Information about System Restore

System Restore is a component of Microsoft's Windows Me, Windows XP and Windows Vista operating systems that allows for the rolling back of system files, registry keys, installed programs, etc., to a previous state in the event of a failure.

In Windows Vista, System Restore features an improved interface and is now based on Shadow Copy technology. In prior Windows versions, it was based on a file filter that watched changes for a certain set of file extensions, and then copied files before they were overwritten. ^[1]

In Windows Server 2003 family, System Restore is not installed by default. However, it can be installed on these system through a Windows XP installation CD ^[2], although it is not recommended nor supported by Microsoft and might violate your EULA.

Overview

System Restore is accessed via the Start menu, in Start -> All Programs -> Accessories -> System Tools -> System Restore. From there, the user may either create a new restore point manually, roll back to an existing restore point, or change the System Restore configuration.

New Restore points are created:

• when a piece of software is installed
• when Windows Update installs new updates to Windows
• when the user installs a driver that is not digitally signed by Windows Hardware Quality Labs
• every 24 hours of computer use (10 hours in Windows Me), or every 24 hours of calendar time, whichever happens first
• when the computer boots after being off for more than 24 hours
• when the user requests it.

System Restore can be configured to use up to a maximum of 15% of hard drive space. Old restore points are discarded in order to keep drive usage within the specified amount. For many users, this can provide restore points covering the past several weeks. Users concerned with performance or space usage may also opt to disable System Restore entirely. Files stored on partitions not monitored by System Restore are never backed up or restored.

System Restore backs up system files of certain extensions (.exe, .dll, etc.), with the exception of files in My Documents folders, and saves them in a large compressed block for later recovery and use. It backs up the registry and most drivers. It does not back up or restore user data. System Restore will not monitor changes to file types commonly used for users' personal data files, such as documents, graphics, e-mail, etc., and will not restore windows logins. Thus, users will not lose personal data, documents, emails, etc. when performing a system restore.Microsoft recommends that if a user is unsure as to whether certain files will be modified by a rollback, they should keep those files under My Documents. When a rollback to a previous restore point is performed, the files that were being monitored by System Restore are restored and newly created folders are removed.

Trivia

• As part of Microsoft's description of the then-new System Restore feature in Windows Me, Microsoft's online help files made a joking reference to famous theoretical physicist Stephen Hawking:

Theoretical physicist Stephen Hawking writes that each of us carries a personal measure of time dependent on our speed and position in the universe. When you find that your computer isn't working the way it should, you may also find that your personal measure of time has come to a complete stop, and that your productivity has disappeared into a black hole.^[3]

• System Restore in Windows Me is known for creating and archiving Trojan Horse viruses that can't be removed by a virus scanner.^[4] The only way to delete the virus is to disable System Restore, which will result in losing all saved checkpoints, or simply wait until Windows deletes the checkpoint to make room for new checkpoints.
• A System Restore update for Windows Me can be obtained from Microsoft's website^[5] that fixes a problem when restoring a checkpoint after September 8, 2001.

See also

• Time Machine (software)
• Windows Recovery Environment

References

Sources

• Roll back the clock with System Restore
• Microsoft Corporation, (2001). Use system restore to undo changes if problems occur. Retrieved Jun. 12, 2005, from Microsoft Corporation Web site: http://www.microsoft.com/windowsxp/using/helpandsupport/learnmore/systemrestore.mspx.
• Windows System Restore. MSDN. Microsoft (August, 2000). Retrieved on 2006-04-28.
• Using System Restore to Remove a Virus or fix a Computer Problem
• MSDN System Restore Reference: Monitored File Extensions
• How to Disable System Restore

•  • [ e] Windows Components
Components:	Aero • DWM • Windows Explorer • Taskbar • Start menu • Windows Shell (Shell namespace) • Special Folders • Windows Search • Saved search • Graphics Device Interface • DirectX • DEP • BitLocker • .NET Framework
Windows Applications:	Mail • Contacts • Calendar • Fax and Scan • Meeting Space • Paint • WordPad • Sound Recorder • Snipping Tool • Photo Gallery • Movie Maker • DVD Maker • Internet Explorer • WMP • Media Center • Defender • Sidebar • Control Panel (Applets) • Security Center • WinSAT • System Restore • Disk Defragmenter • Windows Update • Calculator • Character Map • Notepad • Narrator • Remote Assistance • Task Manager • Disk Cleanup • PowerShell • Cmd.exe • Windows Installer • Management Console
Kernel and core components:	Ntoskrnl.exe • hal.dll • System idle process • Svchost.exe • Registry • Windows service • WOW/WOW64 • DLL • NTLDR/Boot Manager • Winlogon • Recovery Console
Services:	Alerter • BITS • Task Scheduler • Wireless Zero Configuration • Shadow Copy
File systems:	NTFS (Junction point • Symbolic link • TxF • EFS) • FAT32 • FAT • exFAT • CDFS • UDF • DFS
Server components:	Active Directory • Group policy • Domains • Windows Media Services • Rights Management Services • IIS
Architecture:	NT series architecture • Ob • Startup process (Vista) • I/O RP • KTM
Games:	3D Pinball: Space Cadet • Chess Titans • FreeCell • Hearts • InkBall • Mahjong Titans • Minesweeper • Purble Place • Solitaire • Spider Solitaire
PowerToys:	TweakUI • SyncToy • PowerCalc