570 - System Volume Information and System Restore Points

Background

In some versions of Windows, System Restore Points are stored in the System Volume Information (SVI) folder.

System Restore Points are not supported in Windows 2008 or later, so including the SVI folder for backup will not provide Restore Point protection.

See this article for more information: http://support.microsoft.com/kb/926185?wa=wsignin1.0

Explanation

System Restore Points (SRP) are based on maintaining shadow copies of files, linked to the original files, via the Volume Shadow Copy Area (VSA). As time passes and files are modified, the data kept by each SRP will increase as it copies the originals to the VSA when they are modified.

This may sound useful and economical with disk space, but the SRP is reliant on the existence of the original files to copy data from. If a file is corrupted and lost, and the SRP does not have a copy, the system will be unable to restore this.

If your objective in backing up restore points is to give the system a rollback point, we recommend that you either back up the System State, which can be achieved with the System State plugin, or using the Bare Metal Recovery (BMR) script as per Article 571.

Running either of these options as part of a scheduled backup will give the user a series of points that the system can be rolled back to. Both the System State and BMR options rely on indpendent copies of the files being imaged as VHD volumes together with active copies from a point in time, rather than "Copies on Write" as generated in VSS by System Restore Points as changes to the files occur.

The System State and BMR backups can be used to restore regardless of the state of the original source files, and can even be used on different hardware.

Further information on System Volume Information can be found here:
http://www.howtogeek.com/125852/htg-explains-how-system-restore-works-in-windows/
http://en.wikipedia.org/wiki/System_Restore

Errors observed

Access to the System Volume Information folder is normally limited to a System process user. If access is granted and backup is attempted in some cases, the SVI will produce "skipped file" errors. In others it can result in a recursive loop that extends backup indexing and prevents the backup from completing.

As mentioned above, this is because the SVI file also contains the Volume Shadow Copy Service (VSS) files that are used as part of the "Copy on Write" behaviour of VSS. So by trying to back up files that are changed when a backup is running, this generates more files in the System Volume Information of its own changes. The end result is a feedback loop until the Volume Shadow Copy Area runs out of space.