Using System Restore

New to Windows XP, the System Restore function recalls a similar functionality first introduced with Windows Millennium Edition. Using System Restore enables you to "rollback" the operating system to one of the restore points that fix the system state at the moment when the system was stable and worked correctly. A particular advantage of this tool is that it is user-friendly, and enables you to recover the damaged system quickly without performing tedious troubleshooting procedures or even reinstalling the operating system. System Restore doesn't overwrite user files, such as documents, spreadsheets, mail messages, archives, etc. Therefore, this function must become your first line of defense.

System Restore contains the following two components:

• File monitoring tool. File monitoring is performed by the kernel-level file system driver that tracks all the changes to the predefined set of system files and application files. The list of files to be monitored is stored in the Filelist.xml file located in the %Systemroot%\system32\restore directory. Notice that the following files and folders are excluded from the monitoring process:

  • Virtual memory paging file.

  • User data (the contents of the folders such as My Documents, Recycle Bin, Temporary Internet Files, History, and Temp).

  • Graphical files with filename extensions such as BMP, JPG, EPS and so on, and data files with filename extensions such as DOC, XLS, MDB, PST, PDF, etc.

• Restore points. Restore points are "snapshots" of the system state (including, of course, the registry), which are regularly saved to the hard drive. Restore points are created according to the specified schedule (for example, every day after successful logon) or based on system events (for example, installation of new applications or device drivers). Besides, the users can manually create restore points as necessary.

Creating a Restore Point

The process of creating restore points is straightforward. To create a new restore point manually, do the following:

1. Start the System Restore utility. You can do this using various methods:

   • From the Start menu, select All Programs | Accessories | System Tools | System Restore.

   • From the Start menu, select Run and enter the following command in the Open field: %Systemroot%\system32\restore\rstrui.exe.

   • From the Start menu, select Help and Support, then select the System Restore command from the Tools menu.

2. The first screen of the System Restore utility will appear (Fig. 2.1). Set the Create a restore point radio button, then click Next.

   
   Fig. 2.1: The System Restore Welcome screen

3. The next window will open (Fig. 2.2). Here you will be prompted to enter the restore point description. Enter the description string in the Restore Point description field and click Create.

   
   Fig. 2.2: Entering the restore point description

4. The restore point will then be created. The final window of System Restore will open, prompting you to either close the System Restore application or return to the first screen by clicking Home.

Restoring the System State Using System Restore

To restore the system using one of the existing restore points, proceed as follows:

1. Start the System Restore application.

2. In the first window, set the Restore my computer to an earlier time radio button and click Next.

3. The Select a Restore Point window will appear (Fig. 2.3). Select one of the existing restore points and click Next. To help the user with selecting a restore point, System Restore displays a calendar, using which you can determine the dates when the restore points were made. If you spend a lot of time working on the computer, then some dates will have two or more restore points, as shown in the example presented here. On the other hand, restore points will not be created for days when you did not use your computer.

   
   Fig. 2.3: Selecting the restore point in the Select a Restore Point window

4. In the final window, Confirm Restore Point, you'll be prompted to confirm the procedure of restoring the system using the restore point that you have just selected. To continue, click Next.

5. After you select the restore point and confirm the restoration procedure, System Restore will read the change logs and create the restore map based on the log information. The system will be returned to the state that existed at the moment of creation of the selected restore point according to this map. System Restore will then process the restore map, undo all the changes introduced to the files, replace the system registry with the backup copy included into the snapshot, and, finally, reboot the system.

6. After reboot, System Restore will display a window informing you of the results of the restore operation (Fig. 2.4). It should be noticed that successful restore operations are reversible; therefore, you can undo the results of a restore operation and select another restore point, if necessary. To do so, select the Undo my last restoration option in the Welcome to System Restore window.

   
   Fig. 2.4: The Restoration Complete window

Configuring System Restore

Notice that System Restore requires no less than 200 MB of free disk space. If you are short of disk space, the System Restore function will be automatically disabled. Later, when you free up the required amount of disk space, you'll be able to re-enable System Restore. However, all your restore points will be lost, because System Restore is no longer able to track changes and, therefore, can't undo them. Furthermore, if you have less than 200 MB of free disk space upon installation of Windows XP, you'll have to manually enable System Restore after freeing up the required disk space.

Note 

Don't configure System Restore in parallel with software installation procedures, because this may corrupt the initial restore point that System Restore creates when you re-enable it, as well as all subsequent restore points. Notice that there is no way to determine if the initial restore point is corrupt.

To enable, disable, or configure System Restore manually, proceed as follows:

1. Start the System applet in Control Panel. Go to the System Restore tab of the System Properties window (Fig. 2.5).

   
   Fig. 2.5: The System Restore tab of the System Properties window

2. To disable System Restore on all local hard drives, set the Turn off System Restore on all drives checkbox. If you need to re-enable System Restore, clear this checkbox, then click OK.

3. If you need to set individual System Restore options for each hard drive, select the drive or partition for which you need to configure System Restore from the Available drives list. Click the Settings button to open the window that allows for setting the System Restore parameters for the selected drive (Fig. 2.6).

   
   Fig. 2.6: System Restore settings for the system partition

Note 

System Restore can consume up to 12 percent of the available free disk space on disks larger than 4 GB and up to 400 MB on disks less than 4 GB. Depending on your individual requirements and available free disk space, you can manage the amount of disk space reserved for storing System Restore archives on each of the local hard drives. This can be done using the Disk space to use slider. Notice that the system won't allow you to disable System Restore for the system partition without disabling it on all the remaining drives (Fig. 2.6). However, you can exclude any other drive from the list of those used for storing System Restore archives by setting the Turn off System Restore on this drive checkbox (Fig. 2.7).

Fig. 2.7: Any local hard drive, except the System partition, can be excluded from the list of disks used by System Restore

Note 

On NTFS drives, System Restore compresses archived data. This operation is done when the computer is idle. Besides, System Restore periodically clears the archives using the FIFO (First In First Out) algorithm based on the restore point creation dates and the amount of available disk space.

System Restore automatically creates restore points according to the following rules:

• Daily. System Restore creates a restore point every 24 hours (provided that the computer is on), and if more than 24 hours has elapsed since the last restore point was created.

• Periodically. By default, this capability is disabled, and the user interface does not provide the capability to configure it. To configure System Restore in such a way as to create a restore point periodically, use the group policy or edit the system registry More detailed information on this topic will be provided later in this book.

Troubleshooting System Restore

This section provides step-by-step instructions on performing basic troubleshooting procedures when you have problems with System Restore:

1. Make sure that the System Restore service is up and running. This can be done using two methods. First, you can start the Administrative Tools applet in Control Panel, then select Computer Management | Services and Applications (Fig. 2.8). Check if the System Restore Service is started. There is a quick way of performing the same operation. Click Start | Run, type Cmd, and press the <Enter> key, then run the Net Start command at the command prompt to view the list of running services and make sure that the System Restore service is included into this list.

   
   Fig. 2.8: When troubleshooting System Restore, first make sure that the System Restore service is started

2. Make sure that System Restore is enabled on all the drives that you want System Restore to be enabled on, then check if you have enough disk space on these drives.

3. If you suspect that you do not have as many restore points as you should have, make sure that the data store is the size that you want it to be.

4. View the System event log to find out if there are errors related to the System Restore service. To do so, start Administrative Tools in Control Panel, then select Computer Management | Event Viewer | System. Click the Source column to sort events by name, and then look for the srservice string. Investigate the event description, since it may provide an indication of the cause of the problem. Most System Restore issues generate an error message that contains a description of the issue and suggestions on how to resolve the problem.