This is actually a synthesized question that reflects an extremely common line of thinking I see in questions and comments I receive.
I can kind of understand the thinking; it might make sense to rely on something called âSystem Restoreâ to restore your system.
Unfortunately, thatâs not even close to what it does. Add a couple of additional pitfalls, and relying on System Restore without completely understanding what it is â and more importantly what it is not â could lead you down a very dangerous path.
Become a Patron of Ask Leo! and go ad-free!
Let me be clear about something right away: System Restore is not a substitute for backing up.
So, why is that?
Because it doesnât back most things up. In fact, System Restore actually operates only on a very few system files and settings.
Iâm going to oversimplify, but in a nutshell: System Restore backs up your registry. It actually backs up some more things, Iâm sure, but for purposes of this discussion weâll think of it as just backing up the registry. In fact, itâs a very good registry backup â when we say âback up your registryâ these days that often means âset a system restore pointâ.
Whatâs more important is what System Restore does not do:
- System Restore does not backup your data. If you delete or damage a file, System Restore will not recover it.
- System Restore does not really âuninstallâ software. If you set a restore point, install software, and then revert to that restore point, the software will appear uninstalled (it will no longer appear on menus and the Add/Remove list), but files and folders created by that software installation may still remain.
- System Restore does not keep old copies of your files or settings. If youâre looking for an âold versionâ of a file or program that you used to have on your machine, System Restore will not have it.
- System Restore will not restore your system. By that I mean that if your system crashes and Windows needs to be repaired or reinstalled, System Restore will not aid in this process.
The Intent of System Restore
System restore is intended for recovery from recent changes to your system. For example, if you do install a new driver or software package that somehow causes your system to misbehave, you can use System restore to âundoâ most of the changes and return to a prior state. Thatâs actually why most setup programs now cause a restore point to be taken prior to starting: so that in the case of failure or some other unexpected event, youâll always have that restore point to go back to.
I want to emphasize the recent nature of restore points. The intent is that they be used to recover from something that happened recently â as in within a day or two. Yes, restore points are often kept for longer periods of time, but the problem is that so much is constantly changing on your system that rolling back to a significantly older restore point can also have unexpected side effects as more changes are undone that you might expect.
Restore Points Disappear Over Time
Windows only keeps a limited number of restore points based on the amount of disk space you have available for it. Once that space fills up, each time a new restore point is taken, older restore points are deleted to make room.
I need to say that again: older restore points are deleted to make room.
A very common variation on the System Restore question is âwhy are there no restore points where I want to go back to?â The answer is that they were probably deleted to make room for newer ones. Restore points are taken at various times, so older restore points are constantly being swapped out to make room for new. As I keep saying, theyâre not meant to be a long term restoration strategy.
Is System Restore Even On?
System Restore may or may not be turned on. If not, youâll free up some disk space, but youâll have no restore points to go back to ⊠ever. This is, in fact how I run my machines. Because System Restore only backs up a limited set of what I actually care about, I turn it off completely and rely instead on a nightly full backup. That way I know that everything â files, settings, applications, whatever â are all backed up and accessible on a momenâs notice, and I can keep those backups for as long as I might choose to.
A related question if someone can answer. Restoring from full image backup would restore even the user data and files to that previous date. Or is there a way to restore ONLY the programs and settings?
More specifically, is there a way to somehow backup the windows updates (and even the MS Office updates) so that when we reinstall it from the recovery DVD (factory fresh image) we do not have to download the hefty updates again?
If yes, does the method involve downloading all the updates again or the already downloaded updates can be used?
The solution many people take is when building out a new machine is to first install everything. Get it all up to date, and then take a full backup snapshot of the machine at that point in time. That way they have a known good image that they can revert to, and would have to take only updates released since that point if they need to revert to it.
-Leo
The ONE thing that I donât really like about Vista is the inability to decide how many restore points/memory is used (as I could in XP). Every week, I run maintenance, and when I run disk cleanup, there are at least 5 gb of restore points saved. Waste of disk space.
Leo, Does Restore (XP) roll back Windows updates? I have a problem with a program that suddenly developed unusual behaviour after a packet of Windows updates was installed. I want to Restore to a date prior to the Windows update to test program behaviour. And if the problem goes away, I will re-install each of the updates testing for the âbaddieâ. Will this work?
-Leo
You can uninstall MS updates from the Add/Remove programs area. You probably will have to put a check in a box at the top to display them.
The best registry backups are made by the free ERUNT progam. Works with Vista and XP. I put this on every customerâs computer. Do some googling. Packrat1947
Thanks RonH. Yes, I was looking to use Add/Remove programs but I could not identify the kbxxx updates that were loaded at the time the problem began. When I selected Update History from Windows Update, the only thing listed was Microsoft Update download (!!!!) and looking in C:\Windows listed about 10 kbâs. I decided to first test my theory of the problem being caused by an update, by Restoring to an earlier date (which I assumed would roll back those updates). The time it would take to uninstall each likely kb, then reinstall the program, would be wasted if an update was not my problem.
So I would still like to know if Restore does roll back Windows updates. Leo???
Thanks, Bevin.
Dear Leo,
This is do with back-ups. I have some difficulty with finding my current active files which must be miniscule compared with your gargantuan back-up base. Can you please give some tips on your âfilingâ system as regards finding specific files in the mass of those that must accrue from your nightly back-up ?
Thank you
Robert George Douglas
As for how I lay things out on my hard drive ⊠well, thatâs been a long evolution over many years as my needs have changed, and likely wouldnât apply to you. Best advice I can offer it to plan a hard drive organization that makes sense to you, and then the backups shoudl follow.
-Leo
I am slightly confused regarding the statement that âSystem Restore does not backup your dataâ. If I inspect my shadows in the shadowstorage (e.g. with Shadow Explorer) I can see all my files that existed at the time the shadow was written and I can even reimport them. The same goes for system files. How does that relate to your statement that I quoted above? Thanks in advance for your answer. WHS
10-Dec-2008
Hi Leo, thanks for the answer. You are right in the sense that a true backup must be to another media. Thatâs why I use Norton Ghost PLUS a very handy Maxtor One Touch disk that I leave disconnected. However, as long as the HDD stays alive (and that is the base case for most folks), it is possible to recover files and folders from the shadows in shadowstorage. And that has come in handy in several instances â especially if they are system files.
Hello Leo,
I heard that having System Restore on could be a security issue. Is this true?
Thank you
18-Feb-2009
Iâd like to ad one point: be aware about making a system backup imageâŠitâs best to FIRST run all your âantiâ software to get rid of all the viruses and malware you have. Otherwise, if you end up having to use the backup image, youâre going to have all the junk you had before you started.
I always turn off system restore because in my situation and the way in which I use my computers it becomes a very irritating and useless feature,
a> if it doesnât restore user data why does it create restore points for every folder I create and delete?
b> it becomes a resource intensive item when monitoring the 20+ drives in my system,
(Yes Iâve actually made it up to the full disk count of 26, when the last USB drive I plugged in became B: I wish I had another just to see if I would get a windows dialog âno more available drive lettersâ)
c> system restore can harbor infected system files, not that Iâve ever had an infection on any of my systems but Iâve seen .exe files and .dll files in restore points,
Microsoft documentation System Restore Monitored File Types
d> to see the contents of these RP## folders change the folder options to show hidden & system files & folders and uncheck the âHide protected OS filesâ and then right click on âSystem Volume Informationâ and change the security permissions to allow inherit from parent permissions and then look through the RP## folders and youâll see .exe & .dll files
e> also if system restore contains the registry backups you mention then it can also contain those corrupt registry entries created by malware / spyware bad BHOs etc. in fact all the AV and anti-whatever programs such as Spybot Search & Destroy help files tell you to turn off system restore when attempting to recover from an infection.
I recently had to use the system restore that restores the cpu back the the factory installed conditions wiping out all programs I installed. Is there a way or a program that can bring it back? (I do not have the install disk anymore.) I seen some that restores deleted files but do not mention programs.
Hello Leo and all,
I have a PC that creates restore points periodically as expected.
But everytime I try to do a restore I always get a message that the restore could not be done. Try another.
I try others, and always get the same result. This situation has existed for years on this particular PC. Obviously something is wrong with the application/OS.
Do you know of any repair tool availalble?
30-Aug-2011
Leo,
I have been using Nortonâs go back for years and it has saved my life dozens of times. It is easy, and you can retrieve email and other files afterwards if you wish.You can go back a week if you want. why has it vanished from sight? Nobody knows about it. But I donât use it for backups. I use Acronis. Different purpose altogether.
Re:Post by Ron
FIRST run all your âantiâ software.
And if time permits, clean some junk of HDD, and check if defragging is due. Itâs a good feeling having removed junk/wasted space and having 14Gb less to back-up.