A common misconception among Windows users is that System Restore wouldn’t touch your personal files and data stored under your user shell folders, such as Documents, Pictures, Music, etc. This is not fully true!
From the Microsoft or System Restore perspective, ‘document’ files include those whose extensions are not included in their list of “Monitored File Name Extensions.” System Restore monitors a hard-coded list of file types that are either removed or restored during the System Restore rollback operation, irrespective of which folder the files are stored in.
For instance, if you store your data in INI files, a “monitored” extension, System Restore will delete the file during the restore operation if the INI file wasn’t included in the restore point (shadow copy).
Likewise, suppose the Restore Point includes an INI file or any other monitored file type which is not present in the destination path on your hard drive. In that case, the file will be restored to the destination during the rollback operation.
The rule is the same whether you store the files in your personal shell folders or elsewhere. Here is the list of System Restore monitored file name extensions, courtesy of Microsoft.
System Restore: Monitored file name extensions
|
|
|
|
|
The data files, such as Microsoft Office Word/Excel/PowerPoint files, .zip, .txt, and other file types, are not touched by System Restore. However, if any of your files fall in the above list of file types, then they will be included in System Restore operations.
Example:
Before restoring, let’s say the following files were present in a folder:
- test.vbs
- test.exe
- hibernate.lnk
- test.docx
- test.zip
- test.xlsx
- test.txt
After restoring, you may find these items in that folder:
- test.vbs (Item not present in shadow copy – file deleted.)
- test.exe (Item not present in shadow copy – file deleted.)
- hibernate.lnk (Item not present in shadow copy – file deleted.)
- test.docx (unmonitored file type; no changes made)
- test.zip (unmonitored file type; no changes made)
- test.xlsx (unmonitored file type; no changes made)
- test.txt (unmonitored file type; no changes made)
- test.ini (extra file found in the shadow copy)
In the above example, the extra file test.ini
(a “monitored” file type) which was present in the shadow copy, has been placed in the destination folder during the rollback operation.
Lost your files during the last rollback operation?
If you’ve lost your data during the recent System Restore operation, you may be able to get back your files by “Undo”ing the last restore.
An even better option is to recover files by mounting the corresponding shadow copy using System Restore Explorer, Shadow Copy View, PreviousFilesRecovery, or similar software.
So, how do I prevent System Restore from deleting my files?
The only way to prevent System Restore from modifying your personal files (if they belong to the “monitored” file types listing) is to store them on a secondary drive or partition and turn off System Restore for the volume via the System Restore settings dialog.
Regardless, it’s always advisable to have appropriate backups in place, especially on your external hard drive and the Cloud.
If your proprietary software stores data in a file containing one of the above file name extensions, you may make changes in your software so that it outputs to a non-monitored file name extension — e.g., .DAT extension instead of .INI.
One small request: If you liked this post, please share this?
One "tiny" share from you would seriously help a lot with the growth of this blog. Some great suggestions:- Pin it!
- Share it to your favorite blog + Facebook, Reddit
- Tweet it!