In System Restore, the user may create a new restore point manually (as opposed to the system creating one automatically), roll back to an existing restore point, or change the System Restore configuration. Moreover, the restore itself can be undone. Old restore points are discarded in order to keep the volume's usage within the specified amount. For many users, this can provide restore points covering the past several weeks. Users concerned with performance or space usage may also opt to disable System Restore entirely. Files stored on volumes not monitored by System Restore are never backed up or restored.
System Restore backs up system files of certain extensions (.exe, .dll, etc.) and saves them for later recovery and use.7 It also backs up the registry and most drivers.
Starting with Windows Vista, System Restore takes a snapshot of all volumes it is monitoring. However, on Windows XP, it only monitors the following:89
The list of file types and directories to be included or excluded from monitoring by System Restore can be customized on Windows Me and Windows XP by editing %windir%\system32\restore\Filelist.xml.11
The amount of disk space System Restore consumes can be configured. Starting with Windows XP, the disk space allotted is configurable per volume and the data stores are also stored per volume. Files are stored using NTFS compression and a Disk Cleanup handler allows deleting all but the most recent Restore Points. System Restore can be disabled completely to regain disk space. It automatically disables itself if the volume's free space is too low for it to operate.
Windows creates restore points:
Windows XP stores restore point files in a hidden folder named "System Volume Information" on the root of every drive, partition or volume, including most external drives and some USB flash drives.16
The operating system deletes older restore points per the configured space constraint on a first in, first out basis.
There are considerable differences between how System Restore works under Windows XP and later Windows versions.
Up to Windows XP, the system can be restored as long as it is in an online state, that is, as long as Windows boots normally or from Safe mode. It is not possible to restore the system if Windows is unbootable without using 3rd-party bootable recovery media such as ERD Commander. Under Windows Vista and later, the Windows Recovery Environment can be used to launch System Restore and restore a system in an offline state, that is, in case the Windows installation is unbootable.28 Since the advent of Microsoft Desktop Optimization Pack, Diagnostics and Recovery Toolset from it can be used to create a bootable recovery disc that can log on to an unbootable Windows installation and start System Restore. The toolset includes ERD Commander for Windows XP that was previously a 3rd-party product by Winternals.
Before Windows Vista, System Restore protection was restricted to select locations and predetermined file types. Therefore, System Restore could not fully revert unwanted software installations, especially in-place software upgrades.29 Starting with Windows Vista, System Restore monitors all files on all file paths on a given volume.
It is not possible to create a permanent restore point. All restore points will eventually be deleted after the time specified in the RPLifeInterval registry setting is reached or if allotted disk space is insufficient for newer Restore points.30 Consequently, in systems with little space allocated, if a user does not notice a new problem within a few days, it may be too late to restore to a configuration from before the problem arose.
On infected systems, System Restore may end up archiving malware, such as viruses, before antivirus software has the chance to clean the infection. For data integrity purposes, System Restore does not allow other applications or users to modify or delete files in the directory where the restore points are saved. As such, antivirus software is usually unable to remove infected files from restore points.31 The only way to clean them is to delete them altogether. However stored infected files are harmless until the affected restore point is reinstated.
System Restore cannot monitor changes made to a volume from another operating system (in case of multi-booting scenarios). In addition, multi-booting different versions of Windows can disrupt the operation of System Restore. Specifically, Windows XP and Windows Server 2003 delete the restore points of Windows Vista and later.32 Also, restore points created by Windows 8 may be destroyed by previous versions of Windows.33
"No Restore Point For You". CNET. December 28, 2007. Archived from the original on January 19, 2013. Retrieved February 27, 2020. https://archive.today/20130119190024/http://news.cnet.com/8301-13554_3-9838164-33.html ↩
Jim Tanous, "Why and How to Enable System Restore in Windows 10" Archived December 21, 2017, at the Wayback Machine, Tekrevue, July 28, 2015 http://www.tekrevue.com/how-to-enable-system-restore-windows-10/ ↩
"System Protection - Microsoft Support". support.microsoft.com. Retrieved May 2, 2025. https://support.microsoft.com/en-us/windows/system-protection-e9126e6e-fa64-4f5f-874d-9db90e57645a ↩
Russinovich, Mark E.; Solomon, David A. (2005). Microsoft Windows Internals: Microsoft Windows Server 2003, Windows XP, and Windows 2000 (4 ed.). Redmond, WA: Microsoft Press. pp. 706–711. ISBN 0-7356-1917-4. 0-7356-1917-4 ↩
"Windows Backup". Windows Vista portal. Microsoft. Archived from the original on May 10, 2007. Retrieved January 11, 2014. https://web.archive.org/web/20070510204203/http://www.microsoft.com/middleeast/windowsvista/features/foreveryone/backup.mspx ↩
Fok, Christine (September 2007). "A Guide to Windows Vista Backup Technologies". TechNet Magazine. Microsoft. Archived from the original on February 9, 2014. Retrieved January 11, 2014. https://technet.microsoft.com/en-us/magazine/2007.09.backup.aspx ↩
"MSDN System Restore Reference: Monitored File Extensions". Archived from the original on October 20, 2017. Retrieved May 22, 2008. http://msdn.microsoft.com/en-us/library/aa378870.aspx ↩
"Monitoring the System". MSDN. Microsoft. Archived from the original on October 6, 2012. Retrieved May 10, 2014. http://msdn.microsoft.com/en-us/library/aa378891%28v=vs.85%29.aspx ↩
"Frequently Asked Questions Regarding System Restore in Windows XP". TechNet. Microsoft. Archived from the original on April 24, 2008. https://web.archive.org/web/20080424052302/http://technet.microsoft.com/en-us/windowsxp/bb264753.aspx ↩
"System Restore: Monitored File Name Extensions". Archived from the original on September 10, 2016. Retrieved May 4, 2017. https://msdn.microsoft.com/en-us/library/aa378870(v=vs.85).aspx ↩
"Selected Scenarios for Maintaining Data Integrity with Windows Vista". TechNet. Microsoft. Archived from the original on July 14, 2014. Retrieved May 10, 2014. https://technet.microsoft.com/en-us/library/cc749185%28v=WS.10%29.aspx ↩
"About System Restore". MSDN. Microsoft. Archived from the original on October 6, 2012. Retrieved May 10, 2014. http://msdn.microsoft.com/en-us/library/aa378724%28v=vs.85%29.aspx ↩
"MSFN's Unattended Windows : Reduce Disk Space Used By System Restore". Archived from the original on July 6, 2010. Retrieved November 5, 2009. http://unattended.msfn.org/unattended.xp/view/registry/68 ↩
"The Registry Keys and Values for the System Restore Utility". September 15, 2006. Archived from the original on October 31, 2009. Retrieved November 3, 2009. http://support.microsoft.com/kb/295659 ↩
"Windows Vista Help: System Restore FAQs". Archived from the original on May 22, 2008. Retrieved May 22, 2008. http://windowshelp.microsoft.com/Windows/en-US/help/517d3b8e-3379-46c1-b479-05b30d6fb3f01033.mspx ↩
Windows Vista System Restore FAQs: Bert Kinney - System Restore MVP Archived March 27, 2008, at the Wayback Machine http://bertk.mvps.org/html/q_a.html#16 ↩
"The Registry Keys and Values for the System Restore Utility". Archived from the original on October 31, 2009. Retrieved November 5, 2009. http://support.microsoft.com/kb/295659 ↩
"Vista System Restore Q&A - System Restore MVP Bert Kinney". Archived from the original on March 27, 2008. Retrieved May 22, 2008. https://web.archive.org/web/20080327064609/http://bertk.mvps.org/html/q_a.html#6 ↩
"Windows Server Hacks: Hacking System Restore - O'Reilly Media". Archived from the original on August 28, 2008. Retrieved September 19, 2008. http://www.windowsdevcenter.com/pub/a/windows/2004/10/19/SystemRestore.html ↩
"Antivirus Tools Cannot Clean Infected Files in the _Restore Folder". Microsoft Corporation. Archived from the original on January 4, 2007. Retrieved September 19, 2007. http://support.microsoft.com/kb/263455/en-us ↩
"How restore points and other recovery features in Windows Vista are affected when you dual-boot with Windows XP". File Cabinet Blog. Microsoft. July 14, 2006. Archived from the original on July 18, 2006. Retrieved March 21, 2007. https://web.archive.org/web/20060718011852/http://blogs.technet.com/filecab/archive/2006/07/14/441829.aspx ↩
"Calling SRSetRestorePoint". MSDN Library. Microsoft. Archived from the original on March 4, 2016. Retrieved February 1, 2015. Snapshots of the boot volume created by System Restore running on Windows 8 may be deleted if the snapshot is subsequently exposed by an earlier version of Windows. https://msdn.microsoft.com/en-us/library/windows/desktop/aa378727.aspx ↩