Helping people with computers... one answer at a time.

There's much confusion about what System Restore actually is and is not. In a nutshell, it's safest not to rely on it to restore your system.

This is actually a synthesized question that reflects an extremely common line of thinking I see in questions and comments I receive.

I can kind of understand the thinking; it might make sense to rely on something called "System Restore" to restore your system.

Unfortunately, that's not even close to what it does. Add a couple of additional pitfalls, and relying on System Restore without completely understanding what it is - and more importantly what it is not - could lead you down a very dangerous path.

Let me be clear about something right away: System Restore is not a substitute for backing up.

So, why is that?

Because it doesn't back most things up. In fact, System Restore actually operates only on a very few system files and settings.

I'm going to oversimplify, but in a nutshell: System Restore backs up your registry. It actually backs up some more things, I'm sure, but for purposes of this discussion we'll think of it as just backing up the registry. In fact, it's a very good registry backup - when we say "back up your registry" these days that often means "set a system restore point".

"System Restore is not a substitute for backing up."

What's more important is what System Restore does not do:

  • System Restore does not backup your data. If you delete or damage a file, System Restore will not recover it.

  • System Restore does not really "uninstall" software. If you set a restore point, install software, and then revert to that restore point, the software will appear uninstalled (it will no longer appear on menus and the Add/Remove list), but files and folders created by that software installation may still remain.

  • System Restore does not keep old copies of your files or settings. If you're looking for an "old version" of a file or program that you used to have on your machine, System Restore will not have it.

  • System Restore will not restore your system. By that I mean that if your system crashes and Windows needs to be repaired or reinstalled, System Restore will not aid in this process.

The Intent of System Restore

System restore is intended for recovery from recent changes to your system. For example, if you do install a new driver or software package that somehow causes your system to misbehave, you can use System restore to "undo" most of the changes and return to a prior state. That's actually why most setup programs now cause a restore point to be taken prior to starting: so that in the case of failure or some other unexpected event, you'll always have that restore point to go back to.

I want to emphasize the recent nature of restore points. The intent is that they be used to recover from something that happened recently - as in within a day or two. Yes, restore points are often kept for longer periods of time, but the problem is that so much is constantly changing on your system that rolling back to a significantly older restore point can also have unexpected side effects as more changes are undone that you might expect.

Restore Points Disappear Over Time

Windows only keeps a limited number of restore points based on the amount of disk space you have available for it. Once that space fills up, each time a new restore point is taken, older restore points are deleted to make room.

I need to say that again: older restore points are deleted to make room.

A very common variation on the System Restore question is "why are there no restore points where I want to go back to?" The answer is that they were probably deleted to make room for newer ones. Restore points are taken at various times, so older restore points are constantly being swapped out to make room for new. As I keep saying, they're not meant to be a long term restoration strategy.

Is System Restore Even On?

System Restore may or may not be turned on. If not, you'll free up some disk space, but you'll have no restore points to go back to ... ever. This is, in fact how I run my machines. Because System Restore only backs up a limited set of what I actually care about, I turn it off completely and rely instead on a nightly full backup. That way I know that everything - files, settings, applications, whatever - are all backed up and accessible on a momen's notice, and I can keep those backups for as long as I might choose to.

Article C3477 - August 21, 2008 « »

Share this article with your friends:

Share this article on Facebook Tweet this article Email a link to this article
Leo Leo A. Notenboom has been playing with computers since he was required to take a programming class in 1976. An 18 year career as a programmer at Microsoft soon followed. After "retiring" in 2001, Leo started Ask Leo! in 2003 as a place for answers to common computer and technical questions. More about Leo.

Not what you needed?

15 Comments
novice
August 21, 2008 10:56 AM

A related question if someone can answer. Restoring from full image backup would restore even the user data and files to that previous date. Or is there a way to restore ONLY the programs and settings?

More specifically, is there a way to somehow backup the windows updates (and even the MS Office updates) so that when we reinstall it from the recovery DVD (factory fresh image) we do not have to download the hefty updates again?

If yes, does the method involve downloading all the updates again or the already downloaded updates can be used?

The short answer is: not really. A backup is just a backup of files on you disk. It doesn't "know" while files are system files, which files are parts of updates, and which files are your data - it's all just files. So a restore is either complete (all files) or partial (you choose which files and folders to restore). Updates are also frequently invasive, meaning that they touch things you wouldn't expect to be touched. There's simply no way to keep it all straight.

The solution many people take is when building out a new machine is to first install everything. Get it all up to date, and then take a full backup snapshot of the machine at that point in time. That way they have a known good image that they can revert to, and would have to take only updates released since that point if they need to revert to it.

-Leo

Carl R. Goodwin
August 27, 2008 6:55 PM

The ONE thing that I don't really like about Vista is the inability to decide how many restore points/memory is used (as I could in XP). Every week, I run maintenance, and when I run disk cleanup, there are at least 5 gb of restore points saved. Waste of disk space.

Bevin
August 28, 2008 2:07 AM

Leo, Does Restore (XP) roll back Windows updates? I have a problem with a program that suddenly developed unusual behaviour after a packet of Windows updates was installed. I want to Restore to a date prior to the Windows update to test program behaviour. And if the problem goes away, I will re-install each of the updates testing for the "baddie". Will this work?

I believe it will.

-Leo

Ron N.
August 28, 2008 5:22 AM

You can uninstall MS updates from the Add/Remove programs area. You probably will have to put a check in a box at the top to display them.

The best registry backups are made by the free ERUNT progam. Works with Vista and XP. I put this on every customer's computer. Do some googling. Packrat1947

Bevin
August 29, 2008 12:14 AM

Thanks RonH. Yes, I was looking to use Add/Remove programs but I could not identify the kbxxx updates that were loaded at the time the problem began. When I selected Update History from Windows Update, the only thing listed was Microsoft Update download (!!!!) and looking in C:\Windows listed about 10 kb's. I decided to first test my theory of the problem being caused by an update, by Restoring to an earlier date (which I assumed would roll back those updates). The time it would take to uninstall each likely kb, then reinstall the program, would be wasted if an update was not my problem.
So I would still like to know if Restore does roll back Windows updates. Leo???
Thanks, Bevin.

Robert George Douglas
September 7, 2008 12:50 AM

Dear Leo,

This is do with back-ups. I have some difficulty with finding my current active files which must be miniscule compared with your gargantuan back-up base. Can you please give some tips on your 'filing' system as regards finding specific files in the mass of those that must accrue from your nightly back-up ?

Thank you

Robert George Douglas

Actually has very little to do with the backups, per se. The backups are simply images of my hard drive, so they're organized the same way things are laid out on my harddrive.

As for how I lay things out on my hard drive ... well, that's been a long evolution over many years as my needs have changed, and likely wouldn't apply to you. Best advice I can offer it to plan a hard drive organization that makes sense to you, and then the backups shoudl follow.

-Leo

whs
December 9, 2008 9:23 PM

I am slightly confused regarding the statement that "System Restore does not backup your data". If I inspect my shadows in the shadowstorage (e.g. with Shadow Explorer) I can see all my files that existed at the time the shadow was written and I can even reimport them. The same goes for system files. How does that relate to your statement that I quoted above? Thanks in advance for your answer. WHS

That's a Vista-only feature. Technically I'm not sure it's part of System Restore. Even if it is, it's not a backup. Consider what happens if your hard drive dies - your shadow storage dies too.
- Leo
10-Dec-2008

whs
December 11, 2008 7:31 PM

Hi Leo, thanks for the answer. You are right in the sense that a true backup must be to another media. That's why I use Norton Ghost PLUS a very handy Maxtor One Touch disk that I leave disconnected. However, as long as the HDD stays alive (and that is the base case for most folks), it is possible to recover files and folders from the shadows in shadowstorage. And that has come in handy in several instances - especially if they are system files.

Angel
February 17, 2009 10:45 AM

Hello Leo,

I heard that having System Restore on could be a security issue. Is this true?

Thank you

Not that I've heard of. Only thing I can think of is using it to restore something you thought you had removed.
- Leo
18-Feb-2009
Ron
February 17, 2009 5:50 PM

I'd like to ad one point: be aware about making a system backup image...it's best to FIRST run all your "anti" software to get rid of all the viruses and malware you have. Otherwise, if you end up having to use the backup image, you're going to have all the junk you had before you started.

XP Guest Account acting like Win2k Guest Account
September 5, 2009 6:37 PM

I always turn off system restore because in my situation and the way in which I use my computers it becomes a very irritating and useless feature,

a> if it doesn't restore user data why does it create restore points for every folder I create and delete?

b> it becomes a resource intensive item when monitoring the 20+ drives in my system,
(Yes I've actually made it up to the full disk count of 26, when the last USB drive I plugged in became B:\ I wish I had another just to see if I would get a windows dialog "no more available drive letters")

c> system restore can harbor infected system files, not that I've ever had an infection on any of my systems but I've seen .exe files and .dll files in restore points,
Microsoft documentation System Restore Monitored File Types

d> to see the contents of these RP## folders change the folder options to show hidden & system files & folders and uncheck the "Hide protected OS files" and then right click on "\System Volume Information" and change the security permissions to allow inherit from parent permissions and then look through the RP## folders and you'll see .exe & .dll files

e> also if system restore contains the registry backups you mention then it can also contain those corrupt registry entries created by malware / spyware bad BHOs etc. in fact all the AV and anti-whatever programs such as Spybot Search & Destroy help files tell you to turn off system restore when attempting to recover from an infection.

anthony
October 26, 2009 11:53 AM

I recently had to use the system restore that restores the cpu back the the factory installed conditions wiping out all programs I installed. Is there a way or a program that can bring it back? (I do not have the install disk anymore.) I seen some that restores deleted files but do not mention programs.

Jim Komasinski
August 30, 2011 8:59 AM

Hello Leo and all,
I have a PC that creates restore points periodically as expected.

But everytime I try to do a restore I always get a message that the restore could not be done. Try another.

I try others, and always get the same result. This situation has existed for years on this particular PC. Obviously something is wrong with the application/OS.

Do you know of any repair tool availalble?

I'm not aware of the repair utility. Unfortunately your situation also appears to be relatively common. It's one of the reasons that I so strongly advise against relying on system restore. I actually have it turned completely off on my systems, to rely on likely backups instead.
Leo
30-Aug-2011

Louis Allen
August 30, 2011 11:12 AM

Leo,
I have been using Norton's go back for years and it has saved my life dozens of times. It is easy, and you can retrieve email and other files afterwards if you wish.You can go back a week if you want. why has it vanished from sight? Nobody knows about it. But I don't use it for backups. I use Acronis. Different purpose altogether.

GREG JACKSON
August 31, 2011 10:09 PM

Re:Post by Ron
FIRST run all your "anti" software.

And if time permits, clean some junk of HDD, and check if defragging is due. It's a good feeling having removed junk/wasted space and having 14Gb less to back-up.

Comments on this entry are closed.

If you have a question, start by using the search box up at the top of the page - there's a very good chance that your question has already been answered on Ask Leo!.

If you don't find your answer, head out to http://askleo.com/ask to ask your question.