There is another location the Windows File protection service uses and that is the I386 folder in C:\WINDOWS\ServicePackFiles When you install a service pack, like SP1. Any new system drivers are cached in this location too.
after using the administrative install of sp3 I noticed a
My admin install of sp3 put a ServicePackFiles folder in the windows directory 569MB
Inside it is i386 folder, 561MB and a ServicePackCache folder
checking the source path in the registry