What Does System Restore ACTUALLY Do?

Summary

This video explores the inner workings of Windows' System Restore feature, which creates restore points to revert system changes causing issues. Despite not restoring personal data, it backs up more than expected, including the entire Windows directory and specific file types across the drive. It utilizes the Volume Shadow Copy Service for efficient backups. The video also advises enabling System Restore, which is disabled by default in recent Windows versions, and highlights its limitations and potential issues, such as interference from malware.

Takeaways

• 🔄 System Restore in Windows is a feature that can revert the system to a previous state but is not always 100% reliable.
• 📚 According to Microsoft, System Restore monitors system changes and saves the system state without affecting user data or documents.
• 💾 System Restore uses the Volume Shadow Copy Service to back up more than just the listed file types, including the entire Windows directory.
• 🚫 System Restore does not restore user data or documents, ensuring users won't lose personal files, emails, or browsing history.
• 🛠️ System Restore is not enabled by default in Windows 10 and Windows 11, and it's recommended to manually enable it for the main system drive.
• 🔧 System Restore points can be triggered by application installations, Windows updates, or manually created through the system settings.
• 🔎 The feature scans for a list of file types across the entire drive, not just the Windows directory, which could affect user-created files that match these types.
• 🛡️ System Restore is also capable of restoring drivers and programs, suggesting it interacts with the registry to manage installations and removals.
• 📁 The Volume Shadow Copy Service creates snapshots of the entire drive, which can be explored and used to recover files outside of what System Restore typically manages.
• ⚠️ Malware can target and delete shadow copies, which is a risk when relying on System Restore for recovery from infections.

Q & A

What is the primary function of the system restore feature in Windows?

The system restore feature in Windows monitors system changes and saves the system state as a restore point, allowing users to return the system to a previous state if a problem develops due to a system change.

Does system restore affect personal documents and user data?

No, system restore does not restore user data or documents, so it will not cause users to lose their files, email, browsing history, or favorites.

Why might someone need to enable system restore on their Windows computer?

System restore is not enabled by default in Windows 10 and Windows 11, so users may need to enable it to have the option to restore their system to a previous state in case of system issues.

What triggers the creation of a system restore point?

System restore points can be triggered by application installations, Windows updates, manual creation, or scheduling with the task scheduler. Additionally, initiating a restore using a restore point also creates a new restore point.

How does the system restore feature interact with the Volume Shadow Copy Service?

System restore uses the Volume Shadow Copy Service to create a snapshot of the entire volume, which includes a 'difference' copy of the drive. This service is also used by system restore to restore the system to a previous state.

What is the practical implication of the Volume Shadow Copy Service for users?

The Volume Shadow Copy Service allows users to explore and potentially recover files from snapshots even if they were deleted from the recycle bin, providing a way to restore files that system restore might not cover.

Can system restore be used to fix issues caused by malware?

While system restore can be used to revert system changes, it's not specifically designed for malware removal. Some advanced malware may even delete shadow copies to prevent restoration to a previous state.

What are the limitations of relying on system restore for file recovery?

System restore may not always have the most recent snapshot, and it only restores files that are part of the system state or on the list of monitored file types. It is not a substitute for a dedicated backup solution.

Why might system restore fail and what could be done to troubleshoot it?

System restore might fail due to various reasons, such as interference from antivirus programs. Disabling the antivirus temporarily could be a troubleshooting step, but caution should be taken not to disable it if the restore is due to a virus.

What is the recommendation for users regarding system restore and additional backup solutions?

It is recommended that users enable system restore and also utilize additional backup solutions like the File History feature or dedicated external hard drives for a more comprehensive data protection strategy.