Taking Advantage of Windows XP's System Restore
Like this article? We recommend
Like this article? We recommend
Like this article? We recommend
It's not a backup recovery. It's not an operating system reload. And it can't replace either of those Windows features. But the System Restore component of Windows XP is the biggest "undo" available for Windows—and all for just a couple of minutes of your time, rather than hours or days.
NOTE
Windows ME also includes a version of System Restore.
System Restore: The Big Picture
Imagine that you have a calendar, and you can just point to a significant past date and roll your life back to that point. You could go back before that blind date, before following your brother-in-law's stock tip, or before pledging the "party fraternity." That's a trick that would require a boost from Rod Serling for us humans, but it's not science fiction for Windows XP.
With System Restore, you can turn back the clock to a time before a user installed a game downloaded from a chat session, before telling Windows "Yes" to a proposed driver written before the new hardware existed, or even before an unexplained spate of Blue Screens of Death. Once you roll back, Windows will be innocent of its former woes—or, at least, the woes that were rolled back. There are some limitations: The changes have to involve system values that cover the right time period, and are the kind of information that System Restore considers important enough to monitor and record.
What's important to System Restore? Well, they don't call it "Crucial Spreadsheet Restore," or "The Boss's Novel Restore." With user documents, or user data such as browser history or favorites, if your user broke it, he bought it. (It's not a backup program, remember?)
The upside of what System Restore doesn't bring back is that it doesn't regress user documents back to a prior state. Documents with extensions such as .doc and .gif are safe from System Restore (though not from common disasters), as is everything in the My Documents folder. You can use that knowledge to hide files from the rollback scythe. You'll find a list of files that System Restore monitors (and potentially restores from a prior state) in the file windir\System32\Restore\Filelist.xml on Windows Professional, or Windows\System32\Restore\Filelist.xml in XP Home Edition.
System Restore can bring back the meat of the system as it was before executables, drivers, and other system files (such as the Windows Registry) were corrupted. It can restore the system to a state before an .exe, .dll, or the like was installed—that's System Restore's reason to live. The disadvantage is that the restore is selectable by date, not by program. If you install one program called Nasty, and then one called Nice, and nice.exe isn't hidden from System Restore, when you roll back before installation of nasty.exe you'll lose nice.exe as well.
In most cases, assume that you'll need to reinstall your whole Nice program from scratch, but a few programs can be copied whole in their directories, pasted to a backup medium, and copied back without reinstalling. A little experimentation can yield time-saving rewards, should you find yourself frequently facing this kind of cleanup operation on user machines.
When System Restore does remove nice.exe, it probably won't remove the Nice program completely. Since System Restore's focus is on removing potentially threatening system files, it doesn't bother to clean up all the folders and innocuous program files (or data files created by the program, unless they're unfortunately named with extensions like those of protected files). You'll have to run Control Panels' familiar Add or Remove Programs feature to clean up after the System Restore party, or reinstall the program over remaining files (if that's appropriate) to preserve user settings.
It's better to be safe than sorry. Even if you make sure that files have safe extensions, or are in the My Documents folder, you should ensure that the user's backups are up to date, that they don't contain any system files that may be corrupt, and that they can be copied from the backup medium without performing an entire backup/restore operation that might bring back the problem. Because System Restore monitors drives independently, you can turn it off on one drive and then use that drive to hide files or folders from another drive during the restore. But the default setting is to monitor all partitions and drives. (If you turn off System Restore for the drive with the operating system, it has to be turned off on all drives, so plan accordingly.)