On Tue, 26 Dec 2017 23:21:43 +0000, "J. P. Gilliver (John)"
wrote:

In message , Shadow
writes:
On Tue, 26 Dec 2017 17:57:04 +0000, "J. P. Gilliver (John)"
wrote:

In message , Paul
writes:
[]
On WinXP, files outside your "My Documents" tree
are tracked. Say you normally keep Firefox downloads
[]
Restore Point. Files kept in the "officially blessed"
parts of C: are unaffected, so nothing in My Documents
gets added or subtracted to match the way it was
three days ago.

Paul

Are you saying _everything_ else - or maybe everything else on C: - gets
tracked, and potentially restored (synced)? This must make for a huge
tracking area (if for example you [or the system] delete a few feature
films).

They have another record in the NTFS stream and also various
in the registry. Long after you deleted the original files. Yes, it's
there for forensic purposes. What else ?
[]'s
I wasn't in tinfoil-hat mode - just more surprised at the storage
involved. From what is said above, if you deleted a few feature films,
then unless you were storing them in an "officially blessed" area,
invoking a Restore Point would magically restore them; I was just
thinking that, if true, this implies a backup storage area as big as
your disc (or maybe half as big), which seems unlikely,

System Restore does not restore all of the data, only the internals of
Windows necessary to make it run. An image is just that, a bit copy of
the drive. Images are very big, essentially the same size as all of
the data on the drive, minus whatever compression they may do. Hence
trying to make C: as small as you can. (like not storing media files
there). You can easily back up and restore "data" simply using COPY or
drag and drop. Getting a working version of a post W/98 windows system
is more complicated. XCOPY worked OK to copy a W/98 machine with the
right switches.