System Restore Process in Windows Xp

The System Restore feature of Microsoft® Windows® XP (the operating system previously known as Microsoft® Whistler) enables administrators to restore their PCs, in the event of a problem, to a previous state without losing personal data files (such as Word documents, drawings, or e-mail). System Restore actively monitors system file changes and some application file changes to record or store previous versions before the changes occurred. With System Restore, users never have to think about taking system snapshots as it automatically creates easily identifiable restore points, which allow users to revert the system back to a previous time. Restore points are created at the time of significant system events (such as application or driver install) and periodically (every day). Additionally, users can create and name their own restore points at any time. System Restore has an automatic restore point space-management feature that purges the oldest restore points to make room for new ones, so that a rolling safety net is always kept under the user, enabling the user to recover from recent undesirable changes.

If users experience system failure or another significant problem, they can use System Restore from SafeMode or Normal Mode to go back to a previous system state, restoring optimal system functionality. System Restore will not revert user data or document files, so restoring will not cause users to lose their work, mail, or even browsing history and favorites

Detail

System Restore is enabled by default and will run upon the successful completion of either the Windows XP Professional or Home version installation. System Restore uses 400mb or 12% of the Hard Drive (whichever is greater) by default. It requires a minimum of 200 MB of space available on the system partition. If there are not 200 MBs available, System Restore will install disabled and will enable itself automatically once the required disk space is created.

Design Overview

System Restore monitors a core set of system and application files, recording and sometimes copying states of these files before changes are made. Monitored files include those that are not in excluded directories (My Documents) and that do not have known data file extensions (such as .doc). System Restore automatically creates restore points; no user intervention is required. To create a restore point, System Restore takes a full snapshot of the registry and some dynamic system files. For a list of file extension types, which are included (monitored and restored), refer to the Monitored File Extensions list in the System Restore section of the Platform SDK.

To restore a system, System Restore reverts file changes done to mo