Recover and repair Windows XP - How to use System Restore to Recover the System and What to Do If It Doesn't Work

Using System Restore

In Windows XP, if booting all the way into normal mode causes problems, such as features that don't work, freezes, etc., it is possible to backdate Windows itself to an earlier state when it was working properly.

To do this you don't have to use the boot menu, all you have to do is run the System Restore Wizard, which is to be found under Start => All Programs => Accessories => System Tools. Alternatively click Start, right-click on My Computer, click Properties and click on the System Restore tab. Another route is Control Panel => System => System Restore tab.

However, you should note that System Restore can be an unreliable method of recovering Windows XP, so it is not advisable to rely on it as your only method of recovery.

System Restore can often work wonders in restoring a badly mangled Windows setup that has been got at by viruses, spyware, installing bad software, etc., but it is not uncommon to find that it doesn't work. It might not work for many reasons. For example, when you attempt to restore a restore point, it might report that it can't be done for some reason that it mentions but which makes no sense to you or even a computer expert. If a system won't boot, System Restore can't be used, because it can only be used if you can get the system to boot to the Command Prompt, run in Safe Mode, or run in normal mode. Running System Restore from the Command Prompt is dealt with below.

Here is how to use System Restore in Safe Mode, which you may have to do if Windows won't boot into normal mode, but will boot into Safe Mode...

When you start Windows XP/Vista up the BIOS performs POST tests (Power On Self Tests). Unless your computer shows its manufacturer's or motherboard manufacturer's logo (something that can be disabled in the BIOS), at startup it counts the amount of RAM memory and displays hard-disk-drive information. When the memory count is over, press and hold the F8 key until the Windows Advanced Options menu comes up. This page provides detailed information on those options, which you don't need to know in order to enter Safe Mode.

A description of the Safe Mode Boot options in Windows XP - http://support.microsoft.com/kb/315222

Use the keyboard's up and down arrow keys to select the plain Safe Mode option (that doesn't provide Networking or Command Prompt).

When Windows is running in Safe Mode, those two words are displayed in the four corners of the screen.

Now can use System Restore to restore backed-up system files that were created as a restore point on a particular date. Choose a date when the system was working properly.

To run System Restore, click Start => All Programs => Accessories => System Tools => System Restore.

In the System Restore wizard, check the option Restore my computer to an earlier time and click Next.

In the calendar that appears, with the mouse, highlight a bold restore point in a date on which the system was running correctly and click Next. When the restoration is complete, the computer will restart automatically and when Windows has loaded you will be told that the system has been restored successfully.

Read the next section called WHAT TO DO WHEN SYSTEM RESTORE WON'T/DOESN'T WORK for information on why System Restore might fail to work.

If a Windows XP installation won't boot, you have to try other methods of recovery thaqt are dealt with in this section of this website (look through the index at the bottom of this page to find the links their pages), such as installing Windows XP over itself, performing a repair install/installation, or by using the Recovery Console, all of which can only begin or be used if the system can boot from the Windows XP installation CD/DVD from which they are all run.

WHAT TO DO WHEN SYSTEM RESTORE WON'T/DOESN'T WORK

Problem

I am having a problem with System Restore in Windows XP. I can create a new restore point, but whenever I try to restore it, the message "Restoration incomplete. No changes made." is produced. Is there any kind of workaround for this problem?

Answer

Every restore point that System Restore creates contains a complete backup copy of the Windows Registry, and backup copies of the system files that have changed since the previous restore point was created. When System Restore restores the system to the state it was in on the date the restore point it is restoring was created, it has to remove all of the changes that have been made since that restore point was created. If there were any restore points created in between the one being restored, it has to go through them to find out what it needs to remove. If any of the files that those restore points should contain is missing or corrupt, it refuses to restore.

Spyware and virus scanners are often responsible for making System Restore fail to work. The restore points are stored in a folder called System Volume Information, which the malware scanners search through. If they find any infected files stored in them, they offer to remove them. But as soon as the user agrees to remove the files, that restore point and all of the previous restore points becomes useless, because none of them can access all of the information or files that it needs to undo changes. System Restore can't tell the difference between infected files and non-infected files, so it refuses to work if a restore point it needs to access has any missing files.

However, if this is the case, you can still at least perform a partial system restore. When Windows boots, access to the System Restore files in System Volume Information folder is blocked. But you can access the folder if you boot the system from a CD that contains a bootable copy of an operating system that understands the NTFS file system, such as a bootable Linux CD, or if you install the hard disk drive in another computer that is running Windows XP.

You can also use a program called ERD Commander, a utility created by Sysinternals, which is now owned by Microsoft. You should be able to obtain it from http://www.microsoft.com/technet/sysinternals/default.mspx. If you can't afford it, you can try using MiniPE or Hirem's Boot CD, both of which are available for download from many sites. You can use the Google search box at the top of this page (with its Web radio button enabled) to locate them.

You might also want to try the cumbersome method that is described in this MS Knowledge Base article:

How to recover from a corrupted registry that prevents Windows XP from starting -

http://support.microsoft.com/?scid=307545.

If you access the System Volume Information folder by booting from another operating system, you should be able to view its contents. If you can't, this MS Knowledge Base article tells you how to do so: How to gain access to the System Volume Information folder - http://support.microsoft.com/?scid=309531.

After you have access to the System Volume Information folder, you should be able to see one or more folders that have long file names made up of a long string of numbers and letters, such as: _restore{98CD7788-3445-567B-978G-F97G40B3E8F9}. When you click on each of those files, you should see a series of folders called RP1, RP2, RP3, etc. These are the restore points. To see the date on which each of them was last used, right-click on an empty part of the folder and then choose View => Details.

Choose a restore point that has a suitable date. There should be a folder called snapshot under each of the restore point folders.

Each snapshot folder contains several files, including the following: _REGISTRY_USER_DEFAULT, _REGISTRY_MACHINE_SECURITY, _REGISTRY_MACHINE_SOFTWARE, _REGISTRY_MACHINE_SYSTEM, REGISTRY_MACHINE_SAM.

Those files are copies of the five essential Registry files as they were at the time when that particular restore point was created. You must now copy them to the C:\Windows\System 32\Config folder of the damaged installation of Windows.

This next step can only be done if you booted from a different drive, because the copy of Windows that is running won't allow any of its files to be deleted.

Move to the C:\Windows\System 32\Config folder of the damaged installation of Windows.

Delete the following Registry files: DEFAULT, SECURITY, SOFTWARE, SYSTEM, and SAM. Now you can rename the files that you copied across to the folder to the corresponding Registry filename. E.g., rename _REGISTRY_USER_DEFAULT to DEFAULT by right-clicking on it and choosing Rename.

Doing that should restore the Windows Registry to the state it was in when the restore point was created.

You might discover that don't have permission to access the System Volume Information folder after you have installed the hard disk drive containing the defective copy of Windows XP in another computer running Windows XP. This is probably because the folder only has access rights defined for SYSTEM. In that case, you must add access rights for Administrators.

If you are using Windows XP Professional, you must first turn of Simple File Sharing if it enabled. If you don't know how to check if this is the case, read the information provided on this page:

Windows XP Simple File Sharing -

"Windows XP lets you share a computer's disks and folders with other computers on the network, using a method called Simple File Sharing. And it really is simple. If a disk or folder is shared, everyone on the network can access it. There are no user permissions and no passwords. Because sharing in this way is so wide open, Windows XP tries to protect you from some potential security risks..." - http://www.practicallynetworked.com/sharing/xp/filesharing.htm

Next, right-click the with mouse pointer on the System Volume Information folder and choose Sharing and Security. Click on the Security tab. The top part of the window shows which users or groups have rights to access this folder. If it shows just SYSTEM, an entry for Administrators must be added. To do that click on the Add button, enter Administrators, click on Check Names, followed by OK. The lower window should then show permission for Administrators. Use the mouse pointer to place a tick in the Allow box next to the description Full Control and click the Apply and OK buttons.

Note that users of Windows XP Home Edition have to do that in Safe Mode, because the Security tab is not available in normal mode. You can boot into Safe Mode by repeatedly pressing the F8 key at startup and then choosing Safe Mode from the boot menu that presents itself.

****

Running System Restore from the Command Prompt

Note that you can run System Restore from the Command Prompt if a problem with Windows XP only allows you to boot the system by pressing the F8 key continously at startup (between the memory count and Windows startup) to bring up the boot menu with the following options:

Safe Mode

Safe Mode with Networking

Safe Mode with Command Prompt

Enable Boot Logging

Enable VGA mode [loads the standard VGA video card device driver]

Last Known Good Configuration (your most recent settings that worked)

Directory Services Restore Mode (Windows domain controllers only)

Debugging Mode

Start Windows Normally

Reboot

Return to OS Choices Menu.

When starting the computer, just keep pressing the F8 key after the memory count to bring the boot menu shown above up. Select the Safe Mode with Command Prompt option . Enter cd \windows at the C:\> command prompt. The prompt changes to C:\>\Windows. Then just enter system32\restore\rstrui.exe and you should have access to System Restore. RSTRUI.EXE is System Restore's program file.

****

By default, Windows XP creates what are called restore points, which are set occasions when it creates a restorable back-up of itself. It creates such a restore point before new device drivers are installed so that the system can be restored if the new drivers cause problems. You can also create your own restore points.

Even though it can use plenty of drive space for its restore points, System Restore does not make a restorable copy or image of an entire system, and therefore cannot be used to restore it to its previous state. It just rolls back certain essential system files to the date the restore point being restored was created in an attempt to get the system up and running after a major system crash. System Restore is not a back-up, therefore you should not rely on it as one. If your computer contains valuable data, there is no alternative to making proper restorable back-ups. Click here! to go to the page on this site that deals with back-ups.

Note that every actual drive or logical drive has System Restore enabled for it by default. All of the drives are listed. If System Restore is turned on for a particular drive, the Status is Monitoring, if not, the Status is Turned off. There is a box called Turn off System Restore on all drives. Highlight a drive and click on the Settings button. The window that presents itself has the option Turn off System Restore on this drive. If you have many drives with System Restore enabled on them, essential files are backed-up so that System Restore can restore them. This is a background task that takes place during regular operations, so if the hard drive is doing a lot of work, making sounds or making the IDE light on the front of the case flicker while you're only using an office application, you know what the computer is doing. If you don't want the data on a one or more drives backed up in this way, just turn off its System Restore.

You can allocate the amount of drive space each drive uses for System Restore by using the mouse on the slider control.

If you are going to make a major change to the system, you should create a new restore point before you do so. Use Start => All Programs => Accessories => System Tools => and then System Restore. Choose Create a new restore point and enter a name for it. Click the Create button to complete the process.

You make use of the same System Restore feature when you want to roll the system back to a state it was in when a particular restore point was created. You click on Restore my computer to an earlier time, followed by Next. A calendar appears showing the current month. The available restore points are highlighted under each month. To run a restore point, click on the desired highlight followed by Next. Windows then presents a message informing you of what it will be doing to restore the system to the state it was in at that particular date.

Activating a restore point will only adversely affect the system files and any software that was loaded after Windows created it. Windows will remove any reference in its registry to drivers and programs that were installed after the restore point was created, but otherwise will leave the folder structure intact. The driver and program files will remain installed, but won't be able to run without being set up in the Registry, so, if it is to work, any program or driver affected in this way will have to be reinstalled to re-register it in the Registry.

In theory, all such restorations can themselves be reversed.

Note that you can control how much hard-drive space the System Restore function uses, and you can even disable it completely. However, such action is not advised. The more methods you have for restoring a failed system the better. If one method fails you, an alternative might save your bacon.

Windows XP stores its System Restore files - back-up copies of the system files - under the reserved area of the C: drive called System Volume Information. These can occupy a very large amount of space, and, for the most part, the files it contains are useless.

If you use the right mouse button to click on My Computer, then click left-click on Properties, a tab called System Restore will become visible. You can turn this feature off here. Or you can use the Settings button to specify the maximum percentage of the hard disk drive space that it can use. Windows XP uses 12% of the hard disk drive by default to contain the System Volume Information, which, on a 20GB drive, is 2.4GB, and a huge 4.8GB on a 40GB drive.

How to Gain Access to the System Volume Information Folder - http://support.microsoft.com/default.aspx?scid=kb;en-us;309531

How the System Restore Tool Handles Hard-Disk Space Usage - "This articles describes how the System Restore tool handles hard-disk space usage, particularly where low disk-space issues are concerned." - http://support.microsoft.com/?kbid=300044

See the following problem discussed on the Software Problems page of this site: A swollen C: drive with Windows XP installed.

There are many reasons why using System Restore to restore the system can fail. For example, read "Why are previous restore points not working?" in the Troubleshooting section of this official Microsoft page:

http://www.microsoft.com/technet/prodtechnol/winxppro/plan/faqsrwxp.mspx

There is other enlightening information on this subject there, such as the section called Does System Restore protect personal data files? [the answer is No] - and the sections called, What should I do if System Restore does not work? - Why are my restore points missing or deleted? - Why does the System Restore Wizard lockup? The information on that page should make anyone realise that System Restore is not intended for use as a system recovery method of the highest reliability.

Click its title to go to the following Q&A on this site: How to repair the System Restore feature in Windows XP.

Click its title to go to the following Q&A on this site: The System Restore feature in Windows XP stops working after cleaning a virus infection.

"Frequently Asked Questions Regarding System Restore in Windows XP":

http://www.microsoft.com/technet/community/newsgroups/faqsrwxp.mspx

Windows XP System Restore Is Easy to Use - http://www.microsoft.com/windowsxp/using/helpandsupport/getstarted/ballew_03may19.mspx

How to Use System Restore - How to Restore a Windows XP system to a previous State using System Restore: http://bertk.mvps.org/

Click here! to go to information on this site on MS Knowledge Base articles on System Restore in Windows XP.

How do I use the Event Viewer to search for System Restore logs? - http://bertk.mvps.org/html/tips.html#EventViewer

Here are some more links for troubleshooting System Restore.

System Restore Failures to restore: http://bertk.mvps.org/html/srfail.html

System Restore fails to create an automatic restore point: http://bertk.mvps.org/html/srauto.html

How to reinstall System Restore in Windows XP? -

"There are situations where you are required to reinstall System Restore in order to restore its functionality. This article explains how to reinstall System Restore using the INF file." - http://windowsxp.mvps.org/repairsr.htm

There is more information on the System Restore feature here: http://www.kellys-korner-xp.com/xp_restore.htm

Why you should turn off System Restore if your computer has been infected by a virus

System Restore is designed to return the system to a known good state after it has been messed up by, say, a virus, by a program, or by misuse.

If a computer has been infected by a virus, it will be saved in the System Restore files that Windows XP creates on a regular basis, or to order. If the user restores a restore point containing the virus, the system will be re-infected Moreover, it will be detected by a virus scanner that is performing a scan of the system. Note that a virus cannot work from within System Restore and a virus scanner may not be able to remove it. If that is the case, turning System Restore off on the infected drive is the best way to get rid of the virus.

Note that turning System Restore off results in the loss of all previously created restore points. It is up to you if you want to turn it on again. In any case, Windows turns System Restore on for all drives, or partitions on drives, by default, so you should only have it turned on for the drives that you need to restore in the event of a failure, such as the C: drive, which is usually the boot drive that contains the main Windows folder.

You must be logged in as an Administrator to turn the feature off in Windows XP. Windows uses the Administrator account by default at startup, so most users will be logged on as Administrator. If you are not logged in as an Administrator, the System Restore tab is not displayed. If you are on a network and don't not know how to log in as Administrator, contact your system administrator, the computer manufacturer, or installer.

Click Start and right-click My Computer, and then click Properties on the list that is presented. Click the System Restore tab. Place a check mark with the mouse pointer in the check box beside Turn off System Restore on all drives. Click the Apply button. A warning message appears, telling you what has been said above. Click Yes, followed by OK. If you want to turn off the feature on a particular drive, select it with the mouse and click the Settings button, followed by Turn off System Restore for this drive.

Another way of opening System Restore is to click Start -> All Programs -> Accessories -> System Tools -> System Restore.

CONTENTS OF RECOVERING AND REPAIRING WINDOWS XP

Click the relevant link to go to that information

Introduction: Recovering and repairing Windows XP

Methods of recovering Windows XP

How to create a boot (startup) CD/DVD for Windows XP

How to find out the cause of a Blue Screen of Death (BSOD) error message - Shutdown and reboot in Windows 2000, XP and Vista

How to perform a repair installation/install of Windows XP

Recovery by reinstalling Windows XP over itself and the consequences of so doing

Using the Recovery Console and the CHKDSK Hard-disk-drive Diagnostic Tool/Utility

How to use the Recovery Console to restore a corrupt Windows XP Registry when the PC/computer won't even boot into Safe Mode

Copying files and making backups: Using the Xcopy and Robocopy commands from the Command Prompt in Windows XP and Windows Vista