Understanding System Restore

[Guest]

A question about how System Restore works, and what state it leaves my system
in.

Suppose that, on July 15, I make a change to my computer -- installing some
piece of software, perhaps -- that causes a serious problem. I recover by
using System Restore to restore to a July 14 restore point, and all is well.
Then on July 16, Windows creates an automatic restore point.

Does that July 16 restore point include the change that I made on July 15
and then un-made by restoring to the 14th? In other words, if at some future
time I were to restore to July 16, would I be picking up the same problem all
over again? I would think (hope) that it does not, but I'm not really sure.
System Restore claims that it is "completely reversible" which makes it sound
like, somehow, that July 15 change has not really been removed, but is still
there.

Can anybody clarify this for me?

(It's XP/SP2 if that makes a difference)

-- John

 

[Malke]

A question about how System Restore works, and what state it leaves my system
in.

Suppose that, on July 15, I make a change to my computer -- installing some
piece of software, perhaps -- that causes a serious problem. I recover by
using System Restore to restore to a July 14 restore point, and all is well.
Then on July 16, Windows creates an automatic restore point.

Does that July 16 restore point include the change that I made on July 15
and then un-made by restoring to the 14th? In other words, if at some future
time I were to restore to July 16, would I be picking up the same problem all
over again? I would think (hope) that it does not, but I'm not really sure.
System Restore claims that it is "completely reversible" which makes it sound
like, somehow, that July 15 change has not really been removed, but is still
there.

Can anybody clarify this for me?

(It's XP/SP2 if that makes a difference)

The best place to get your questions about System Restore answered is on
MVP Bert Kinney's site here:

http://bertk.mvps.org


Malke

 

[Plato]

A question about how System Restore works, and what state it leaves my system
in.

System restore mainly restores the registry file to an earlier date. It
does not save your importand data. In fact, you have a virus or trojan
loading in a previous version of system restore, aka the registry, then
it will reappear.

 

[Zilbandy]

Suppose that, on July 15, I make a change to my computer -- installing some
piece of software, perhaps -- that causes a serious problem. I recover by
using System Restore to restore to a July 14 restore point, and all is well.
Then on July 16, Windows creates an automatic restore point.

Does that July 16 restore point include the change that I made on July 15
and then un-made by restoring to the 14th?

If you restore the July 14 point, then that is the state of your
system after the restore. If you create a new point on the 16th, then
you are essentially making a backup of the July 14 point. The data for
the restore made on the 15th should not matter, as you went back to a
point before that time.

It's my understanding that each restore point is dependent on all
previous restore points. To me, this means if something gets messed up
with one point, they are all useless.

A restore point takes a picture of the system state at the time the
restore point is made. System restore DOES NOT backup your entire
computer. It monitors a variety of file extensions, besides just
monitoring the registry. For a list of files monitored by system
restore, check out this link:
http://msdn2.microsoft.com/en-us/library/aa378870.aspx

Now, do I use System Restore? No, I don't! I used to, but I had too
many times that I wanted to restore to a previous date, but the
restore point was corrupt, and it wouldn't restore. Now, I use ERUNT
(Emergency Recovery Utility for NT) to just backup the system
registry. It creates complete and separate backups of all the registry
hives; backups not dependent on the others. This may not be as
thorough as System Restore, but it's more reliable, and in most cases,
just recovering the registry will save you from problems created by
adding and deleting programs or making system changes. I also make
complete image backups to an external USB2 hard drive once a week
using Acronis True Image, so the worst case scenario is I lose a weeks
worth of changes should I have to restore from a backup image. I also
make daily backups of my c:\data folder when all my user created data
files are stored. These files are also backed up to my USB drive, as
well as sent over my home network to my other computer. My system has
served me well over the years, as I still have old DOS data files from
the late 1980's on my system. ::knocking on wood::

 

[Barry Watzman]

No, the 7/16 restore point won't have the change. System restore saves
the registry as it exists at the moment of the restore. On 7/16, the
change that you made and then restored out of isn't in the registry,
therefore it's not part of the 7/16 restore point. System restore also
saves some (quite a few) other files, but, again, they are saved as they
exist at the time that the restore point is created. And, again, on
7/16, the change that caused your problem isn't effectively present
since you had used a 7/14 restore point to remove it. Now there MIGHT
be a 7/15 restore point that would include those changes .... many
things that you do create restore points automatically without your
necessarily knowing it. But the 7/16 restore point won't have it.

 

[Bert Kinney]

Hi John,

A question about how System Restore works, and what state it leaves my system in.

Here is a description of System Restore:
http://bertk.mvps.org/html/description.html

Suppose that, on July 15, I make a change to my computer -- installing some
piece of software, perhaps -- that causes a serious problem. I recover by
using System Restore to restore to a July 14 restore point, and all is well.
Then on July 16, Windows creates an automatic restore point.

Does that July 16 restore point include the change that I made on July 15
and then un-made by restoring to the 14th?

The automatic restore point created on July 16, will reflect the state of
the system at the time it was created.

In other words, if at some future
time I were to restore to July 16, would I be picking up the same problem all
over again?

No. The July 16th restore point would return the system to exactly the state
it was at the time the restore point was created.

I would think (hope) that it does not, but I'm not really sure.

System Restore claims that it is "completely reversible" which makes it sound
like, somehow, that July 15 change has not really been removed, but is still there.

When a restore is performed (in normal mode, not Safe Mode) an UNDO restore
point is created. For example, if a user accidentally chooses the wrong
restore point, the user can use the UNDO or "Undo my last restoration" after
opening System Restore. Or the user could choose another restore point at
that time.
Warning: When restoring a system from Safe Mode or from the Command Prompt
an UNDO restore point will NOT be created! You would have the option of
choosing another available restore point.

Here's a scenario to consider. Say something very bad happened to the system
on July 15th and you were able to restore to the 14th. Now that the system
is running normally you are concerned about restoring to the bad state on
the 15th. A manual restore point can be created to save this good state. To
eliminate the chance of restoring to the bad state Disk Cleanup can be used
to delete all existing restore point and leave the the most recent.

How to using Disk Clean-up to remove restore points:
http://bertk.mvps.org/html/diskclean.html

Can anybody clarify this for me?

I hope I did.

(It's XP/SP2 if that makes a difference)

Yes is does. There several fixes to System Restore in SP2.

-- John

Regards,
Bert Kinney MS-MVP Shell/User
http://bertk.mvps.org
Member: http://dts-l.org

 

[Ken Blake, MVP]

A question about how System Restore works, and what state it leaves my system
in.

Suppose that, on July 15, I make a change to my computer -- installing some
piece of software, perhaps -- that causes a serious problem. I recover by
using System Restore to restore to a July 14 restore point, and all is well.
Then on July 16, Windows creates an automatic restore point.

Does that July 16 restore point include the change that I made on July 15
and then un-made by restoring to the 14th? In other words, if at some future
time I were to restore to July 16, would I be picking up the same problem all
over again? I would think (hope) that it does not, but I'm not really sure.

No, it does *not* reinstate the July 15 problem. It restores you to
the July 16 state, which is a state with the problem *gone*. What
happened before July 16--in other words, how you got to the July 16
state--is not relevant.

Only if you restore to a July 14 restore point made after the software
installation, or a July 15 restore point that was made before you did
the restore, would you reinstate the problem.

 

[Guest]

I hope I did.

Regards,
Bert Kinney MS-MVP Shell/User
http://bertk.mvps.org
Member: http://dts-l.org

You did indeed. Thank you for a clear and cogent explanation.
-- John

 

[Barry Watzman]

System restore saves much more than just the registry ... it saves all
of the system files referenced in the registry (drivers, some .DLLs and
..EXE files).

 

[Bert Kinney]

You're welcome John.

Regards,
Bert Kinney MS-MVP Shell/User
http://bertk.mvps.org
Member: http://dts-l.org