Does System Restore Delete My Files?

A common misconception among Windows users is that System Restore wouldn’t touch your personal files and data stored under your user shell folders, such as Documents, Pictures, Music, etc. This is not fully true!

From the Microsoft or System Restore perspective, ‘document’ files include those whose extensions are not included in their list of “Monitored File Name Extensions.” System Restore monitors a hard-coded list of file types that are either removed or restored during the System Restore rollback operation, irrespective of which folder the files are stored in.

For instance, if you store your data in INI files, a “monitored” extension, System Restore will delete the file during the restore operation if the INI file wasn’t included in the restore point (shadow copy).

Likewise, suppose the Restore Point includes an INI file or any other monitored file type which is not present in the destination path on your hard drive. In that case, the file will be restored to the destination during the rollback operation.

The rule is the same whether you store the files in your personal shell folders or elsewhere. Here is the list of System Restore monitored file name extensions, courtesy of Microsoft.

System Restore: Monitored file name extensions

~~C
~~D
12A
1PA
1ST
386
8BA
8BY
8LI
A2A
AAS
AAX
ABM
ABR
ACF
ACG
ACO
ACS
ADK
ADW
ADX
AFM
AID
AIP
ALT
AM
AMB
APL
APM
APP
APV
AR
ARX
AS
AT
ATC
ATL
ATM
ATN
AW
AWE
AWX
AX
B0
BAT
BCF
BD
BDR
BE
BGB
BGR
BID
BIT
BK1
BLD
BM
BMA
BND
BNF
BOF
BPP
BPT
BPX
BT
BTN
BUC
CAG
CAO
CAT
CBS
CC
CF
CFG
CHA
CIK
CL
CLW
CLX
CLY
CMD
CNT
CNV
COL
COM
CPB
CPL
CQM
CR
CRL
CRS
CRV
CS
CSB
CSI
CSL
CSW
CTB
CTG
CTY
CUS
CW_
D01
D02
D03
D04
D05
D32
DATA
DB0
DB1
DB2
DC2
DCA
DCF
DCI
DCL
DDB
DDD
DEP
DES
DESKLINK
DET
DGM
DIALOG
DID
DIR
DISABLED
DIX
DLL
DOB
DOS
DRC
DRS
DRV
DS
DSC
DSK
DSN
DSR
DSX
DT
DTT
DUN
DVB
DWT
DXT
DYNCMD
ECF
EFF
EFM
EID
EL
ELM
END
ENU
ENV
EOT
EPF
ET
EX_
EXA
EXCLUDE
EXE
EXL
F32
FAE
FAM
FAS
FFP
FIN
FIO
FLL
FLW
FMC
FMP
FNT
FON
FSG
FSS
GCS
GDB
GI_
GMS
GNG
GPD
GS
GSF
GST
GUIATN
GUICMD
GVT
GWD
H16
HCT
HDC
HDI
HDP
HFX
HGD
HHC
HHK
HK0
HK1
HK2
HK3
HLP
HM
HTA
HTC
HTZ
HU
HWL
HYP
IAT
IBD
ICD
ICM
ICO
ICR
ICW
ID
IDS
IFA
ILF
ILG
ILM
IN_
INCL
INF
INI
INK
INL
INO
INS
INV
IP
IRS
ISA
ISS
ISU
ITF
J0
JA
JBR
JCM
JGD
K01
K02
K03
KBD
KNN
KO
L0
L2L
L2P
LAB
LAM
LAST
LCA
LCK
LDA
LEX
LGC
LGD
LGE
LGF
LIC
LID
LIM
LIVEREG
LLI
LMC
LMG
LMP
LNK
LO~
LRD
LRS
LSM
LSO
LSQ
LSS
LSX
LT
LTS
LV
M20
MANIFEST
MAPIMAIL
MC
MCD
MCM
MD2
MDM
MDP
ME
MFL
MHK
MIL
MLN
MMC
MMM
MMX
MNC
MNL
MNR
MNS
MOF
MOR
MP
MPD
MPT
MSB
MSC
MSE
MSI
MST
MSK
MSO
MXT
MYDOCS
N0
NAM
NAME
NDX
NEW
NFO
NIB
NMD
NOD
NPM
NQM
NQV
NSI
NSW
NTE
NU4
NUM
NUS
NV
OBE
OCM
OCX
ODE
ODL
OLB
OLD
OLE
OP
OPG
OR5
OSD
OUT
P2A
PAG
PBC
PBK
PBV
PC3
PCI
PDI
PDR
PEN
PER
PFB
PFM
PFR
PH
PHO
PHX
PID
PIF
PL3
PLY
PMT
PNF
POC
POF
POL
PPD
PR4
PROPERTIES
PRX
PSC
PSF
PSP
PT
PTH
PTX
PV
Q0
Q32
Q3X
QDAT
QJF
QRS
QTC
QTD
QTW
QUE
QUF
QUT
R0
R98
RAD
RAT
RC2
RCP
RCT
RDB
RDC
REF
REG
RGS
RH
RI
RJS
RO
ROB
RPR
RPS
RSD
RSP
RSRC
RTA
RTR
RU
S98
SAM
SAX
SCK
SCR
SCS
SECURITY
SELFREG
SFP
SG
SG0
SG1
SHARED
SHR
SHX
SIF
SK
SLL
SMC
SMM
SNP
SOF
SPC
SPE
SPM
SPT
SPX
SR
SRC
SRG
SRT
SSM
SST
ST4
STB
STD
STF
STP
SWB
SYM
SYN
SYS
T32
TAG
TB
TDF
TH
THE
THK
THS
TID
TIE
TIP
TLB
TLD
TLF
TLT
TLU
TLX
TMC
TNL
TOL
TPA
TR
TRE
TRG
TRO
TSK
TSP
TTF
TTS
TUB
TUM
TUW
TV
TVC
TWD
TXR
TYM
TZD
UBM
UCM
UCP
UCT
UDC
UDI
UDL
UDT
UID
UIL
UK
ULG
ULK
UNT
US
USA
USERPROFILE
USP
USR
UTX
V10
VBS
VBX
VBZ
VCPREF
VDB
VER
VFM
VFX
VIL
VLX
VM
VOF
VPH
VPX
VQA
VQM
VSC
VSH
VWP
VXD
W32
W98
WA_
WBD
WBM
WCD
WDL
WDS
WINSYS
WIPEINFO
WIPESLACK
WMZ
WPC
WPX
WRF
WSL
WTB
WTR
XLL
XMX
XRS
XTU
ZFSENDTOTARGET
ZH
ZH_TW
ZRW

The data files, such as Microsoft Office Word/Excel/PowerPoint files, .zip, .txt, and other file types, are not touched by System Restore. However, if any of your files fall in the above list of file types, then they will be included in System Restore operations.

Example:

Before restoring, let’s say the following files were present in a folder:

  • test.vbs
  • test.exe
  • hibernate.lnk
  • test.docx
  • test.zip
  • test.xlsx
  • test.txt

After restoring, you may find these items in that folder:

  • test.vbs (Item not present in shadow copy – file deleted.)
  • test.exe (Item not present in shadow copy – file deleted.)
  • hibernate.lnk (Item not present in shadow copy – file deleted.)
  • test.docx (unmonitored file type; no changes made)
  • test.zip (unmonitored file type; no changes made)
  • test.xlsx (unmonitored file type; no changes made)
  • test.txt (unmonitored file type; no changes made)
  • test.ini (extra file found in the shadow copy)

In the above example, the extra file test.ini (a “monitored” file type) which was present in the shadow copy, has been placed in the destination folder during the rollback operation.




Lost your files during the last rollback operation?

If you’ve lost your data during the recent System Restore operation, you may be able to get back your files by “Undo”ing the last restore.

undo system restore rollback

An even better option is to recover files by mounting the corresponding shadow copy using System Restore Explorer, Shadow Copy View, PreviousFilesRecovery, or similar software.


So, how do I prevent System Restore from deleting my files?

The only way to prevent System Restore from modifying your personal files (if they belong to the “monitored” file types listing) is to store them on a secondary drive or partition and turn off System Restore for the volume via the System Restore settings dialog.

Regardless, it’s always advisable to have appropriate backups in place, especially on your external hard drive and the Cloud.

If your proprietary software stores data in a file containing one of the above file name extensions, you may make changes in your software so that it outputs to a non-monitored file name extension — e.g., .DAT extension instead of .INI.


One small request: If you liked this post, please share this?

One "tiny" share from you would seriously help a lot with the growth of this blog. Some great suggestions:
  • Pin it!
  • Share it to your favorite blog + Facebook, Reddit
  • Tweet it!
So thank you so much for your support. It won't take more than 10 seconds of your time. The share buttons are right below. :)

Ramesh Srinivasan is passionate about Microsoft technologies and he has been a consecutive ten-time recipient of the Microsoft Most Valuable Professional award in the Windows Shell/Desktop Experience category, from 2003 to 2012. He loves to troubleshoot and write about Windows. Ramesh founded Winhelponline.com in 2005.

Leave a Comment