Restoring Files on a Bootable System

Three common causes of system instability are faulty device software drivers, and improper system settings, and improper application configuration settings. A faulty device driver can cause problems for a device or for the entire computer. Therefore, it is particularly important that administrators always look for certified versions of software drivers before installing them on a computer running Windows XP Professional.

Misconfigured system and application settings can likewise affect a portion or all of Windows XP Professional performance and, in some cases, prevent a computer from booting. Two tools that the administrator can use to deal with driver, system configuration, and application issues include Driver Rollback and System Restore.

Driver Rollback

Driver Rollback is a new Windows feature that allows an administrator to restore the previously installed device driver in the event that the new driver causes a problem. Driver Rollback is managed from Device Manager and can be used to roll back or restore the previous driver (if one exists) for a hardware device. Driver Rollback is limited to only the previous software driver.

The following procedure outlines the steps involved in rolling back or restoring a hardware device software driver.

1. Click on Start and then right-click on My Computer and select Properties. The System Properties dialog appears.

2. Select the Hardware property sheet and click on Device Manager. The Device Manager dialog appears.

3. Expand the hardware tree to display the device whose driver is to be restored and then right-click on the device and select Properties.

4. Select the Driver property sheet, as shown in Figure B.1.

   
   Figure B.1: Accessing Device Driver management options

5. Click on Roll Back Driver and then click on Yes when prompted for confirmation.

Note 

For more information on how to work with the Windows XP Device Manager and its Driver Rollback feature, refer to "Driver Rollback" in Chapter 2, "Installing and Upgrading to Windows XP Professional."

System Restore

In the event that an unsigned device driver is installed, Windows XP's Driver Rollback may not be able to remove it. In that case, another option is to restore computer settings to the way they were in a previous point in time, known as a restore point. This allows administrators to restore the computer to a period of time before:

• A virus ran and corrupted system files

• A software application installed inappropriately altered system settings and files

• A Windows Update corrupted system files

• System settings were incorrectly configured

Restore points are saved on local hard disks. They contain information about critical system and application settings. Restore points do not contain user data. User data can only be restored if regular backups are made. System Restore automatically creates restore points at various times, as outlined below.

• Immediately after Windows XP Professional is first installed

• Every 10 hours of operation

• Every 24 hours, or at startup if the computer is powered off when the next restore point is scheduled

• Before installing an automatic update

• Before installing an unsigned driver

• Before installing a new application

• Before performing a file recovery using Windows XP's Backup utility

• Before performing a system restore

System Restore also allows administrators to manually create restore points. Administrators should create manual restore points before making any significant change to the system, such as editing the boot.ini, system.ini, and win.ini system files or making configuration changes to system services.

Note 

Unless an application is designed to register itself and its critical files with the Windows Installer process, System Restore cannot be used to restore its settings to a previous state.

Configuring System Restore

System Restore is automatically enabled when Windows XP Professional is installed. System Restore manages the files and settings stored on each disk separately. System Restore can be enabled or disabled on a driver-by-driver basis or enabled and disabled for the entire computer. In addition, administrators can configure the amount of space made available to the System Restore process, thus affecting the number of restore points that Windows XP can create and store. If the amount of space available for maintaining restore points is used up, Windows XP will discard old restore points in order to make room for new ones.

Tip 

If a computer has more than one hard disk drive and one or more drives are dedicated exclusively to containing data files, there is no need to leave System Restore enabled on these drives. System Restore only saves critical system and application files and settings.

In order to be able to use System Restore, a computer must be able to boot Windows XP Professional. This means that System Restore can be used when the computer is booted normally or when it is booted using Windows XP Safe Mode.

The following procedure outlines the steps involved in configuring System Restore.

1. Click on Start and then right-click on My Computer and select Properties. The System Properties dialog appears.

2. Select the System Restore property sheet, as shown in Figure B.2.

   
   Figure B.2: System Restore configuration settings from the System Properties dialog

3. To disable System Restore for all drives on the computer, clear the Turn off System Restore on all drives option.

4. To configure an individual drive, select the drive and click on Settings. A dialog similar to the one shown in Figure B.3 appears.

   
   Figure B.3: Configuring a system restore for an individual disk drive

5. To disable System Restore for the selected drive, clear the Turn off System Restore on this drive option.

6. To configure the amount of disk space available to System Restore, move the slider bar left or right. The minimum space setting is 200MB, and the maximum amount of space that can be allocated is 400MB.

7. Click on OK twice.

Creating Restore Points

In addition to the automatic restore points created by System Restore, administrators can create manual restore points. Manual restore points should be created just before an administrator makes a major change to the computer. This way if something goes wrong and the administrator cannot manually undo the change, a restore operation can be attempted.

The following procedure outlines the steps involved in manually creating a restore point.

1. Click on Start/All Programs/Accessories/System Tools and System Restore. The System Restore dialog appears, as shown in Figure B.4.

   
   Figure B.4: The System Restore dialog is used to manually create restore points and to perform a system restore

2. Select Create a restore point and click on Next.

3. Type a descriptive name for the restore point, as demonstrated in Figure B.5, and click on Create.

   
   Figure B.5: Creating a manual restore point

4. System Restore creates the new restore point and then displays its creation date, time, and name. Click on Home to return to the main System Restore dialog or click on Close to terminate System Restore.

Restoring Windows XP Professional

If a new application, device driver, or configuration change is causing a problem, the administrator should always attempt to fix the problem using other Windows XP tools before restoring to System Restore. Try using Driver Rollback to restore to a previous version of a device software driver. Likewise, administrators can use Add/Remove Programs to try to uninstall a problem application. System and application configuration errors should be undone by undoing whatever changes were originally made.

The following procedure outlines the steps involved in performing a system restore.

1. Click on Start/All Programs/Accessories/System Tools and System Restore. The System Restore dialog appears.

2. Select Restore my computer to an earlier time and click on Next. The Select a Restore Point screen appears, as shown in Figure B.6.

   
   Figure B.6: Selecting the restore point to be used to perform a system restore

3. Click on the left or right arrows on the calendar to locate the day containing the restore point to be used. Once selected, all of the restore points created on that day are displayed.

   Tip 

   Since a restore point is automatically created just before a system restore is performed, the administrator can restore the computer back to its previous settings if the restoration produces undesirable effects. The only exception to this occurs when System Restore is used on a computer that was started using a Safe Mode startup option. Automatic restore points are not created when running in Safe Mode and, therefore, cannot be used to restore the computer to the state that it was in just before the last restore was performed.

4. Select a restore point and click on Next.

5. A confirmation screen similar to the one shown in Figure B.7 appears. Verify that the correct restore point has been selected and click on Next.

   
   Figure B.7: System Restore requires confirmation before continuing

6. System Restore applies the settings saved in the selected restore point and then restarts the computer. When the computer completes its restart, the Restoration Complete screen is displayed. Click on OK.

Undoing a System Restore

In the event that the system restore is performed but does not resolve the problem or leads to a bigger problem, the administrator has several options, including:

• Troubleshooting the current situation

• Restoring to a different point in time

• Undoing the last restoration

Normally, the Welcome to System Restore dialog shown in Figure B.4 displays the following options:

• Restore my computer to an earlier time

• Create a restore point

However, if a restore was recently performed, the following option will also be displayed:

• Undo my last restoration

The following procedure outlines the steps involved in undoing a recently applied restore point.

1. Click on Start/All Programs/Accessories/System Tools and System Restore. The System Restore dialog appears.

2. Select Undo my last restoration and click on Next.

3. System Restore prompts for the confirmation. Close any open applications and click on Next.

4. System Restore applies the settings saved in the selected restore point and then restarts the computer. When the computer completes its restart, the Restoration Complete screen is displayed. Click on OK.

Clearing Out Bad Restore Points

Administrators may also use System Restore to restore a computer to a previous state in the event that a virus infects the computer and corrupts system settings. If after removing the virus from the computer, the administrator suspects that the virus may have been active on the computer for a long period, it may not be desirable to use any existing restore points because use of one of the restore points might bring back the virus. In that case, the administrator will have to manually reconfigure computer and application settings. In addition, the administrator should remove any existing restore points to ensure that they will not be available later.

To clear out all existing restore points, the administrator needs to disable and then re-enable System Restore. The following procedure explains the steps involved in completing this task.

1. Click on Start and then right click on My Computer and select Properties. The System Properties dialog appears.

2. Select the System Restore property sheet.

3. Clear the Turn off System Restore on all drives option and click on OK.

4. Click on Yes when prompted to restart the computer.

5. Click on Start and then right click on My Computer and select Properties. The System Properties dialog appears.

6. Select the System Restore property sheet.

7. Select the Turn off System Restore on all drives option and click on OK.