SYSTEM RESTORE

Greg Shultz (PDF file):

http://techrepublic.com.com/i/tr/downloads/home/10_things_system_restore.pdf

Aim: Incorporate above article by Shultz with other remarks re System Restore

General

What is it? It is tool for restoring your PC to a previous setting if you

experience system failure, etc

May void the problem of re-installing the OS

Snapshots (automatic) of your system state, which comprises crucial system

files including certain parts of the Registry.

Deals with files with extensions .exe, .dll, .com, vxd, .sys etc.

It does NOT restore data files (e.g. .wps, .doc, .txt, .xls extensions), the

Recycle Bin, Temporary Internet files, and My Documents folder. (Desktop is

not secure)

Automatically creates a restore point when it detects an impending change.

Maintains multiple restore points

Creates restore points:

· At first boot

· Every 10 hours of continuous system operation

· Every 24 hours of real-world time

· Every time Windows Update installs something

· Every time you install any software using an installer program that System

Restore recognizes (such as InstallShield 6.1 or higher)

· System points more than 90 days are automatically purged by default.

Space re SR

            All stored as CAB files in Restore folder plus each HD has a hidden Restore

folder for indexing and monitoring

Minimum requirement: 200 MB

If HD > 4GB, the folder can be as much as 12% of HD (consumed PRN)

You can specify amount to minimum

Demonstrate re setting reduction in System Properties (Window key +

Pause key)

Cannot free space by deleting specific restore points; oldest go first

It is not a panacea; learn its’ advantages, limitations and problems that it

can create.

Available also in WinMe (Win 98 as a DOS command using startup disk

c/windows/command. At this prompt type "scanreg/restore").

Restore point creation & application.

Manually i.e. prior to making a change that S R does not do automatically

carry out e.g. installing/upgrading driver, prior to downloading shareware or freeware.

            You will be told if the procedure is unsuccessful; no changes occur to your PC

Undoing a restore operation; do so immediately select the Undo My Last

Restoration option and click Next, etc.

If you selected the wrong restore point date, simply run System Restore again

and select the restore point date you wanted. You will be told if your restore is unsuccessful.

At times, the PC will not boot normally after a restore operation. Use Safe Mode;

launch SR; “Undo My Last Restoration”

Running System Restore from a command prompt in Safe Mode if necessary.

%systemroot%\system32\restore\rstrui.exe

            To purge restore points to free up HD space (prior to 12% mark is reached), use

Disk Cleanup. (All Programs> Accessories>  System Tools> Disk Cleanup> More

Options tab).

To view amount of HD space available, Windows key + Pause; select the HD;

Settings

To bypass the SR Wizard, create a two line VBScript file, etc. Why?

Creating a shortcut on Desktop

            Copy from Start> All Programs> Accessories> System Tools

Problem with file/s infected with virus/worm that are in SR.

The infection may endure even when eliminated elsewhere via Anti Virus

program.

Infection may resurface so disable SR (Windows key + Pause key) which

deletes all restore points.

To Determine the actual amt. of HD space S R is using

            Need WinXP Pro, NTFS and Administrator account

            Investigate System Volume Information in root directory of HD

            Warning: “Making any changes to the files in the System Volume

Information folder will disrupt or otherwise damage System Restore's ability to do its job.”

            Only for investigative purposes.

Side Effects after Using SR

            May replace more files than you desire restored. Try reboot or Safe Mode then

Last Known Good Configuration before using it

All caps in Start menu

            Screensaver password may change to older one           

            May not restore file attributes correctly

            If any user's My Documents folder contains files with one of the aforementioned

system extensions e.g.  .EXE, .SYS, etc. a restore may delete those files if they didn't

exist when the restore point was created.                      

VS. Goback

Provides more features and flexibility than System Restore e.g. selectively restore

only certain parts of your configuration or recover deleted or accidentally modified files