What is System Restore in Windows XP?
System Restore is a component of Windows XP Professional that you can use to restore your computer to a previous state, if a problem occurs, without losing your personal data files (such as Microsoft Word documents, browsing history, drawings, favorites, or e-mail). System Restore monitors changes to the system and some application files, and it automatically creates easily identified restore points. These restore points allow you to revert the system to a previous time. They are created daily and at the time of significant system events (such as when an application or driver is installed). You can also create and name your own restore points at any time.
Note: You may also want to read Disable System Restore in Windows XP.
System Restore functions like an “undo” feature for Windows XP Professional configuration changes, allowing you to recover from problems caused by such things as incorrect system settings, faulty drivers, incompatible applications and so on, without risk to personal files, such as documents or e-mail.
System Restore enables you to restore your system by automatically creating restore points based on a preset schedule or in response to system events (such as installing a new application or driver). You can also manually create restore points as needed. You must be logged on as an administrator or a member of the Administrators group to use System Restore.
System Restore consists of two parts, file monitoring and restore point management.
System Restore monitors file operations for a core set of system and application files specified in systemrootSystem32RestoreFilelist.xml. System Restore records changes to the original file and sometimes copies it to a hidden archive before Windows XP Professional overwrites, deletes, or changes, the monitored file. System Restore does not monitor the following files and folders:
- The virtual memory paging file.
- Personal user data, such as files in My Documents, Favorites, Recycle Bin, Temporary Internet Files, History, and Temp folders.
- Image and graphics files, such as those with .bmp, .jpg, and .eps extensions.
- Application data files with extensions not listed in systemrootSystem32RestoreFilelist.xml such as .doc, .xls, .mdb, and .pst.
Restore Points and Restore Point Management
Restore points contain the following two types of information:
A snapshot of the registry.
Certain dynamic system files.
System Restore creates restore points according to the following system events, user actions, or time intervals:
Installing an unsigned device driver: Installing an unsigned driver causes System Restore to create a restore point.
Installing System Restore compliant applications: Installing an application that uses Windows Installer, or Install Shield Pro version 7.0 or later, causes System Restore to create a restore point.
Installing an update by using Automatic Updates: Installing an update by using Automatic Updates or installing an update directly by using Windows Update causes System Restore to create a restore point.
Performing a System Restore operation: System Restore creates a new restore point when you revert your system to a previous state by using a restore point. System Restore implements this safeguard in the event that you use the wrong restore point. You can undo the last restore, rerun System Restore, and select another restore point.
Restoring data from backup media: When you use the Backup tool to restore files, System Restore creates a restore point to use before restoring from backup media. If problems occur with the Backup application, and your system is left in an undetermined state, you can restore your system. System Restore does not revert personal data files copied to the computer by using the Backup tool.
Creating daily restore points: System Restore creates a restore point every 24 hours if the computer is turned on, or if it has been 24 hours since the last restore point was created. Scheduled restore-point creation occurs when the computer is idle, when there is no mouse, keyboard, or disk activity.
Creating restore points at preset intervals: Restore-point creation at specified intervals is disabled by default but can be enabled by using the registry editor, Regedit.exe. See Table D.4 later in this appendix for a description of the System Restore registry entries RPSessionInterval and RPGlobalInterval.
For systems using the NTFS file system, System Restore compresses archive information during idle time when there is no mouse, keyboard, or disk activity.
Archiving and Purging of Restore Points
System Restore archives expand to include multiple restore points, each representing unique system states. System state refers to the components that define the current state of the operating system and includes the following:
- User account information stored in the registry.
- Application, hardware, and software settings stored in the registry.
- Files that Windows XP Professional requires for startup, including those in the systemroot directory and boot files on the system partition, such as Ntldr or IA64ldr.efi.
Archived restore point information is saved to a hidden systemdrive folder or an archive on the volume where a monitored file is located. The archive collects multiple restore points, each representing individual system states. The files, registry snapshots, and logs associated with older restore points are purged on a first in, first out (FIFO) basis, optimizing System Restore disk space and making room for new restore points. System Restore uses the following algorithms and conditions to determine whether it is time to purge restore point data:
When System Restore consumes at least 90 percent of allotted space: System Restore purges restore points to reduce the amount of allotted space used from 90 percent to 75 percent. System Restore is limited to 12 percent of available disk space, which is not pre-allocated. Windows XP Professional and applications can use the free portion of this space.
When you reduce the amount of disk space allotted to System Restore: By using Control Panel or Disk Cleanup to reduce the amount of System Restore space you can cause System Restore to purge all but the most recent restore points.
When you disable System Restore: Disabling System Restore deletes all restore points.
When a specified period of time has elapsed: You can configure System Restore to purge restore points by elapsed time. For example, you can specify deletion of restore points older than two months. By default, System Restore purges restore points older than 90 days.
Tagged with Disaster Recovery