Office Hours: Monday - Friday  --  8:30am - 4:30pm CST

Home » Support » FAQ » How to restore your PC to an earlier date

How to restore your PC to an earlier date

What is System Restore?

Answer: The System Restore feature of Microsoft Windows XP enables administrators to restore their PCs, in the event of a problem, to a previous state without losing personal data files (such as Word documents, drawings, or e-mail). System Restore actively monitors system file changes and some application file changes to record or store previous versions before the changes occurred. Users never have to think about taking system snapshots as System Restore automatically creates easily identifiable restore points, which the users can use to revert the system back to a previous time. Restore points are created at the time of significant system events (such as application or driver install) and periodically (every day). Additionally, users can create and name their own restore points at any time. For more information please visit:

http://www.microsoft.com/resources/documentation/windows/xp/all/reskit/en-us/prmb_tol_fngj.asp.

Which versions of Windows have System Restore?

Answer: System Restore is available in Windows Millennium (Me) and the Windows XP (Home and Professional) Operating Systems. This FAQ addresses questions and issues with System Restore in Windows XP only.

How is System Restore different from Backup?

Answer: Unlike System Restore which monitors only a core set of specified system and application file types (e.g. .exe, .dll etc), the Backup Utility usually backs up all files including users personal data files, ensuring a safe copy stored either on the local disk or to another medium. System Restore does not monitor changes to or recover users' personal data files such as documents, drawings, e-mail, and so forth. While system data contained in System Restore's restore points are available to restore to for only a limited period of time (by default restore points older than 90 days are deleted), backups taken by the Backup Utility can be recovered anytime.

Do I as a user have to do anything to ensure I have System Restore protection? Answer: System Restore is enabled by default and will run upon the successful completion of either the Windows XP Professional or Personal x86 version installation. It does require a minimum of 200 MB of free space available on the system partition. If there are not 200 MBs available, System Restore will install disabled and will enable itself automatically once the required disk space is available. With System Restore, you also never have to worry about taking system snapshots as it will automatically create easily identifiable restore points, which allows you to revert the system back to a previous time. Restore points are created at the time of significant system events (such as application or driver install) and periodically (every day). Additionally, you can create and name your own restore points at any time. You also never have to worry about System Restore filling up your hard drive with these restore points. By default it only takes up to a max of 12% of your disk space and has an automatic restore point space-management feature that purges the oldest restore points to make room for new ones, so that a rolling safety net is always kept under the user, enabling you to recover from recent undesirable changes.

Does System Restore cause any performance loss on my System?

Answer: No, System Restore does not cause any noticeable performance impact when monitoring your machine. The creation of a Restore point also is a very fast process and usually takes only a few seconds. Scheduled System Checkpoints (every 24 Hrs by default) are also only created at system idle time so that their creation never interferes with any user using the machine.

Who can use System Restore on a machine?

Answer: Only users with administrative rights on the machine can use System Restore to restore and to adjust System Restore settings on that machine. However, creation of automatic restore points (System check points or event driven Restore Points) on the machine takes place regardless of which user is logged onto the machine, for e.g. if only a non admin user is logged on to a machine, System Checkpoints or event driven checkpoints will still be created on that machine to ensure System Restore protection and only the user with admin privileges however will be able to restore the machine.

Does System restore protect my personal data files like word documents, email etc.?

Answer: System Restore does not monitor changes to or recover users' personal data files such as documents, drawings, e-mail, and so forth. Also see 'What files are monitored by System Restore?'.

What files are monitored by System Restore?

Answer: System Restore monitors only a core set of specified system and application file types (e.g. .exe, .dll etc), archiving the states of these files before system changes are made. System Restore does not monitor any user/personal data files. To view the included files specified in System Restore, see Monitored File Extensions in the System Restore section of the Platform SDK available from http://msdn.microsoft.com/library/en-us/sr/sr/monitored_file_extensions.asp. Modifications to this list from sources other than Microsoft are not supported.

How does System Restore handle passwords?

Answer: System restore handles passwords in the following manner:

Passwords That Are Not Restored:

• Windows XP passwords and hints are not restored. This behavior is by design to prevent confusion and to prevent you from getting locked out of your computer because the restore point includes an old password that you do not remember.
• Microsoft Internet Explorer and Content Advisor passwords and hints are not restored. This behavior is by design to prevent confusion and to prevent problems that could occur when you browse the Internet, in the event that you restore your system to a point with an old password that you do not remember.

Passwords That Are Restored:

• Program passwords are restored, such as Windows Messenger, AOL Messenger, Yahoo Messenger, and other Web server-based passwords. This behavior is by design: The programs simply cache these passwords on the machine; the actual passwords are stored on a Web server. System Restore does not actually change the password, but it changes the password that is remembered by the program locally. You still need to use the current password for the program to log on to the server.
• Domain and Computer passwords for the machine are also cached in a similar way and are restored by System Restore. As System Restore only rolls back the local machine state and part of the information about joining domains resides in Active Directory which is not rolled back by System Restore, the restored cached password will be updated to the current password as soon as the machine reconnects to the domain.

Does System Restore uninstall my program if I restore to a point before the program was installed?

Answer: No, System Restore does not completely uninstall any program by itself if restoring to a point prior to the program installation. Since system restore is based on an inclusionary model, any file added or modified by the installation which System Restore does not monitor or files added to or modified in a non monitored drive will not be tracked by System Restore. Thus System Restore cannot delete or undo any modifications made to these files. To remove all the changes an installation may have made on the system, the user should first use the Add/Remove option in the control panel to remove the application prior to using System Restore. System Restore however will undo all recorded changes made to the registry & monitored files caused by the application install including:

• Delete monitored files the program installation may have added to the system
• Undo modifications to monitored files made by the installation
• Replace the current registry with the registry snapshot taken when the restore point chosen was created. (*note: some current values will persist)
• Any file type not monitored by System Restore added or modified on the system will not be restored or removed. E.g. .jpg, .txt files.

What is restored on my machine when I use System Restore and what is not?

Answer: The following are restored when you use System Restore to restore your system to a previous time using a restore point:

• Registry
• Profiles (local only—roaming user profiles not impacted by restore)
• COM+ DB
• WFP.dll cache
• WMI DB
• IIS Metabase
• Files type which are monitored by System Restore as specified in the SDK available from http://msdn.microsoft.com/library/en-us/sr/sr/monitored_file_extensions.asp.

The following are not restored by System Restore:

• DRM settings
• Passwords in the SAM hive
• WPA settings (Windows authentication information is not restored)
• Specific directories/files listed in the Monitored File Extensions list in the System Restore section of the Platform SDK e.g. 'My Documents' folder
• Any file types not monitored by System Restore like personal data files e.g. .doc, .jpg, .txt etc
• Items listed in both Filesnottobackup and KeysnottoRestore (hklm->system->controlset001->control->backuprestore->filesnottobackup and keysnottorestore) in the registry
• User-created data stored in the user profile
• Contents of redirected folders

Why does System Restore delete some of my downloaded or saved files/executables during a restore?

Answer: As System Restore monitors a core set of specified system and application file types, any downloaded or saved file which has an extension type monitored by System Restore (e.g. .exe, .dlls) and stored on a monitored drive will be lost if restoring to a point prior to the download or save. If you do not want to lose files with a monitored extension due to a restore, you should move these files to the 'My Documents' folder or to a non monitored partition which will not be restored during a restore process. If you have unknowingly deleted some files due to a restore on your system, you can always get them back by undoing that restore process.

When are Restore Points created on my machine?

Answer: The user can manually create a restore point at any time on their machine using the System Restore wizard. Restore Points are also automatically created on your machine when:

• Installing an unsigned device driver
• Installing System Restore compliant applications (Installing an application that uses Windows Installer, or Install Shield Pro version 7.0 or later, causes System Restore to create a restore point.)
• Installing an update by using Automatic Updates
• Performing a System Restore operation so the user can undo that restore operation if needed
• Restoring data from backup media using the Backup tool
• Creating daily restore points (System Restore creates a restore point every 24 hours if the computer is turned on, or if it has been 24 hours since the last restore point was created.)

Can I make System Restore permanently store a restore point so it is always available to restore to?

Answer: No, you cannot make System Restore store a restore point permanently to always restore back to. System Restores current architecture is unable to support this as it is a change base tracking tool and not an imaging or backup tool. Each restore point only stores changes to the system since the creation of the previous restore point to minimize space usage and improve performance and so all the restore points are associated to each other. Thus, restoring the machine from the current state to a previous state requires the availability of all restore points created in between to undo changes tracked inside them. For e.g. when a user wants to restore the machine from point D to a point A, System Restore will work through the changes made to the system and recorded in the change logs for each point C, then B and then A as these restore points collectively hold all the changes to the system since point A and so are needed to undo all the changes made to the system. It will then create a roadmap for recovery using these restore points and restore the system.

If a restore point was made a permanent restore point, space usage for storing the complete chain of restore points since the creation of the permanent restore point would in due course become very large and not be practical. System Restore also has an automatic restore point space-management feature that purges the oldest restore points to make room for new ones, so that a rolling safety net is always kept under the user, enabling the user to recover from recent undesirable changes. By Default any restore point older than 90 days will be purged automatically by System Restore.

How does an improper shutdown affect System Restore?

Answer: If an improper shutdown happens and a restore is done to a point before the improper shutdown, there is a small possibility that such a restore might fail, due to the fact that some file operations might not have been logged properly by System Restore at the time of the improper shutdown. If the restore fails, the system will be in the same state as before the restore was initiated.

How much disk space does System Restore use on my system by default?

Answer:

• For drives greater than 4Gb, System Restore takes up to 12% of the disk space by default to store the restore point information in its data store.
• For drives below 4Gb, System Restore by default only uses up to 400MB of the disk space to store restore point information
• The data store size is not a reserved space on the disk and the size to which it can grow (up to the max values defined above) is limited at any time by the amount of free space available on disk. Thus, if disk-space use encroaches on the data store size, System Restore always yields its data store space to the system.

For example, if the data store size is configured to 500 MB, of which 200 MB is already used, and the current free hard-disk space is only 150 MB, the effective size of the data store is 350 MB (200 + 150), not 500 MB. For more information on how System Restore Handles Hard-Disk Space Usage please visit http://support.microsoft.com/default.aspx?scid=kb;en-us;300044.

• The space usage can be adjusted at any time by the user as described in 'How can I adjust how much space System Restore uses on my disk?'.

Does System Restore support scripting?

Answer: Yes, System Restore parameters are configurable remotely or locally by using a Windows Management Instrumentation (WMI) script. A WMI script can also be used to create restore points, list them, select a restore point to restore to, and view the status of a restore operation. Also see 'How do I use scripts with System Restore?'.

How can I enable/disable System Restore on my machine?

Answer: To enable/disable System Restore, go to the Control Panel ('Start > Control Panel') and double click the 'System' icon. Then:

1. Click on the 'System Restore' tab on the system applet
2. Check mark 'turn off system restore on all drives' to turn off system restore on the system
3. Uncheck the box to enable System Restore monitoring on the system
4. Click OK when done

How can I disable System Restore from monitoring a particular drive?

Answer: To disable system restore from monitoring a particular drive go to the Control Panel ('Start > Control Panel') and double click the 'System' icon. Then click on the 'System Restore' tab on the system applet. Depending on your disk setup use the following instructions:

• If you have just a single partition: You can only turn off system restore on/off for the system. Check mark 'turn off system restore on all drives' to turn off system restore on the system
• If you have multiple disks or partitions on your systems: Click on the drive you want to stop System Restore from monitoring and then click the settings option. Check mark the box for 'turn off system restore on this drive" to disable monitoring of that drive. You cannot disable monitoring of the system drive explicitly. You will need to disable System Restore on the whole system to stop it from monitoring the system drive.

How can I adjust how much space System Restore uses on my disk?

Answer: To adjust the amount of space System Restore uses on a disk, go to the Control Panel ('Start > Control Panel') and double click the 'System' icon. Then click on the 'System Restore' tab on the system applet. Depending on your disk setup use the following instructions:

• If you have just a single partition on your system: You can adjust the space system restore uses on the disk by moving the slider on this page left (to decrease space usage) or right (to increase space usage. The maximum space usage is 12% and is the default
• If you have a multiple partitions on your system or multiple disks: Click on the drive you want to adjust in the available drives section on the System Restore page and then click the settings option. You can then adjust the space system restore uses on that drive by moving the slider to the left (to decrease space usage) or right (to increase space usage). The maximum space usage is 12% and is the default. Repeat for each drive as necessary.

How do I tell how much space system restore is currently using to store my restore points?

Answer: To check how much space System Restore is actually using up on your disk use the following steps:

1. Open 'My computer' from the Start menu
2. From the toolbar go to 'Tools > Folder Options' menu and then click the 'View' tab
3. In the advanced settings option for Hidden files and folders ensure the 'show hidden files and folders' option is selected. Also ensure that 'Hide protected operating system files' option is unchecked.
4. Then click 'OK'.Go to your system drive (the drive where windows is installed, generally the C: drive for most users) and look for the 'System Volume Information' folder
5. Double Click the 'System Volume Information' folder
6. Inside you will find a '_restore' directory.
7. Right click this directory and click on the 'Properties' option
8. The 'Size on Disk' value is how much space system restore is using on this drive to store the restore points
9. Repeat as necessary for other drives on the system you may have System Restore monitoring.

If your computer is part of a domain and you do not have access to the 'System Volume Information' Folder, please perform the following additional steps after step 4 above:

1. Right click the 'System Volume Information' folder and click the 'Properties' option for the folder.
2. Go to the security tab and add your username to the user/group list which have access to this folder. Without doing this you will not be allowed access to this folder
3. Once you have completed the above step, click 'OK' and then continue from step five above.

How do I delete System Restore restore points I do not need?

Answer: You have the option to delete all but the latest restore point from your machine or delete all the restore points on your machine. To do this

1. To delete all but the latest restore point on your machine by using the disk cleanup utility: Go to 'Start > All Programs > Accessories > System Tools > Disk Cleanup'. Click on the more options tab and then click 'Clean up' in the System Restore box
2. To delete all the restore points on your machine disable and re-enable system restore on the system: Go to the Control Panel ('Start > Control Panel') and open the 'System' applet. Click on the 'System Restore' tab on the system applet. Check mark 'turn off system restore on all drives' and click the apply button. Then uncheck the box again to re-enable System Restore on the machine and click OK
3. You can also reduce the number of restore points saved on your machine by lowering the total amount of disk space available to system restore. Remember that the lower the disk space available to system restore, the lower the number of restore points that will be available on your machine and smaller the safety net available to you through System Restore.. To do this please see 'How can I adjust how much space System Restore uses on my disk?'

How do I use scripts with System Restore?

Answer: WMI scripts can be used to locally or remotely create restore points, list them, select a restore point to restore to, view the status of a restore operation and adjust system restore parameters. Please refer to the Scriptingexamples.doc available from http://www.microsoft.com/WindowsXP/pro/techinfo/productdoc/scriptsamples.asp which contains functions and parameter descriptions, along with script samples, which are provided as a guide to administrators who need local or remote access to the System Restore features and settings. Also see: http://support.microsoft.com/default.aspx?scid=kb;en-us;295299&sd=tech.

How can I perform a system restore remotely on my Machine?

Answer: You can perform a system restore remotely on the machine using WMI scripts. Please refer to 'How do I use scripts with System Restore?'

What are some general steps I should take if System Restore does not work on my machine?

Answer: If you are receiving errors using system restore please ensure the following on your machine:

1. The System Restore service is running. See 'How can I verify that the System Restore services are running on my machine?'
2. Make sure the task scheduler is running on your machine. See 'How can I verify that the Task Scheduler is running on my machine?'
3. Verify that you have enough free space on all your drives as required by System Restore. If the free space on any partition system restore is monitoring falls below 50MB, System Restore will suspend and purge out all restore points to free up disk space. It will automatically thaw itself when 200Mb+ free space is again available. For more info on how System Restore uses disk space also see: http://support.microsoft.com/default.aspx?scid=kb;en-us;300044&sd=tech.
4. Look at the event logs to investigate any system restore related errors which could help you identify the problem. See 'How do I look at the event logs to investigate any system restore errors?'

Why is System Restore suspended on my machine although I have enough free space on my system drive?

Answer: This can occur when the following conditions are true:

• A drive that is not a system drive that has System Restore enabled on it has reached less than 50 MB of free disk space.
• A copy, delete, modify operation was made to a file that is monitored by System Restore on such drive.

This will cause System Restore to suspend across the system. To resolve this issue please visit http://support.microsoft.com/default.aspx?scid=kb;EN-US;299904.

When I run System Restore I get the error 'System restore was unable to start due to a missing Framedyn.dll. Please reinstall the application to fix this problem'. How do I fix this?

Answer: This error seems to happen when the Windows path on your machine has been corrupted. To temporarily address this issue copy the framedyn.dll file from the \windows\system32\wbem directory to the \windows\system32 directory. If you cannot see the .dll file in the …\Wbem folder please see 'Why cannot I see system files like .dll's or .inf's in Windows?'

Why is system restore not creating automatic System Checkpoints on my machine?

Answer: There are two possible reasons for this:

• System Restore requires the Task Scheduler to be enabled on the machine to create System Checkpoints. If you or some application has purposely or accidentally disabled the task scheduler on the machine, it will prevent System Restore from creating System Checkpoints on a scheduled basis. To correct this problem please refer to 'How can I verify that the Task Scheduler is running on my machine?'
• System Restore requires the machine to be in an idle state to create system check points. This is by design so that System Restore never intrudes when the user is using the machine by taking processing power to create a system checkpoint. Hence, if system restore never sees any idle time on the machine, it will not be able to create System Checkpoints. Often users may have some application which is also operating during idle time like a virus scanner or disk utility software. This again may cause System Restore to never get any idle time. Try disabling any software you may have had running at idle time and see if that solves your problem, for e.g. Running the software SetiSpy has been known to cause this issue
• Another cause of this could be scenarios where the user may be turning on the system for only a limited portion of time per day, continuously using the machine thus not giving it any idle time and then immediately powering it off or hibernating. Again System Restore wont be able to see any idle time to create restore points as when the system is powered on it is being constantly used by the user (hence no idle time) and is then immediately being powered off or sent to hibernation.

Why are my System Restore restore points missing or deleted?

Answer: One of the common reasons for this is when you run out of free disk space on the system drive or on any of the available non-system drives being monitored by System Restore, and so System Restore starts purging restore points consistently across all monitored partitions to free disk space . If the free disk space falls below 50MB on any monitored partition, System Restore stops monitoring your system and suspends. This causes System Restore to purge all restore points in an attempt to free up the remaining disk space. However, you should have already received a warning about running low in disk space prior to this. To better understand this issue and for other possible causes please visit the following URL: http://support.microsoft.com/default.aspx?scid=kb;EN-US;301224.

I don't have any restore points to restore to cause System Restore displays a blank calendar in Windows XP?

Answer: This behavior can occur if the file association for Hypertext Markup Language (HTML) component (.htc) files is not in the registry. Please refer to the following URL to address this issue: http://support.microsoft.com/default.aspx?scid=kb;EN-US;313853.

Why do I lose my Remote Assistance session after using System Restore?

Answer: When you use System Restore to restore to a point before the Remote Assistance Ticket creation, the HelpAssistant account password is reset. The HelpAssistant account is the account that the Expert uses to log on and connect to the Novice's computer. To work around this behavior, use Remote Assistance to create another ticket and send this new ticket to the Expert. Also See: http://support.microsoft.com/default.aspx?scid=kb;en-us;304689&sd=tech.

What should I do if my anti-virus scanner cannot access the System Volume Information folder to remove a virus? Answer: If the System Volume Information (SVI) folder is on a FAT partition and a virus infected file has been detected or copied to the data store before it was cleaned, the data store needs to be purged to remove the Restore Point with the infected file. To do this, the user should disable and then re-enable System Restore monitoring on that particular drive as specified in 'How can I disable System Restore from monitoring a particular drive?'. Where the System Volume Information Folder is on an NTFS partition, the SVI directory can be accessed in the admin context by the virus utility to clean an infected file as any other part of the file system and this should not be an issue.

Microsoft support is asking me to generate a .cab file for system restore. How do I do this?

To generate a system restore Cab file please use the following procedure:

1. Click Start, click Run
2. Type or paste the following: "%windir%\system32\restore\srdiag.exe" (without the quotation marks) and either press Enter or click OK.
3. A CMD window will open while the Srdiag.exe runs. The CMD session will automatically close when complete, and the .CAB file will be created as desired in your 'Windows\system32\restore' directory. Please be patient as this could take a couple of minutes.

How do I look at the event logs to investigate any system restore errors?

Answer: To check the event logs for System Restore related errors:

1. Click Start, click Control Panel, and then click "Performance and Maintenance".
2. Click Administrative Tools, click Computer Management, double-click Event Viewer, and then click System
3. Click the Source tab to sort by name, and then look for "sr" or "srservice." Double-click each of these services, and then evaluate the event description for any indication of the cause of the problem.

Why is System Restore displaying duplicate drives with offline status?

Answer: This problem can occur if you convert the disk from a Basic disk to a Dynamic disk. To resolve this issue please visit http://support.microsoft.com/default.aspx?scid=kb;EN-US;306217.

Why did system restore not restore my desktop wallpaper? Answer: This behavior occurs because the image that is displayed on the desktop is a common image file not monitored by System Restore and therefore is not restored by System Restore. System Restore does not restore common image files because their restoration might compromise the security of personal data that is stored on the computer.

Why does System Restore not restore compression on files or folders? Answer: This behavior is by design and occurs because System Restore does not record changes in compression, nor does it undo them as changes in compression do not cause the system to fail.

Why are my System Restore settings not preserved during a reinstallation or upgrade? Answer: In the upgrade and installation scenarios, Setup overwrites the existing settings so that System Restore is enabled after installation. In operating systems in which System Restore is not included, such as Microsoft Windows 95, Microsoft Windows 98, Microsoft Windows NT Workstation, or Microsoft Windows 2000 Professional, System Restore will also be enabled by default on all drives.

How can I verify that the System Restore services are running on my machine?

Answer: To verify that the System Restore service is running use the following procedure.

Verifying that the service is started from the Control Panel:

1. Click Start, click Control Panel, and then click "Performance and Maintenance"
2. Click Administrative Tools, click Computer Management, and then click Services and Applications
3. Click Services, and then click System Restore Services. Make sure the Service is set to "Automatic" and the status is "started"

Using the Command prompt window to ensure that the service is started:

1. Click Start, click Run, and then type "CMD" (without the quotation marks)
2. Press the ENTER key, and then type "Net Start" (without the quotation marks) at the command prompt to make sure that the System Restore service is up and running.

How can I verify that the Task Scheduler is running on my machine?

Answer: To verify that the Task Scheduler service is running on your machine use the following procedure:

Verifying that the service is started from the Control Panel:

1. Click Start, click Control Panel, and then click "Performance and Maintenance"
2. Click Administrative Tools, click Computer Management, and then click Services and Applications
3. Click Services, and then click the Task Scheduler service. Make sure the Service is set to "Automatic" and the status is "started"

Using the Command prompt window to ensure that the service is started:

1. Click Start, click Run, and then type "CMD" (without the quotation marks)
2. Press the ENTER key, and then type "Net Start" (without the quotation marks) at the command prompt to make sure that the Task Scheduler service is up and running

Why cannot I see system files like .dll's or .inf's in Windows?

Answer: By default windows hides all system files and files marked hidden by making them invisible to the user. To view these files please use the following procedure:

1. Open 'My computer' from the start menu
2. Using the toolbar go to 'Tools > Folder Options' menu and then click the 'View' tab
3. In the advanced settings option for Hidden files and folders ensure the 'show hidden files and folders' option is selected. Also ensure that 'Hide protected operating system files' option is unchecked. Then click 'OK'
4. You should now be able to see hidden and system files. To re-hide them just reverse the above procedure.

(Source Microsoft)