System Restore quietly reserves a slice of your drive

System Restore is one of the better things Windows does and one of the least visible. It takes snapshots before updates and driver installs, stores them as shadow copies, and reserves a share of the drive to hold them. Nothing in Explorer shows any of it.

Seeing the actual numbers

vssadmin list shadowstorage

Run that in an administrator Command Prompt. It reports three figures per drive: used, allocated and maximum. The maximum is the cap, usually a percentage of the drive set when the feature was enabled, and it is the number that explains where the space went.

vssadmin list shadows

That lists the individual restore points with their dates, which tells you whether the space is holding one useful recent point or fifteen from a year of updates.

Capping it rather than turning it off

The useful change is almost never to disable System Restore. It is to cap it, which keeps the safety net and bounds the cost:

1. Open System Properties, System Protection.
2. Select the drive and click Configure.
3. Move Max Usage to something deliberate. Five to ten percent is usually plenty.
4. Apply. Windows discards the oldest points to fit the new cap.

Turning protection off entirely deletes every restore point immediately and stops new ones being made, which is worth it only on a machine you image separately.

Deleting points selectively

vssadmin delete shadows /for=C: /oldest

That removes the oldest restore point, and can be repeated. Disk Cleanup's More Options tab has a blunter version that removes all but the most recent, which is the right tool when the drive is full right now.

Why the numbers rarely match

Shadow copies store differences rather than whole copies, so the space used grows with how much has changed rather than with how many points exist. A machine that has just had a large update will show a jump, and it will settle again. That is the same mechanism as purgeable space on a Mac, where deleted files stay on disk while a snapshot still references them.

On a drive that is already full

Restore points are among the safest large things to remove in an emergency, because losing them costs you a recovery option rather than any data. The order for the rest is in why the C drive is full.