This is actually a synthesized question that reflects an extremely common line of thinking I see in questions and comments I receive.
I can kind of understand the thinking; it might make sense to rely on something called “System Restore” to restore your system.
Unfortunately, that’s not even close to what it does. Add a couple of additional pitfalls, and relying on System Restore without completely understanding what it is – and more importantly what it is not – could lead you down a very dangerous path.
Become a Patron of Ask Leo! and go ad-free!
Let me be clear about something right away: System Restore is not a substitute for backing up.
So, why is that?
Because it doesn’t back most things up. In fact, System Restore actually operates only on a very few system files and settings.
I’m going to oversimplify, but in a nutshell: System Restore backs up your registry. It actually backs up some more things, I’m sure, but for purposes of this discussion we’ll think of it as just backing up the registry. In fact, it’s a very good registry backup – when we say “back up your registry” these days that often means “set a system restore point”.
What’s more important is what System Restore does not do:
- System Restore does not backup your data. If you delete or damage a file, System Restore will not recover it.
- System Restore does not really “uninstall” software. If you set a restore point, install software, and then revert to that restore point, the software will appear uninstalled (it will no longer appear on menus and the Add/Remove list), but files and folders created by that software installation may still remain.
- System Restore does not keep old copies of your files or settings. If you’re looking for an “old version” of a file or program that you used to have on your machine, System Restore will not have it.
- System Restore will not restore your system. By that I mean that if your system crashes and Windows needs to be repaired or reinstalled, System Restore will not aid in this process.
The Intent of System Restore
System restore is intended for recovery from recent changes to your system. For example, if you do install a new driver or software package that somehow causes your system to misbehave, you can use System restore to “undo” most of the changes and return to a prior state. That’s actually why most setup programs now cause a restore point to be taken prior to starting: so that in the case of failure or some other unexpected event, you’ll always have that restore point to go back to.
I want to emphasize the recent nature of restore points. The intent is that they be used to recover from something that happened recently – as in within a day or two. Yes, restore points are often kept for longer periods of time, but the problem is that so much is constantly changing on your system that rolling back to a significantly older restore point can also have unexpected side effects as more changes are undone that you might expect.
Restore Points Disappear Over Time
Windows only keeps a limited number of restore points based on the amount of disk space you have available for it. Once that space fills up, each time a new restore point is taken, older restore points are deleted to make room.
I need to say that again: older restore points are deleted to make room.
A very common variation on the System Restore question is “why are there no restore points where I want to go back to?” The answer is that they were probably deleted to make room for newer ones. Restore points are taken at various times, so older restore points are constantly being swapped out to make room for new. As I keep saying, they’re not meant to be a long term restoration strategy.
Is System Restore Even On?
System Restore may or may not be turned on. If not, you’ll free up some disk space, but you’ll have no restore points to go back to … ever. This is, in fact how I run my machines. Because System Restore only backs up a limited set of what I actually care about, I turn it off completely and rely instead on a nightly full backup. That way I know that everything – files, settings, applications, whatever – are all backed up and accessible on a momen’s notice, and I can keep those backups for as long as I might choose to.
A related question if someone can answer. Restoring from full image backup would restore even the user data and files to that previous date. Or is there a way to restore ONLY the programs and settings?
More specifically, is there a way to somehow backup the windows updates (and even the MS Office updates) so that when we reinstall it from the recovery DVD (factory fresh image) we do not have to download the hefty updates again?
If yes, does the method involve downloading all the updates again or the already downloaded updates can be used?
The solution many people take is when building out a new machine is to first install everything. Get it all up to date, and then take a full backup snapshot of the machine at that point in time. That way they have a known good image that they can revert to, and would have to take only updates released since that point if they need to revert to it.
-Leo
The ONE thing that I don’t really like about Vista is the inability to decide how many restore points/memory is used (as I could in XP). Every week, I run maintenance, and when I run disk cleanup, there are at least 5 gb of restore points saved. Waste of disk space.
Leo, Does Restore (XP) roll back Windows updates? I have a problem with a program that suddenly developed unusual behaviour after a packet of Windows updates was installed. I want to Restore to a date prior to the Windows update to test program behaviour. And if the problem goes away, I will re-install each of the updates testing for the “baddie”. Will this work?
-Leo
You can uninstall MS updates from the Add/Remove programs area. You probably will have to put a check in a box at the top to display them.
The best registry backups are made by the free ERUNT progam. Works with Vista and XP. I put this on every customer’s computer. Do some googling. Packrat1947
Thanks RonH. Yes, I was looking to use Add/Remove programs but I could not identify the kbxxx updates that were loaded at the time the problem began. When I selected Update History from Windows Update, the only thing listed was Microsoft Update download (!!!!) and looking in C:\Windows listed about 10 kb’s. I decided to first test my theory of the problem being caused by an update, by Restoring to an earlier date (which I assumed would roll back those updates). The time it would take to uninstall each likely kb, then reinstall the program, would be wasted if an update was not my problem.
So I would still like to know if Restore does roll back Windows updates. Leo???
Thanks, Bevin.
Dear Leo,
This is do with back-ups. I have some difficulty with finding my current active files which must be miniscule compared with your gargantuan back-up base. Can you please give some tips on your ‘filing’ system as regards finding specific files in the mass of those that must accrue from your nightly back-up ?
Thank you
Robert George Douglas
As for how I lay things out on my hard drive … well, that’s been a long evolution over many years as my needs have changed, and likely wouldn’t apply to you. Best advice I can offer it to plan a hard drive organization that makes sense to you, and then the backups shoudl follow.
-Leo
I am slightly confused regarding the statement that “System Restore does not backup your data”. If I inspect my shadows in the shadowstorage (e.g. with Shadow Explorer) I can see all my files that existed at the time the shadow was written and I can even reimport them. The same goes for system files. How does that relate to your statement that I quoted above? Thanks in advance for your answer. WHS
10-Dec-2008
Hi Leo, thanks for the answer. You are right in the sense that a true backup must be to another media. That’s why I use Norton Ghost PLUS a very handy Maxtor One Touch disk that I leave disconnected. However, as long as the HDD stays alive (and that is the base case for most folks), it is possible to recover files and folders from the shadows in shadowstorage. And that has come in handy in several instances – especially if they are system files.
Hello Leo,
I heard that having System Restore on could be a security issue. Is this true?
Thank you
18-Feb-2009
I’d like to ad one point: be aware about making a system backup image…it’s best to FIRST run all your “anti” software to get rid of all the viruses and malware you have. Otherwise, if you end up having to use the backup image, you’re going to have all the junk you had before you started.
I always turn off system restore because in my situation and the way in which I use my computers it becomes a very irritating and useless feature,
a> if it doesn’t restore user data why does it create restore points for every folder I create and delete?
b> it becomes a resource intensive item when monitoring the 20+ drives in my system,
(Yes I’ve actually made it up to the full disk count of 26, when the last USB drive I plugged in became B: I wish I had another just to see if I would get a windows dialog “no more available drive letters”)
c> system restore can harbor infected system files, not that I’ve ever had an infection on any of my systems but I’ve seen .exe files and .dll files in restore points,
Microsoft documentation System Restore Monitored File Types
d> to see the contents of these RP## folders change the folder options to show hidden & system files & folders and uncheck the “Hide protected OS files” and then right click on “System Volume Information” and change the security permissions to allow inherit from parent permissions and then look through the RP## folders and you’ll see .exe & .dll files
e> also if system restore contains the registry backups you mention then it can also contain those corrupt registry entries created by malware / spyware bad BHOs etc. in fact all the AV and anti-whatever programs such as Spybot Search & Destroy help files tell you to turn off system restore when attempting to recover from an infection.
I recently had to use the system restore that restores the cpu back the the factory installed conditions wiping out all programs I installed. Is there a way or a program that can bring it back? (I do not have the install disk anymore.) I seen some that restores deleted files but do not mention programs.
Hello Leo and all,
I have a PC that creates restore points periodically as expected.
But everytime I try to do a restore I always get a message that the restore could not be done. Try another.
I try others, and always get the same result. This situation has existed for years on this particular PC. Obviously something is wrong with the application/OS.
Do you know of any repair tool availalble?
30-Aug-2011
Leo,
I have been using Norton’s go back for years and it has saved my life dozens of times. It is easy, and you can retrieve email and other files afterwards if you wish.You can go back a week if you want. why has it vanished from sight? Nobody knows about it. But I don’t use it for backups. I use Acronis. Different purpose altogether.
Re:Post by Ron
FIRST run all your “anti” software.
And if time permits, clean some junk of HDD, and check if defragging is due. It’s a good feeling having removed junk/wasted space and having 14Gb less to back-up.