Windows XP's System Restore

Microsoft OSs have typically included utilities that help you recover systems that become unstable or crash, but Windows XP's System Restore goes much further. System Restore reinstates the registry, local profiles, the COM+ database, the Windows File Protection (WFP) cache (wfp.dll), the Windows Management Instrumentation (WMI) database, the Microsoft IIS metabase, and files that the utility copies by default into a Restore archive. You can't specify what to restore*it's all or nothing.

Understanding System Restore
System Restore's purpose is to return your system to a workable state without requiring a complete reinstallation and without compromising your data files. The utility runs in the background and automatically creates a restore point when a trigger event occurs. Trigger events include application installations, AutoUpdate installations, Microsoft Backup Utility recoveries, unsigned- driver installations, and manual creations of restore points. The utility also creates restore points once a day by default.

System Restore requires 200MB of free hard disk space, which the utility uses to create a data store. If you don't have 200MB of free space, System Restore remains disabled until the space becomes available, at which point the utility enables itself. System Restore uses a first in/first out (FIFO) storage scheme: The utility purges old archives to make room for new ones when the data store reaches a set limit. See the sidebar "System Restore Registry Entries," page 60, to learn how to adjust the default data store size and how to replace the FIFO purges with timed purges.

The file types that System Restore monitors are many but include most of the extensions that you typically see when you install new software (e.g., .cat, .com, .dll, .exe, .inf, .ini, .msi, .ole, .sys). Note that only application installations that use a System Restore restorept.api-compliant installer will trigger the creation of a restore point.

Typically, system recoveries are easiest when you know*or think you know*what caused the problem (e.g., a recently installed device driver). In some cases, System Restore might not be the best choice for correcting a problem you're experiencing. System Restore changes many different files and registry entries, and in some cases might replace too much and actually cause more problems than it solves. For example, say you install Office XP, which triggers System Restore to create a restore point, and the software suite works great. Later in the day, you download and install an updated video driver, and because the driver is signed, the installation doesn't trigger System Restore to create a restore point. Now your system hangs on occasion, and you believe that the video driver is the culprit. In this case, you should use the Device Driver Rollback utility because it will address the device-driver problem only and not change anything else on your system. System Restore would roll your computer back to a pre­Office XP state, and you would have to reinstall the entire software suite after you resolved the driver problem.

Creating a Restore Point
Windows XP automatically creates restore points when you would typically need them most. However, occasions arise when you might want to create restore points manually*for example, if you're installing an application that you're not sure will be stable on Windows XP, if you're unsure whether an application is System Restore restorept.api-compliant, or if you're making system changes that could affect the system's stability.

For example, I wanted to install Crystal Decisions' Crystal Reports Professional 7, but because that version is several years old, I wasn't sure how well it would run on Windows XP. I decided to create a restore point before installing the software. I clicked Start, All Programs, Accessories, System Tools, System Restore. A Welcome screen appeared, and System Restore asked whether I wanted to restore or create a restore point. I chose Create a restore point and clicked Next. I named my restore point Before Crystal Reports, as Figure 1 shows, and clicked Create. Name restore points so that you can easily identify them later. After the utility collected all the information it needed, it displayed the Restore Point Created screen, which Figure 2 shows. I closed the utility to end the process.