Help me understand the restore system function

I need help understanding what changes and what remains unchanged when you restore your system to an earlier time using the "system restore" process in Windows XP. For example, will applications installed or updated between the current date and the "system restore" date that one selects be eliminated or the updates deleted therefore requiring a full re-installation of the application or of its updates?

 

System Restore returns your computer to the operating state it was in at the date and time the Restore Point was created that you choose to use.
If something was updated, and not updated in the RP, no, it isn't any longer.
If that Restore Point was infected with a virus, you will be infected.
If a program was installed and not when the Restore Point was created, it will no longer be installed, but the C:\Programs\programfolder
directory will still be there.

 

Hello chetonbbs,

To add to Mark's answer,

File types SR monitors, meaning the files with these extensions would be restored, for example .exe, that would mean any application programs installed by you:
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/sr/sr/monitored_file_extensions.asp

You might also search here for System Restore, a great many threads on SR, covering a lot of aspects of it.

Regards - Charles

 

Do not put your full trust in Windows to handle System Restore. It will may/can ( and has ) let me down.

System Restore also seems to be one of them things that may well vary in behavior between systems.

System Restore is something that you not only need to know what it supposed to do but how to check to be sure it has done what it is supposed to.

Before you do too much, learn how to check to see if there are any RPs. And how to make your own. And even how to restore if you wish to. I think you will find it time well spent.

System Restore is ( can be ) a great help if used with a bit of common sense and at times a bit of planning.

If all is well or if have problems and/or you are going to make changes in ANY WAY. Add/remove software etc. Or any kind of setting that you want to keep. I suggest that you shutdown and restart SR. Then open SR and MAKE SURE it has done its' job.

Then make your Changes. Add/remove Software. Then as you makes changes create a new RP and name it lets say AfterStep1. Make more changes if you want and make a RP AfterStep2. By doing this if the changes in AfterStep1 were Ok but something in Step2 messes up you DO NOT NEED to go all the way back to the beginning.

Once you get everything done wait a day or two to be sure all is going to stay well then shutdown and restart SR. This will give you a RP of the system as it is.

Most ( not all ) software makes a RP before installing. But that may not be consistant either. ( here is where I got BURNED ) So again it pays to check things out first.

Now I do have a question of my own. But it also I believe fits in here nicely.

Does System Restore use the same clock as the one that shows in the Systray ?

If so then could that be why my SR was not making any RPs. I had it set for 3:00 PM. But the Clock was showing it to be AM at that actuall time.

Can't blame Windows for that one. Because It could ( I believe ) be due to a weak Battery. Or Ol' BillyBob here just plain messed up. I believe a weak battery would have brought up A LOT more problems than just the clock.

BillyBob

 

Thanks to all

Thanks to Markp62, Charlesvar and BillyBob. Your clear responses and suggestions are very helpful. Keep it up. This is a great BBS service. Just enrolled as a lifetime member after reading your responses and help I received earlier from Noahdfear. Excellent investment.

BillyBob, can't explain the clock issue.

 

Symantec advises to turn it off, for reasons mentioned above.
Once infected, the virus will stay.

A

 

I would not shut it of untill cleanup was done. Just in case the Cleanup goes bad. If it does then you will have a place to start over.

But once the cleanup is done and all is OK then DEFFINETLY turn it off. And restart it so that it has a RP of the cleaned up system.

Now I have question of my own that I think may fit in here.

I have had different views about whether to have SR activated on ALL partitions if same do exist. I myself only have SR setup on the C: ( OS ) drive. I see no need for it on the other partitions.

BillyBob

 

I agree, no point in having SR monitor user data, it's hit and miss anyway. Other backup procedures should be used.

Using SR to guard the OS only is the way to have the least amount of problems/supprises.

Regards - Charles

 

Hi, BillyBob!
I agree with you. There is no point in running SR on any partition that does not hold an OS. AFAIK, SR does depend on the system clock, so if you had SR set to run while your comp was shut off, that explains why no auto RPs were made. Whew! I thought you had a ghost in there! (A mean one! )

For anyone doing a search for SR on the BBS- use Zander, Christer or Charlesvar to narrow it down. They explained SR well in a couple of different threads that I can remember. The best way to use SR is to know exactly how it works, so there is a reasonable expectation. Restore points are cumulative, and since you don't want to accidently restore a problem, when in doubt, wipe them out. The easiest way to delete old restore points is to toggle the on/off setting. You can also delete all but the last one made.

Johanna

 

Another thought and something that I have run into.

If you do have more than one partition.

If you do add/remove software on one of the other partitions.

Be sure a new Restore Point is made. And old ones sent flying.

I can just hear the question coming WHY!!! ??

Because EVERYTHING on the machine is in some way recorded ( registered ) in the Registry. ( I did not think so either till I ran into it )

I removed some no longer used programs from say the E: drive. I did clean up the registry and made a new RP. As a test I did a SR to a previous one. YUCK!!! everything was back in the registry and I had all kinds of " Can't find messages. "

And if I had added something it would have caused problems too. Different errors maybe. But still could be a problem. At least the progam may not work.

Add/Remove/Change can all create problems.

Bottom line. ( mine anyway )
Restore Points must be kept up todate with the machine.

BillyBob

 

This isn't a reply so much as another question about System Restore. I have had occasion it use it in the past and it has worked perfectly well. Recently, I tried it again and it seems to have stopped working. I have always gone to a 'restore point' but after some delay get the message "System Restore cannot restore your system. Nothing has been changed. Try another date." (Or words to that effect.) So I do and go further and further back and get the same message. It is not working.

I went to the Microsoft website for System Restore and checked out the possibilities but everything I tried made no difference. According to the Task Manager everything is up and running but SR is NOT working.

Anyone have suggestions?

Many thanks,
Lochinvar

 

Hello Lochinvar,

I went to the Microsoft website for System Restore and checked out the possibilities
Do a search here as well.

System Restore doesn't work:

One reason - the space allocated to System Volume Information is filled to the maximum which is 12% of Drive space. Neither XP or WinME handle this situation well.

To make room: right click on My Computer > Properties > System Restore tab and for the Monitored drive > settings. Move the slider left to 6% and reboot, reset the slider back to 12%.

Try the above first and you can test it, see below.



Another reason - You may have a corrupt restore point somewhere in the chain of Restore Points, the integrity of each restore point is dependent on the previous one.

Shut SR off: My Computer > Properties > System Retore tab > Check "Turn off System Restore on all drives ".

Reboot.

Go back and re-enable SR - will create an initial restore point.

After re-establishing SR, a way to test the Restore function:
Take any executable file ( extention .exe) , and burn it out and/or move it to the My Documents folder and delete it from it's original location. SR does not monitor files in My Documents folder regardless of file type.

Then restore to the initial restore point created by the system; the deleted executable should be back in it's original location. Afterwards, you can delete the copy in My Documents.

Regards - Charles

 

Charles,
It worked! I followed the steps you suggested and it seems I did have a corrupted 'restore point' somewhere. I simply went back to the last one set and it performed flawlessly.

Many thanks,
Lochinvar