System Restore

System Restore
A component of Microsoft Windows

The System Restore wizard on Windows 7
Details
Type System recovery
Included with Windows ME
Windows XP
Windows Vista
Windows 7
Windows 8
Windows 8.1
Windows 10
Related components
Shadow Copy, Windows File Protection

System Restore is a feature in Microsoft Windows that allows the user to revert their computer's state (including system files, installed applications, Windows Registry, and system settings) to that of a previous point in time, which can be used to recover from system malfunctions or other problems. First included in Windows ME, it has been included in all following desktop versions of Windows released since, excluding the Windows Server.[1] In Windows 10, System Restore is turned off by default and must be enabled by users in order to function.[2]

In prior Windows versions it was based on a file filter that watched changes for a certain set of file extensions, and then copied files before they were overwritten.[3][4] An updated version of System Restore introduced by Windows Vista uses the Shadow Copy service as a backend (allowing block-level changes in files located in any directory on the volume to be monitored and backed up regardless of their location) and allows System Restore to be used from the Windows Recovery Environment in case the Windows installation no longer boots at all.[5]

Overview

In System Restore, the user may create a new restore point manually (as opposed to the system creating one automatically), roll back to an existing restore point, or change the System Restore configuration. Moreover, the restore itself can be undone. Old restore points are discarded in order to keep the volume's usage within the specified amount. For many users, this can provide restore points covering the past several weeks. Users concerned with performance or space usage may also opt to disable System Restore entirely. Files stored on volumes not monitored by System Restore are never backed up or restored.

System Restore backs up system files of certain extensions (.exe, .dll, etc.) and saves them for later recovery and use.[6] It also backs up the registry and most drivers.

Resources monitored

Starting with Windows Vista, System Restore takes a snapshot of all volumes it is monitoring. However, on Windows XP, it only monitors the following:[7][8]

The list of file types and directories to be included or excluded from monitoring by System Restore can be customized on Windows Me and Windows XP by editing %windir%\system32\restore\Filelist.xml.[9]

Disk space consumption

The amount of disk space System Restore consumes can be configured. Starting with Windows XP, the disk space allotted is configurable per volume and the data stores are also stored per volume. File are stored using NTFS compression and a Disk Cleanup handler allows deleting all but the most recent Restore Point to free up disk space. System Restore can be disabled completely to regain disk space. It automatically disables itself if the disk free space is too low for it to operate.

Restore points

Windows creates restore points:

Windows XP stores restore-point files in a hidden folder named "System Volume Information" on the root of every drive, partition or volume, including most external drives and some USB flash drives.[3]

The operating system deletes older restore points per the configured space constraint on a first in, first out basis.

Implementation differences

There are considerable differences between how System Restore works under Windows XP and later Windows versions.

Restoring the system

Up to Windows XP, the system can be restored as long as it is in an online state, that is, as long as Windows boots normally or from Safe mode. It is not possible to restore the system if Windows is unbootable without using a 3rd-party bootable recovery media such as ERD Commander. Under Windows Vista and later, the Windows Recovery Environment can be used to launch System Restore and restore a system in an offline state, that is, in case the Windows installation is unbootable.[5] Since the advent of Microsoft Desktop Optimization Pack, Diagnostics and Recovery Toolset from it can be used to create a bootable recovery disc that can log on to an unbootable Windows installation and start System Restores. The toolset includes ERD commander for Windows XP that was previously a 3rd-party product by Wininternals.

Limitations and complications

A bug existed in System Restore that shipped with Windows Millennium Edition wherein the rollback procedure does not work after 8 September 2001 due to the limitations of the algorithm used to generate checkpoints. Microsoft had created an update to address this issue.[18]

A limitation which applies to System Restore in Windows versions prior to Windows Vista is that only certain file types and files in certain locations on the volume are monitored, therefore unwanted software installations and especially in-place software upgrades may be incompletely reverted by System Restore.[19] Consequently, there may be little or no practical beneficial impact. Certain issues may also arise when attempting to run or completely uninstall that application. In contrast, various other utilities have been designed to provide much more complete reversal of system changes including software upgrades. However, beginning with Windows Vista, System Restore monitors all system file types on all file paths on a given volume, so there is no issue of incomplete restoration.

It is not possible to create a permanent restore point. All restore points will eventually be deleted after the time specified in the RPLifeInterval registry setting is reached or earlier if allotted disk space is insufficient. Even if no user or software triggered restore points are generated allotted disk space is consumed by automatic restore points.[8] Consequently, in systems with little space allocated, if a user does not notice a new problem within a few days, it may be too late to restore to a configuration from before the problem arose.

For data integrity purposes, System Restore does not allow other applications or users to modify or delete files in the directory where the restore points are saved. On NTFS volumes, the Restore Points are protected using ACLs. Since its method of backup is fairly simplistic, it may end up archiving malware such as viruses, for example in a restore point created before using antivirus software to clean an infection. Antivirus software is usually unable to remove infected files from System Restore;[20] the only way actually to delete the infected files is to disable System Restore, which will result in losing all saved restore points; otherwise they will remain until Windows deletes the affected restore points. However stored infected files in themselves are harmless unless executed; they will only pose a threat if the affected restore point is reinstated. Windows System Restore is not compatible with restore points made by third party applications.

Changes made to a volume from another OS (in case of dual-boot OS scenarios) cannot be monitored. In addition, dual-booting different versions of Windows can disrupt the operation of System Restore. Specifically, Windows XP and Windows Server 2003 delete the checkpoints the Windows Vista and later has created.[21] Also, checkpoints created by Windows 8 may be destroyed by previous versions of Windows.[22]

See also

References

  1. ↑ No restore point for you, Cnet, 2007-12-28
  2. ↑ Jim Tanous, "Why and How to Enable System Restore in Windows 10", Tekrevue, 2015-07-28
  3. 1 2 Russinovich, Mark E.; Solomon, David A. (2005). Microsoft Windows Internals: Microsoft Windows Server 2003, Windows XP, and Windows 2000 (4 ed.). Redmond, WA: Microsoft Press. pp. 706–711. ISBN 0-7356-1917-4.
  4. ↑ "Windows Backup". Windows Vista portal. Microsoft. Archived from the original on 10 May 2007. Retrieved 11 January 2014.
  5. 1 2 Fok, Christine (September 2007). "A Guide to Windows Vista Backup Technologies". TechNet Magazine. Microsoft. Retrieved 11 January 2014.
  6. 1 2 MSDN System Restore Reference: Monitored File Extensions
  7. ↑ "Monitoring the System". MSDN. Microsoft. Retrieved 10 May 2014.
  8. 1 2 3 4 "Frequently Asked Questions Regarding System Restore in Windows XP". TechNet. Microsoft. Archived from the original on 24 April 2008.
  9. 1 2 System Restore: Monitored File Name Extensions
  10. 1 2 "Selected Scenarios for Maintaining Data Integrity with Windows Vista". TechNet. Microsoft. Retrieved 10 May 2014.
  11. 1 2 3 "About System Restore". MSDN. Microsoft. Retrieved 10 May 2014.
  12. ↑ MSFN's Unattended Windows : Reduce Disk Space Used By System Restore
  13. ↑ "The Registry Keys and Values for the System Restore Utility". 2006-09-15. Retrieved 2009-11-03.
  14. 1 2 Windows Vista Help: System Restore FAQs
  15. ↑ Windows Vista System Restore FAQs: Bert Kinney - System Restore MVP Archived March 27, 2008, at the Wayback Machine.
  16. ↑ The Registry Keys and Values for the System Restore Utility
  17. ↑ Vista System Restore Q&A - System Restore MVP Bert Kinney
  18. ↑ Checkpoints that you create after September 8, 2001 do not restore your computer. Retrieved 15 August 2013 from Microsoft website.
  19. ↑ Windows Server Hacks: Hacking System Restore - O'Reilly Media
  20. ↑ "Antivirus Tools Cannot Clean Infected Files in the _Restore Folder". Microsoft Corporation.
  21. ↑ "How restore points and other recovery features in Windows Vista are affected when you dual-boot with Windows XP". File Cabinet Blog. Microsoft. July 14, 2006. Retrieved 2007-03-21.
  22. ↑ "Calling SRSetRestorePoint". MSDN Library. Microsoft. Retrieved 2015-02-01. Snapshots of the boot volume created by System Restore running on Windows 8 may be deleted if the snapshot is subsequently exposed by an earlier version of Windows.

Further reading

This article is issued from Wikipedia. The text is licensed under Creative Commons - Attribution - Sharealike. Additional terms may apply for the media files.