of the my documents folder contained copies of ALL files, changed AND not changed, of the earlier folder copies. So, I have my original folder plus 6 extra copies (an addition disk space “savings” of more than 3 gig; “savings” as in NOT).

If this is how the “feature” works, they can keep it. I will turn it off. This means I have folders all over the place that are being kept essentially the same way, which could mean that is where ALL my disk space is going.

And, where is all this data being kept? Again, probably HIDDEN from my view. Yup, it’s “magic”. The magic of Microsoft anyway. It is probably kept somewhere that the space shows up as 0 files and folders, 0 megabytes on disk. This means many of my files, that I put out are kept available somewhere that someone else can access but with the illusion (to me) that they are safe and secure. With friends like Microsoft using up my computer resources, who need enemies that do the same thing.

Reply | Quote

Thanks for digging into this gem and sharing with all of us. This one is going into the utility box to pull out when I want to impress my fellow geeks.

Reply | Quote

In my case, I looked at the my documents folder and checked for recent versions. There were 6 recent versions, including today (16 JUN 2011), OF THE ENTIRE FOLDER…

The Seagate FreeAgent backup drives handle this issue in a very civilized way — they push down the older versions of changed files into as many as 10 levels of “history” folders. The files are stored uncompressed and so, immediately accessible and the backup runs as fast as any disk transfer and is light on resources except on the first run-through. Well worth the price, which is under $150 for a 2 TB drive.

Reply | Quote

In my case, I looked at the my documents folder and checked for recent versions. There were 6 recent versions, including today (16 JUN 2011), OF THE ENTIRE FOLDER – 795 files & folders, 511 megabytes in each copy! Each copy of the my documents folder contained copies of ALL files, changed AND not changed, of the earlier folder copies. So, I have my original folder plus 6 extra copies (an addition disk space “savings” of more than 3 gig; “savings” as in NOT).

Actually, that’s not what’s happening. Yes, when you double-click any one of the My Documents folders in the Restore Previous Versions (RPV) dialog, Explorer will open up to the network share version of the full My Documents folder. That doesn’t mean, however, that all those folders and files that you see in Explorer are in the shadow copy that’s used by RPV, or that the space consumed by the shadow copy is the same as that used by My Documents.

On my system, My Documents is on a dedicated partition and is currently about 12GB, while the space used by the System Protection function for that partition is only 1.6GB (and remember, that’s multiple shadow copies, or versions). That’s not the whole story, though–since I moved all my user files (AppData, etc.) to the data partition, that 1.6GB represents the shadow copies of My Documents plus the rest of my user data. That’s not much space to give up for a lot of data backup capability (via RPV).

Reply | Quote

An Excellent Article Fred!

I’d seen the ‘Restore Previous Versions’ command but had no idea exactly what it did. This was especially so, as when ever I tried to go into the Retore Previous Versions ‘System’, all I would see is that there are no previous versions available. Your article helped to clear up why that was happening on my system. I’ve partitioned my HDD into separate OS (System) Drive and Data Drive, and then thinking that System Retore was only needed on the OS Drive I had disabled it on the Data Drive! Hence no Previous Versions were being created on the Data Drive, and so nothing would show up in the Restore Previous Versions dialog box.

After reading your article, in which you explained the link between System Restore Points and the Previous Versions of documents, I’ve re-enabled System Restore on the Data Drive. Then created a manual Restore Point and low and behold there is now a Previous Version of the My Documents Folder on the Data Drive.:)

Thanks for explaining about this very useful, but hidden system!

Jonathan.

Reply | Quote

By Donovan Colbert
June 15, 2011, 1:11 PM PDT

Takeaway: On the heels of other disturbing stories about Google and privacy and security issues, blogger Donovan Colbert discovered another problem with info that his Android device shares with Google.

After waiting in disappointment after missing the original rush for the ASUS Eee PC Transformer Android-based tablet, last night I finally got my hands on it and the keyboard dock that converts the device into an Android netbook. My iPad and my Lenovo S10 are both quaking in fear right now, and they probably should be. I’m still learning about this device, and actually I’m writing this document on the Eee Pad using the bundled Polaris Office application – so this article won’t be a review of my experience with the device. Instead, this will be about an interesting thing I discovered about Android OS that increases my growing concern and discontent with this new era of personal digital devices and the companies that sit behind their emerging place in our lives.

I purchased the machine late last night after work. I brought it home, set it up to charge overnight, and went to bed. This morning when I woke I put it in my bag and brought it to the office with me. I set up my Google account on the device, and then realized I had no network connection. My first response was to connect to our corporate public network connection – but we just moved offices and I did not know the WPA2 key off the top of my head. Instead, I pulled out my Virgin Mobile Mi-Fi 2200 personal hotspot and turned it on. I searched around Honeycomb looking for the control panel to select the hotspot and enter the encryption key. To my surprise, I found that the Eee Pad had already found the Virgin hotspot, and successfully attached to it. I literally questioned myself, wondering if I had simply already attached to the hotspot from the Eee Pad and forgotten about it. But that was not the case.
Vendor HotSpot
Go from Zero to Savings in less than 90 days with ProfitLine Managed Mobility Solutions

Learn how to deal with the influx of smart devices, while maintaining control and optimizing costs.
Learn More »

As I looked further into this puzzling situation, I noticed that not only was my Virgin Hotspot discovered and attached, but a list of other hotspots, including the hotspot at my campground (a 45-minute drive away) were also listed in the Eee Pad’s hotspot list. The only conclusion that one can draw from this is obvious – Google is storing not only a list of what hotspots you have visited, but any private encryption keys necessary to connect to those hotspots in the cloud.

Beyond the obvious personal privacy issues this raises, there are other concerns that might not be as readily apparent. One might argue that if you use an Android product and Google services, you implicitly consent to this “feature” of the Android OS platform. But many of the Wi-Fi access points we access are not our own, and frequently there are specific terms of service associated with these APs; generally, that we will not disclose the encryption keys for these APs to third parties. This is a reasonable and obvious security policy, but clearly Google doesn’t care about the ToS policies on shared public hotspots protected by encryption.

As far as I can tell, there is no clear and easy way for Android end-users to “opt out” of sending their access points to Google for storage on the cloud and synchronization to other Android devices the user may own. If this is the case, Google gives the Android device user two choices: do not access public encrypted wireless access points or violate their terms of service by sharing those access keys with Google. The obvious response that I would expect third party public encrypted hotspot owners to adopt is to specifically prohibit subscribers from accessing those APs via Android devices. As noted, my corporate office has a public, protected wireless access point. The idea that every Android device that connects with that access point shares our private corporate access key with Google is pretty unacceptable. The frustrating thing is that this isn’t just something I would have to make a policy for visitors, but even our own employees with Android devices should be prohibited from accessing our public Wi-Fi AP. Unfortunately, this includes me.

In a recent blog for TRoL I suggested that our future under the corporate rule of Facebook, Google, and Apple might make the darkest days of the Microsoft Empire look pretty benevolent and progressive — as more and more information like this is exposed about how Google and Facebook regard personal privacy issues. I think it illustrates that my concern is relatively well founded. This isn’t just a trivial concern. The fact that my company can easily lose control of their own proprietary WPA2 encryption keys just by allowing a user with an Android device to use our wireless network is significant. It illustrates a basic lack of understanding on the ethics of dealing with sensitive corporate and personal data on the behalf of the engineers, programmers and leadership at Google. Honestly, if there is any data that shouldn’t be harvested, stored and synched automatically between devices, it is encryption keys, passcodes and passwords. It makes you wonder what other information Google might be harvesting and storing to “add value” to your “Google Experience”.

Because — make no mistake about it, that is the spin that Google would put on this “feature”. And, it is convenient – especially for the consumer who doesn’t know better and would willingly sacrifice their personal privacy for a little convenience that makes them have to think less about their personal technology. That is the thing that I may be the most troubled by. I’d argue that many of the biggest abuses that Redmond was guilty of in cutting corners were achieved with the complicit assistance of the consumers. They willingly traded in reliability and security for convenience. It seems that Google was paying attention to Redmond’s playbook in this regard. I doubt many consumers will see the problem with the implications of what is going on here – but it is clear to me, and I’m certain that I don’t like it.

What do you think? Is this an innocent, excusable mistake? Is Google a company that only has the best interests of the consumers at heart? Are we making too much out of this, or has Google crossed the boundaries of reasonable behavior? If anyone can confirm or refute the results I’ve encountered here, I am also interested in hearing your experiences.

For the record, my experience as described was with an Acer Eee Pad Transformer I purchased last night. I haven’t confirmed the experience and never noted it before on any of my other Android devices. Is this a Honeycomb “feature”? An Eee Pad feature? If anyone has any additional information, feel free to contribute to the discussion in the forum.

Reply | Quote

Might be useful to explain one reason there might be no “previous versions” listed is Administrative Shares have been disabled.

Reply | Quote

Thanks for the insight Fred… great catch…but… is this protection given ONLY to what’s in the Documents (My Documents) folder?
Many clients have data files outside the Microsoft pre-defined Documents path, and looks like this feature will not cover, neither can be configured to cover, any other folders like lets say: C:/Intuit/ .
thanks.

Reply | Quote

Fred, thanks as always for your great info. A questions regarding System Image. When you use the Backup & Restore and accept the Let Windows Chose function it creates a System Image. Does it only create a System Image at that time or does it recreate a new System Image at each Backup Time? My concern would be that if it creates a new System Image and that System Image was somehow corrupted, say by a virus, and is saved then the System Image is also corrupted.

Reply | Quote

I think that the “previous versions” feature may be related to a problem I have been experiencing. Versions of Windows up through Vista would recognize any device at any drive letter. I could remove one drive and later use another at the same drive letter. But if I remove an external drive, and then plug in another, Windows 7 informs me that there is a problem, offers to scan the drive — then tells me that I must format the drive before I can use it. I declined this very disheartening, misleading and potentially destructive request, thank you, and found that the drive worked perfectly on another computer or on the same dual-boot computer in Ubuntu Linux.

The computer also now no longer recognizes memory chips plugged into its card slots.

I may have helped bring on the problem by reassigning drive letters for the card slots.

This is only happening on one of the two computers on which I have Windows 7 installed. This one has Windows 7 Home Premium and has a multiplicity of USB ports. The other is a netbook with Windows 7 Starter and 3 USB ports.

Any comments or ways to resolve this issue would be most appreciated.

Reply | Quote

In The Missing Manual: Windows 7, this is called Shadow Copy. Shadow Copy has existed in previous versions.

In the options for a restore point, one can select all system settings and files, files only, or none. I cannot select system settings only. I think the feature of backing up some user files during setting a restore point, may be of questionable value, only taking up more disk space than what was understood to be happening. If one could selectively designate some subset of files and where to put them, there may be some merit but the essential all or none selection limits the usefulness of the “feature”.

Reply | Quote

Good story and gives me some ideas and at least one topic for next week’s class.

A note on trying to duplicate the previous file demonstration.

I used open office calc and a test spreadsheet. I saved the file, created a restore point, deleted the file and cleaned the recycle bin, found the file in “previous files”, but the file would not open the OO Calc nor display the test spreadsheet. I tried again. No luck. I tried with OO Write with no luck in opening the file with OO Write. The file would open using WordPad. I tried a text message using NotePad. It worked.

Have you tested this with non microsoft products? Maybe I have a rogue machine?

Reply | Quote

In The Missing Manual: Windows 7, this is called Shadow Copy. Shadow Copy has existed in previous versions.

In the options for a restore point, one can select all system settings and files, files only, or none. I cannot select system settings only. I think the feature of backing up some user files during setting a restore point, may be of questionable value, only taking up more disk space than what was understood to be happening. If one could selectively designate some subset of files and where to put them, there may be some merit but the essential all or none selection limits the usefulness of the “feature”.

Again, this IMO is an argument for using a dedicated data partition (per my post on this, two posts above). Having that setup would give you exactly the control over the situation that you say you want, and would do so with minimal cost to you in disk space (per my previous post).

Of course, you don’t have to have System Protection turned on at all, now that you know the implications of doing so (and again, I agree that Microsoft should have explicitly explained those implications to us either at install or on first use). You would, however, have to be willing to live without System Restore.

Reply | Quote

I think that the “previous versions” feature may be related to a problem I have been experiencing. Versions of Windows up through Vista would recognize any device at any drive letter. I could remove one drive and later use another at the same drive letter. But if I remove an external drive, and then plug in another, Windows 7 informs me that there is a problem, offers to scan the drive — then tells me that I must format the drive before I can use it.

Sorry to disappoint you, but it’s highly unlikely that your issues are related to the mechanism Windows 7 uses for Previous Versions (Volume Shadow Copy; this function is also the basis for System Restore and disk imaging).

Given that I swap external hard drives all the time (and also use the SD card slot in my card reader) without having the problems you’ve related, I’d guess that you’ve got either a corrupted system file or a BIOS issue. Both would be off-topic for this discussion.

I’d suggest that you start a new forum topic to request help for your problems.

Reply | Quote

When you use the Backup & Restore and accept the Let Windows Chose function it creates a System Image. Does it only create a System Image at that time or does it recreate a new System Image at each Backup Time? My concern would be that if it creates a new System Image and that System Image was somehow corrupted, say by a virus, and is saved then the System Image is also corrupted.

Yes, it saves a new system image each time the Backup job is run.

This is one reason why I recommend using the “Let me choose” option and not selecting the system image option.

Another reason I don’t recommend making a system image with each backup is that Windows 7 limits the amount of space that can be used for storing system images; when that space limit is reached, it deletes the oldest image(s) to make room for the next new one. Depending on how often your Backup job runs (and it really should be at least weekly, if not daily), you’ll be cycling through your system images so fast that you may not have an older, stable image when you need it.

Note, too, that if you store your backups on your system drive (though that’s a really bad idea), the reserved space for system images is also what’s used by System Restore. Consequently, saving a system image with each backup will reduce then number of saved system restore points (perhaps pretty drastically).

All told, you’re much better off making a new system image only when you really need to (such as after a Windows service pack install or after installing a new application).

Reply | Quote

…is this protection given ONLY to what’s in the Documents (My Documents) folder?

Recover Previous Versions is available (at least, in theory; YMMV) on any logical drive that has System Protection enabled (see the System Protection tab of the System Properties control panel).

By default, Windows 7 protects only the system drive (that’s usually the C: drive).

In order to have System Protection enabled on any other logical drives, you’ll need to select that drive in the Protection Settings list (on the System Protection tab of the System Properties control panel) and then click . For non-system drives, all you need to do is select the “Only restore previous versions of files.”

While you’re on the System Protection dialog, note that it’s also possible to adjust the amount of disk space that’s given to storing the image files that contain the previous versions. By default, Windows 7 sets the maximum to 15% of the total logical drive space. I would never recommend decreasing that value (mainly because there are additional implications of doing so that are beyond the scope of our current discussion), but if you’re setting up System Protection for a data drive, and have lots of free space available, increasing the “Disk Space Usage” value will allow you to retain additional previous versions of your data files (again, if Restore Previous Versions is otherwise working for you already).

Reply | Quote

I think this does present possible security concerns for people unaware of it. Why? Say you’ve “shredded” (securely wiped) what you think is the only instance of a document, only to find out that there may be several backups of these documents still “living” elsewhere? Perhaps a utility that will seek out these backups when someone goes to securely delete a given document might be handy, or at least some kind of notification that such backups might exist.

This in no way, however, diminishes my appreciation for learning of this feature. I still see far more upside potential than negative. Nice job, Fred.

Edit: Yes, I do know that apps like Word might be creating their own backups of documents that one might need to be aware of, too.

Reply | Quote

Is it safe to asume that if one has system restore disabled, previous versions will also be?

Reply | Quote

Is it safe to asume that if one has system restore disabled, previous versions will also be?

Hi CLiNT,

If System Protection is disabled, then there will be no restore points or previous versions. However, when you highlight a specific hard disk under Protection Settings on the System Protection tab page, and click Configure, there are two other options besides Turn off system protection. The other two are Restore system settings and previous versions of files, and Only restore previous versions of files. So you can enable only previous versions as long as System Protection is not disabled.

Check out this MS Previous Versions FAQ.

Reply | Quote

Is it safe to asume that if one has system restore disabled, previous versions will also be?

If by disabling System Restore you mean disabling System Protection for the logical hard drive in question via the System Properties control panel, then the answer is “yes.”

Reply | Quote

To Fred Langa

Hello Fred, The latest newsletter states ‘Introduced in Vista and now present in all editions of Windows 7, previous versions are local backups of every data file and folder that changes on your system.’ How do I access this feature in Vista? Thank you, George

Reply | Quote

Fred, thank you from the bottom of my heart! About a week ago, my encrypted password database file containing over 125 web site passwords somehow got corrupted. Yes, I do backups, but we had just delivered our backup hard drive to my mother’s house (a 2.5 hour drive) for safe-keeping, and I had neglected to re-backup my passwords file to the 2nd external drive in our home in the past week or so. So, I had only a very old version available (from 2010!), and I spent quite awhile on various websites re-setting my most critical passwords.

After reading this article, I was able to pull a version of the file from June 3, and although I had reset about 10 passwords since the crash, there were many, many more in this file than what I had to work with. I was able to grab the older version of the file and merge the two in about 10 minutes. Back in business! I’ve now backed it up in three places!

I consider myself a fairly knowledgeable user but did not know about this Win7 capability. I’m indebted! :clapping:

Reply | Quote

Fred, thank you from the bottom of my heart! About a week ago, my encrypted password database file containing over 125 web site passwords somehow got corrupted. Yes, I do backups, but we had just delivered our backup hard drive to my mother’s house (a 2.5 hour drive) for safe-keeping, and I had neglected to re-backup my passwords file to the 2nd external drive in our home in the past week or so. So, I had only a very old version available (from 2010!), and I spent quite awhile on various websites re-setting my most critical passwords.

After reading this article, I was able to pull a version of the file from June 3, and although I had reset about 10 passwords since the crash, there were many, many more in this file than what I had to work with. I was able to grab the older version of the file and merge the two in about 10 minutes. Back in business! I’ve now backed it up in three places!

I consider myself a fairly knowledgeable user but did not know about this Win7 capability. I’m indebted! :clapping:

This sounds like a security breach waiting to happen. What if someone else can recover the same files? Are they still protected by the same level of encryption as the original? I somehow doubt it. Makes me wonder about the whole saved passwords utilities products industry.

-- rc primak

Reply | Quote

The only problem I have is that the previous versions are not shown and settings are correct as far as I can see. I am using Win 7 H.P. Michael

Reply | Quote

The only problem I have is that the previous versions are not shown and settings are correct as far as I can see. I am using Win 7 H.P. Michael

Check this MS Previous Versions FAQ to see if it sheds some light on the issue. Particularly look under the section titled Why can’t I find previous versions of some files?

Reply | Quote

I had seen the “previous versions” mentioned in the System Properties control panel’s System Protection tab (under Configure…), but hadn’t had time to chase down what that was all about–thanks, Fred, for the primer.

One note that Fred left out: Only the virtual drive that contains Windows has System Protection automatically enabled (per the Windows 7 help file on the topic). If you have a separate drive (logical or physical) for your data, you’ll need to enable System Protection for that drive in order to recover previous versions of files.

Reply | Quote

After reading Fred’s article, I decided to give Restore Previous Versions a whirl:

[*]I enabled System Protection on my data drive.
[*]I manually created a restore point.
[*]I modified an existing file on my data drive.
[*]I manually created a second restore point.
[*]I right-clicked the test file in Explorer and selected “Restore previous versions.”

To my dismay, the Previous Versions tab (of the file Properties dialog) showed “There are no previous versions available.”

Just to be sure that I hadn’t goofed something up, I repeated steps 3-5, but got the same result.

Wondering if there was some time-lag issue from just having enabled System Protection on D:, I decided to do a test on C: (where System Protection has been enabled since day 1 of my current Windows installation). To keep things simple, I navigated to the C:WindowsTemp folder and deleted the PDF files there. After manually creating a restore point, I checked the Properties of C:WindowsTemp. According to both Fred and the Windows 7 help file, what I should have seen in the Previous Versions tab was a list of the PDFs I’d just deleted, but instead all I saw was “There are no previous versions available.”

To double-check that my manually-created restore points really were created, I opened
System Restore and selected “Choose a different restore point.” After clicking , I saw all of my test restore points listed.

I’m stumped as to why Previous Versions doesn’t seem to be working for me. Anyone got any ideas?

Reply | Quote

Check this MS Previous Versions FAQ to see if it sheds some light on the issue. Particularly look under the section titled Why can’t I find previous versions of some files?

Nothing listed in the FAQ helped me–I’ve already looked at all of those issues without fixing the problem.

Anyone else have another idea?

Reply | Quote

To Fred Langa

Hello Fred, The latest newsletter states ‘Introduced in Vista and now present in all editions of Windows 7, previous versions are local backups of every data file and folder that changes on your system.’ How do I access this feature in Vista? Thank you, George

Check out this VistaForums tutorial on How to Restore Previous Versions of a File and Folder in Vista. However, in Vista the feature is only available in the Business, Ultimate and Enterprise editions.

Reply | Quote

Fred, Great article. An interesting point: I run Win 7 under VMware on a Macbook Pro, with store files on the Mac enabled. To accomplish this, VMware creates a Z: drive with a network link to the Mac file system. When I look at My Documents under Windows Explorer the files are there, however to use RPV, I have to select C:/Users/MyID/ Documents. Documents is basically empty.

I’m not concerned since I keep my own backups, but you might want to add the caveat that RPV doesn’t work under the scenario described above.

By the way on my other machine, a Windows VIsta PC everything works fine.

Keep the good articles coming, I’ve been a fan since your early news letters.

Reply | Quote

I run Win 7 under VMware on a Macbook Pro, with store files on the Mac enabled. To accomplish this, VMware creates a Z: drive with a network link to the Mac file system. When I look at My Documents under Windows Explorer the files are there, however to use RPV, I have to select C:/Users/MyID/ Documents. Documents is basically empty.

I’d speculate that what’s happening is that Windows’ Volume Shadow Copy (VSC) service doesn’t work on non-system drives when Windows is run in a virtual space (with the data files existing out in “the real world”).

You could test this by opening the the System Protection tab of the System Properties control panel and looking for your data drive in the “Protection Settings” list. If it’s not there, then that’s the answer. If your data drive is there, try turning on System Protection for that drive and then looking for previous file versions (after setting an initial restore point, making changes, then setting a second restore point).

Just out of curiosity, does System Restore work when Windows is run in a virtual machine? If not, it may be that VSC doesn’t work at all in this scenario.

Reply | Quote

Interesting column. I have Windows 7 Ultimate on my machine. When I right click on any folder, such as My Documents, and choose Restore Previous Version, it always comes up with a message there are no previous versions to restore. I have checked that System Protection is enabled on my machine and that the radio button Restore Points and Restore previous files is checked. Also, this feature is enabled for Drive C.

Reply | Quote

Interesting column. I have Windows 7 Ultimate on my machine. When I right click on any folder, such as My Documents, and choose Restore Previous Version, it always comes up with a message there are no previous versions to restore. I have checked that System Protection is enabled on my machine and that the radio button Restore Points and Restore previous files is checked. Also, this feature is enabled for Drive C.

Just to be clear: Is your data (My Documents) on the C: drive?

If not, then you’ll need to enable System Protection for your data drive. System Protection can be enabled only for individual logical drives, not (in one step) for physical drives with multiple partitions or for full systems with multiple drives.

If your data is on C:, then perhaps you’re having the same problem that I am–hopefully, someone will help us with a solution.

Reply | Quote

Hi bethel95,

I tried something very similar to the second part of your original post.

1) Create folder c:test
2) Within this folder create a blank xls file & a blank ppt file
3) Create a restore point
4) Delete the xls file (no recycle bin, straight delete)
5) Open restore previous versions for the folder c:test and the xls file is there

This would also appear to answer jvismaras question as to whether the restore functionality is restricted to the documents folder.

Reply | Quote

So the files that I shred to keep from prying eyes still exist in multiple locations? Thank you for exposing another of Microsoft’s “features”. Multiple redundency via “Restore Previous Versions” may be fine for providing another level of back-up, but is disheartening in the grand scheme of privacy and security.

Reply | Quote

I’m happy to report that some digging around on the ‘net has uncovered a solution (or solutions–I’m not sure which) that have enabled Restore Previous Versions (RPV) on my system. I’m going to try to lay this out for everyone, but realize that since I tried a number of suggested solutions, my summary may not represent the shortest path.

First, my relevant system specs (in case yours are different and this doesn’t work, we may have a clue why):

[*]Windows 7 Pro x64 SP1 with all recommended patches installed (per Patch Watch)
[*]File and printer sharing on (which may be important)
[*]HomeGroup connections off (which may be important); I.e., set to “Use user accounts and passwords…”

The key seems to be that network shares (aka disk shares) must be enabled for RPV to work.

Here’s my best guess at the simplest troubleshooting and resolution process:

[*]Open the Computer Management control panel; expand System ToolsShared Folders and select Shares.
[*]You should see something like this, where all of your logical drives are present in the center-panel list with the “$” behind them:
28213-Capture-1
If you already see that “shares” exist for all of your logical drives: You can try going to the Network & Sharing control panel, selecting “Change advanced sharing settings,” and verifying that “File and printer sharing” is on and “HomeGroup connections” is set to “Use user accounts…” (assuming that you’re willing to live with those settings). After making any necessary changes, restart Windows, cross your fingers, and retry Restore Previous Versions from any logical drive that has System Protection enabled.
If you already had those settings in place, skip to step 7.
Otherwise, continue with step 3.
[*]Go to the Microsoft Support article “Overview of problems that may occur when administrative shares are missing“.
Note: This article has a lot of scary things to say about possible malware infections; don’t necessary assume that this is your problem. If following all the remaining steps in thie procedure doesn’t restore your disk shares, however, you may want to consider this possibility and follow the recommended actions for detecting and removing malware infections.
[*]Scroll down to the “Resolution” section.
[*]Under “To verify whether a computer is affected by this issue…,” follow steps 1 and 2.
[*]After rebooting, restart the Computer Management control panel; expand System ToolsShared Folders and select Shares.
If your disk shares now exist, retry Restore Previous Versions from any logical drive that has System Protection enabled.
If your disk shares still don’t exist, or if they do, but RPV still doesn’t work, continue with step 7 of this procedure.
[*]Disclaimer: I cannot vouch for the helpfulness of this step (but I did it, so it may help you).
Go to the blog article “Administrative Shares In Windows 7” and complete the second procedure (just below the :D; what he confusingly calls “step 2”) and restart Windows; note that you’ve already done everything else that he recommends.

Hopefully, if you’ve gotten this far, RPV is now working for you.

Why shares were turned off on my system to begin with is beyond me. Perhaps some other third-party utility that I’ve installed turned them off (I’ll be looking for a consequential malfunction) or else a decision I made during the initial Windows 7 install is at fault (I did my own clean install on a bare drive). I’m sure that malware wasn’t at the root of the missing shares on my system, as the significant behavior in that instance would be that shares wouldn’t automatically turn on on system start-up, even after making the above changes (and that, as a former IT manager, I practice the system and network security philosophy of “it’s not paranoia if they really are out to get you”).

Reply | Quote

So the files that I shred to keep from prying eyes still exist in multiple locations? Thank you for exposing another of Microsoft’s “features”. Multiple redundency via “Restore Previous Versions” may be fine for providing another level of back-up, but is disheartening in the grand scheme of privacy and security.

Agree that MS should have told us about this. At the very least, is should be an installation option, with the security implications clearly explained (or on pre-installed systems, a “first run” option with explanation).

This is now, for me, another very good reason to put user data in a separate partition (or disk) from the system files. Why? So that I can have System Protection turned on for my system partition (so that System Restore and system image creation both work) and so that I can choose whether to separately turn on System Protection for my data partition (yes, if I want Previous Versions to work, and can deal with the issues if I need to shred files; no, if I don’t care about Previous Versions and need to frequently shred files).

Now that you know, you can decide whether to take the step of having a separate data partition, and enable System Protection appropriately. It would seem to me, however, that keeping the system and data files on the same partition and disabling System Protection on that partition would be the worst of all worlds–you not only don’t have Previous Files, you would also lose System Restore.

Reply | Quote

One other thing that came to my attention while I was researching network shares (see my previous post) was the Microsoft Baseline Security Analyzer. It does some nifty things (verifying that shares are enabled being one of them), so I’m bringing it to your attention as a potential addition to your admin tool box.

Reply | Quote

For those of you who wish to delete any shadow copies that contain versions of files you’ve shredded, here’s a helpful explanation of how to do it.

Reply | Quote

If you do a Service Pack Upgrade, you will lose all your Restore Points. You will also lose all your Previous Versions data. Remember this, and back up your data and your system before applying a Service Pack. Also, if you restore from an archive, you will lose Restore Points and Previous Versions, or else the PVs will be reverted to an older condition. In either case, don’t count on PVs or System Restore Points after a restore operation.

-- rc primak

Reply | Quote

You can also access the full restore point (Volume shadow copy snapshot) which not only allows previous versions of files/folders but also allows copying the snapshot of any files that are open and cannot otherwise be copied. See this article on MSDN, written for Vista but works on 7 and servers 2003 and 2008. http://blogs.msdn.com/b/adioltean/archive/2008/02/28/a-simple-way-to-access-shadow-copies-in-vista.aspx

Reply | Quote

You can also access the full restore point (Volume shadow copy snapshot) which not only allows previous versions of files/folders but also allows copying the snapshot of any files that are open and cannot otherwise be copied. See this article on MSDN, written for Vista but works on 7 and servers 2003 and 2008. http://blogs.msdn.com/b/adioltean/archive/2008/02/28/a-simple-way-to-access-shadow-copies-in-vista.aspx

Unless I’m misunderstanding the point of the MSDN article, it looks to me like it’s describing a manual way of accomplishing the same thing that the free utility ShadowExplorer does automatically (and with a user-friendly interface).

Reply | Quote

I was very excited at this article. But on looking into it, I have no previous versions on my PC. Everything seems to be set up right … System Restore runs nightly at midnight and on reboot (at least that’s how it’s set in Task Scheduler), I’m doing nightly Windows backups to an external drive … yet the restore points on my computer look like this:
6/29/11 3:00 am Windows Critical Update
4/7/11 8:30 pm System Image Restore Point
3/23/2010 10:00 pm System Image Restore Point
Then the same thing on the four previous nights.
Nothing in between these dates … nothing for more than a year, and the last one before this morning was 2½ months ago.

What’s wrong?

Reply | Quote

I was very excited at this article. But on looking into it, I have no previous versions on my PC.
…
What’s wrong?

Perhaps you have the same problem I had. See my post “Previous Versions are now working!” earlier in this thread (post #34).

Reply | Quote

When I delete something, I want it deleted! How do I turn this “feature” off without turning off System Restore? It’s like a recycle bin for the recycle bin. Who really needs it, or wants it?

Reply | Quote

When I delete something, I want it deleted! How do I turn this “feature” off without turning off System Restore? It’s like a recycle bin for the recycle bin. Who really needs it, or wants it?

The challenge is that disabling the Previous Versions feature does not, by itself, accomplish what you want, if you have your data files in the same logical partition (usually the C: partition) as your system files. Even though System Restore only affects system files (not data files), the “shadow copy” that is the basis for system restore points is an image of the entire partition. As such, as long as your data files are stored in the system partition, any tool that can open shadow copies (such as ShadowExplorer) can be used to explore and recover files from the existing shadow copies that were created prior to your file deletion (one for each existing restore point prior to your file deletion).

The only way that I know of to absolutely ensure that there’s no copy of a deleted file stored anywhere in a Windows shadow copy while maintaining System Restore is to do the following:

[*]Move your data files to a different partition than your system files:
– Create the new partition.
This could either be a new partition on the same hard drive as C: or on a different drive entirely.
– Right-click “My Documents,” select Properties, select the “Location” tab.
– Enter the new location for your documents folder (such as D:Documents) and click on .
,
[*]Reset System Protection on your C: partition (first turn it off, then turn it back on; see the System Protection option on the System control panel).
This should delete any existing shadow copies. Note, too, that it will also remove all existing system restore points; after turning System Protection back on for the system partition, new system restore points can be made.


[*]Delete any existing “system image” backups that you’ve made that you think may contain the data file(s) in question.
Existing system image backups would also include any data files (as they existed when still on the C: partition) at the time the backup was created.

After doing this, no shadow copies that include your data files should exist, and no future shadow copies of your data will be made (as long as you don’t enable System Protection on your new data partition).

Reply | Quote

The challenge is that disabling the Previous Versions feature does not, by itself, accomplish what you want, if you have your data files in the same logical partition (usually the C: partition) as your system files. Even though System Restore only affects system files (not data files), the “shadow copy” that is the basis for system restore points is an image of the entire partition. As such, as long as your data files are stored in the system partition, any tool that can open shadow copies (such as ShadowExplorer) can be used to explore and recover files from the existing shadow copies that were created prior to your file deletion (one for each existing restore point prior to your file deletion).

The only way that I know of to absolutely ensure that there’s no copy of a deleted file stored anywhere in a Windows shadow copy while maintaining System Restore is to do the following:

[*]Move your data files to a different partition than your system files:
– Create the new partition.
This could either be a new partition on the same hard drive as C: or on a different drive entirely.
– Right-click “My Documents,” select Properties, select the “Location” tab.
– Enter the new location for your documents folder (such as D:Documents) and click on .
,
[*]Reset System Protection on your C: partition (first turn it off, then turn it back on; see the System Protection option on the System control panel).
This should delete any existing shadow copies. Note, too, that it will also remove all existing system restore points; after turning System Protection back on for the system partition, new system restore points can be made.


[*]Delete any existing “system image” backups that you’ve made that you think may contain the data file(s) in question.
Existing system image backups would also include any data files (as they existed when still on the C: partition) at the time the backup was created.

After doing this, no shadow copies that include your data files should exist, and no future shadow copies of your data will be made (as long as you don’t enable System Protection on your new data partition).

How can a shadow copy be an image of the entire partition without occupying as much, or some substantial portion (assuming compression), space as the partition itself, or at least the data contained in it?

Reply | Quote

How can a shadow copy be an image of the entire partition without occupying as much, or some substantial portion (assuming compression), space as the partition itself, or at least the data contained in it?

Shadow copies are highly compressed, but are still rather large. There may be more to the shadow copy technology than just compression, but I’ve not found any more info on the subject than that.

FYI, Windows 7 allocates 15% of disk space (by default) for any disk with data protection enabled (this means system restore and/or previous versions). Whether that’s a hard allocation (i.e., makes that space unavailable for data storage) or whether stored data can squeeze out room for shadow copies (reducing the number that are retained), I have been unable to determine, as yet.

Reply | Quote