Summary: There's much confusion about what System Restore actually is and is not. In a nutshell, it's safest not to rely on it to restore your system.
This is actually a synthesized question that reflects an extremely common line of thinking I see in questions and comments I receive.
I can kind of understand the thinking; it might make sense to rely on something called "System Restore" to restore your system.
Unfortunately, that's not even close to what it does. Add a couple of additional pitfalls, and relying on System Restore without completely understanding what it is - and more importantly what it is not - could lead you down a very dangerous path.
•
Let me be clear about something right away: System Restore is not a substitute for backing up.
So, why is that?
Because it doesn't back most things up. In fact, System Restore actually operates only on a very few system files and settings.
I'm going to oversimplify, but in a nutshell: System Restore backs up your registry. It actually backs up some more things, I'm sure, but for purposes of this discussion we'll think of it as just backing up the registry. In fact, it's a very good registry backup - when we say "back up your registry" these days that often means "set a system restore point".
What's more important is what System Restore does not do:
-
System Restore does not backup your data. If you delete or damage a file, System Restore will not recover it.
-
System Restore does not really "uninstall" software. If you set a restore point, install software, and then revert to that restore point, the software will appear uninstalled (it will no longer appear on menus and the Add/Remove list), but files and folders created by that software installation may still remain.
-
System Restore does not keep old copies of your files or settings. If you're looking for an "old version" of a file or program that you used to have on your machine, System Restore will not have it.
-
System Restore will not restore your system. By that I mean that if your system crashes and Windows needs to be repaired or reinstalled, System Restore will not aid in this process.
The Intent of System Restore
System restore is intended for recovery from recent changes to your system. For example, if you do install a new driver or software package that somehow causes your system to misbehave, you can use System restore to "undo" most of the changes and return to a prior state. That's actually why most setup programs now cause a restore point to be taken prior to starting: so that in the case of failure or some other unexpected event, you'll always have that restore point to go back to.
I want to emphasize the recent nature of restore points. The intent is that they be used to recover from something that happened recently - as in within a day or two. Yes, restore points are often kept for longer periods of time, but the problem is that so much is constantly changing on your system that rolling back to a significantly older restore point can also have unexpected side effects as more changes are undone that you might expect.
Restore Points Disappear Over Time
Windows only keeps a limited number of restore points based on the amount of disk space you have available for it. Once that space fills up, each time a new restore point is taken, older restore points are deleted to make room.
I need to say that again: older restore points are deleted to make room.
A very common variation on the System Restore question is "why are there no restore points where I want to go back to?" The answer is that they were probably deleted to make room for newer ones. Restore points are taken at various times, so older restore points are constantly being swapped out to make room for new. As I keep saying, they're not meant to be a long term restoration strategy.
Is System Restore Even On?
System Restore may or may not be turned on. If not, you'll free up some disk space, but you'll have no restore points to go back to ... ever. This is, in fact how I run my machines. Because System Restore only backs up a limited set of what I actually care about, I turn it off completely and rely instead on a nightly full backup. That way I know that everything - files, settings, applications, whatever - are all backed up and accessible on a momen's notice, and I can keep those backups for as long as I might choose to.
Related:
-
How do I get at System Restore in Windows XP? System Restore settings are in the properties of My Computer, but actually running the System Restore application is a little less obvious.
-
Why isn't there a restore point where I want to go back to? Restore points are a handy way to undo problematic system changes. Even though you can control it some, restore points can only go back so far.
-
What backup program should I use? Backing up your computer's data is critical. What program should you use? There are many, but the best is which ever one you actually will use.
-
Microsoft - What Is System Restore?
Article C3477 - August 21, 2008
Leo, Does Restore (XP) roll back Windows updates? I have a problem with a program that suddenly developed unusual behaviour after a packet of Windows updates was installed. I want to Restore to a date prior to the Windows update to test program behaviour. And if the problem goes away, I will re-install each of the updates testing for the "baddie". Will this work?
-Leo
You can uninstall MS updates from the Add/Remove programs area. You probably will have to put a check in a box at the top to display them.
The best registry backups are made by the free ERUNT progam. Works with Vista and XP. I put this on every customer's computer. Do some googling. Packrat1947
Posted by: Ron N. at August 28, 2008 5:22 AMThanks RonH. Yes, I was looking to use Add/Remove programs but I could not identify the kbxxx updates that were loaded at the time the problem began. When I selected Update History from Windows Update, the only thing listed was Microsoft Update download (!!!!) and looking in C:\Windows listed about 10 kb's. I decided to first test my theory of the problem being caused by an update, by Restoring to an earlier date (which I assumed would roll back those updates). The time it would take to uninstall each likely kb, then reinstall the program, would be wasted if an update was not my problem.
Posted by: Bevin at August 29, 2008 12:14 AMSo I would still like to know if Restore does roll back Windows updates. Leo???
Thanks, Bevin.
Dear Leo,
This is do with back-ups. I have some difficulty with finding my current active files which must be miniscule compared with your gargantuan back-up base. Can you please give some tips on your 'filing' system as regards finding specific files in the mass of those that must accrue from your nightly back-up ?
Thank you
Robert George Douglas
As for how I lay things out on my hard drive ... well, that's been a long evolution over many years as my needs have changed, and likely wouldn't apply to you. Best advice I can offer it to plan a hard drive organization that makes sense to you, and then the backups shoudl follow.
-Leo
I am slightly confused regarding the statement that "System Restore does not backup your data". If I inspect my shadows in the shadowstorage (e.g. with Shadow Explorer) I can see all my files that existed at the time the shadow was written and I can even reimport them. The same goes for system files. How does that relate to your statement that I quoted above? Thanks in advance for your answer. WHS
10-Dec-2008
Hi Leo, thanks for the answer. You are right in the sense that a true backup must be to another media. That's why I use Norton Ghost PLUS a very handy Maxtor One Touch disk that I leave disconnected. However, as long as the HDD stays alive (and that is the base case for most folks), it is possible to recover files and folders from the shadows in shadowstorage. And that has come in handy in several instances - especially if they are system files.
Posted by: whs at December 11, 2008 7:31 PMHello Leo,
I heard that having System Restore on could be a security issue. Is this true?
Thank you
18-Feb-2009
I'd like to ad one point: be aware about making a system backup image...it's best to FIRST run all your "anti" software to get rid of all the viruses and malware you have. Otherwise, if you end up having to use the backup image, you're going to have all the junk you had before you started.
Posted by: Ron at February 17, 2009 5:50 PMI always turn off system restore because in my situation and the way in which I use my computers it becomes a very irritating and useless feature,
Posted by: XP Guest Account acting like Win2k Guest Account at September 5, 2009 6:37 PMa> if it doesn't restore user data why does it create restore points for every folder I create and delete?
b> it becomes a resource intensive item when monitoring the 20+ drives in my system,
(Yes I've actually made it up to the full disk count of 26, when the last USB drive I plugged in became B:\ I wish I had another just to see if I would get a windows dialog "no more available drive letters")
c> system restore can harbor infected system files, not that I've ever had an infection on any of my systems but I've seen .exe files and .dll files in restore points,
Microsoft documentation System Restore Monitored File Types
d> to see the contents of these RP## folders change the folder options to show hidden & system files & folders and uncheck the "Hide protected OS files" and then right click on "\System Volume Information" and change the security permissions to allow inherit from parent permissions and then look through the RP## folders and you'll see .exe & .dll files
e> also if system restore contains the registry backups you mention then it can also contain those corrupt registry entries created by malware / spyware bad BHOs etc. in fact all the AV and anti-whatever programs such as Spybot Search & Destroy help files tell you to turn off system restore when attempting to recover from an infection.
I recently had to use the system restore that restores the cpu back the the factory installed conditions wiping out all programs I installed. Is there a way or a program that can bring it back? (I do not have the install disk anymore.) I seen some that restores deleted files but do not mention programs.
Posted by: anthony at October 26, 2009 11:53 AM