A solution for this is provided by Doug Knox who created the application Sys Restore Point which can create a System Restore Point by double-clicking the executable of the program. The software works from every directory it is placed in and does not have to be installed.

It is furthermore compatible to Windows XP and Windows Vista and creates System Restore Points without user input. The Microsoft .net 2.0 Framework is required to run the latest version of the software.

Doug gives the tip to create a shortcut to the file executable and place that shortcut in a location where it can be launched quickly. It is even possible to add it to a scheduler to create a System Restore Point as part of a scheduled process.

Related posts

• Windows XP Run Count List and Editor (3)
• Windows Updates Downloader (6)
• Use Windows Vista fonts in Windows XP (22)
• Tweak Windows with TweakNow WinSecret Professional (0)
• Run Vista’s Windows System Assessment Tool In Windows XP (0)

System Restore Points are created when several events trigger. Those are for example the initial booting of the system, before program installations and every 24 hours of uptime. System Restore is enabled by default.

Restore Point Analyzer is a forensic tool that can determine the original paths and file names of files stored inside restore points. It has been created by the company Mandiant and was used by one of their forensic experts to determine if a client’s notebook had been compromised.

A simple xml file in C:\WINDOWS\system32\Restore called filelist.xml is responsible for file inclusions and exclusions and it is immanent to check if this file has been altered in any way. The best way to do this is to make a copy of the file when System Restore is activated for the first time. You can then use a simple File Comparison tool like Winmerge to compare both files.

Restore Point Analyzer helps in determining when a file was added to System Restore, it’s name and location on the system. This gives the analyst excellent information if the intruder was clever enough to delete the files that he did use to gain access to a computer.

The software can list all of the files in a System Restore directory. Unfortunately though those files are not listed with their original name but with a seemingly random name. The file change.log keeps record of those changes and can be consulted to find out the new file name of the file that you are looking for.

I suggest you read the excellent White Paper that is available on the Mandiant website as well to receive further information on the process.

Related posts

• ZoneScreen Finally Gets 64-bit Update (7)
• ZC DVD Creator Platinum [Free Full Version] (19)
• Youtube Videos Downloader TubeQueue (17)
• Youtube Video Search Is A Barebone Youtube Downloader (2)
• Youtube Playlist Converter (7)

System Restore might be a good way to give users the option to fallback when something goes wrong but the amount of data used is more often than less way out of proportion. You can check your System Restore settings by opening the Control Panel, selecting System from the links in there and the tab System Restore in the new window.

System Restore can either be deactivated for all drives, activated for some drives or for all drives. If it is activated the settings button will display information about the maximum amount of space which is 12% of the space on the hard drive.

You can find out about the space that System Restore is currently occupying by using Windows Explorer. Right-click on the System Volume Information folder and select Properties from the menu.

If you feel that the file size of the restore points is to big you could decrease the amount Windows uses in the System Restore menu in the Control Panel. Or, you could do the bold and turn of System Restore on all drives. I have it turned off since the beginning and I never had a problem.

To just get rid of all System Restore points is also easy. Turn off System Restore and turn it back on again afterwards. This cleans all System Restore points that are currently on the hard drive.

Are you using System Restore or do you prefer another method of backing up your files ?

Related posts

• Single Click System Restore Point Creation (3)
• XdN Tweaker for Windows (3)
• Windows XP Run Count List and Editor (3)
• Windows XP prompts to activate every time (6)
• Windows Xp Diagnostic Guide (0)

In their drive for a uncomplicated system they restrict user possibilities to create a system the way they like. It is becoming a closed system with the owner of the computer being a user instead of someone who can actively alter his system the way he wants. To change the System Restore size in Microsoft Windows Vista you have to rely on the command line utility vssadmin.

Open the command line and use the following command to change the size of System Restore in Windows Vista:

vssadmin resize shadowstorage /on=c: /for=c: /maxsize=4GB

This would change the allocated size of System Restore on drive C: for drive C: to 4 gigabytes. Please note that the on: parameter is the drive letter where the System Restore files are stored while the for: parameter defines the drive that the files should be backed up from. The maxsize parameter is pretty obvious. It can’t go below 300 Megabytes. If you remove the maxsize parameter the settings will be changed to the default ones again.

If you select a size that is lower than the current amount of space the oldest entries in System Restory will be deleted first.

Related posts

• Single Click System Restore Point Creation (3)
• Download Windows Vista SP1 RC1 (43)
• Download Windows Vista SP1 Beta through Windows Update again (79)
• Copy to Path Hidden Vista Feature (3)
• Yuck new Windows Vista Ultimate Extras (20)