Windows Explorer has a feature to restore individual files, but the process of doing only works if the file that you want to restore still exists on the machine. See Restore Previous Versions Of Windows Files for pointers.

The free program System Restore Explorer for Windows offers a better solution. The program displays all existing system restore points in its interface. This includes the date and time of creation, the description and the total disk space used by all system restore points.

A right-click on a specific system restore point opens a context menu with options to delete the data or to mount and unmount it. Mounting basically creates a shortcut to that system restore point that you can click on to open all of its folders and files in Windows Explorer. This way you can select individual files or folders for restoration. You’d then use the unmount context menu option later on to remove the shortcut from the system again.

The core benefit of System Restore Explorer is that it makes it a lot easier to restore individual files from system restore points. The option to delete previous restore points is a nice addition to that.

Windows users can download System Restore Explorer from the developer website over at Nic Bedford. The program is offered as a beta version, and it is not clear if the developer has abandoned the project. A viable alternative is the previously reviewed Shadow Explorer. System Restore Explorer is compatible with 32-bit and 64-bit editions of Windows Vista and Windows 7. (via)

This is where System Restore comes in handy. As most of us know, it’s where we can roll back system settings to a predetermined point. It was available on XP and Vista, and you’ll also find it on Windows 7.

But now lets assume that for some reason Windows 7 won’t allow us to boot into Windows or run system restore in the usual way. What do we do now? Well, you can run system restore from your Windows 7 disk. Before you do this, make sure you have exhausted all other options first. One wrong move when running system restore from your Windows disk, and you could find yourself reformatting your drive – and that’s not what we want to do.

So begin by inserting your Windows 7 disk, and boot up your computer. We’ll assume that you already have your BIOS set up boot from CD first. If not you’ll have to enter the BIOS (usually by pressing F2 or DEL at start-up), and change the boot up priorities.

You should see a prompt to boot from DVD, and after you press any key the Windows 7 setup will begin. At this stage, no changes are being made to your computer so don’t worry, you’ll be given options later to choose what you want to do. The first screen you’ll see is where you’re prompted to choose your language and keyboard layouts. Again, we’re not changing anything on your Windows installation at this stage, we’re only choosing this for the benefit of the setup program, so go ahead and choose your keyboard layout and click next.

The next screen is the one we need to be careful about. We don’t want to click “Install Now”, because that will start a new installation of Windows 7. We want to click on the link further down that says, “Repair your computer”.

Clicking on this will prompt the computer to search for installed operating systems. It will find our Windows 7 install, and you’ll be taken through a wizard. Click next, and choose “System Restore” from the menu. What you see now should be the same kind of dialogue boxes as you’d see if you ran system restore from your Windows desktop, except in this case, we haven’t booted into Windows so no nasty viruses or bugs can stop us from carrying out the maintenance. Follow the instructions to choose a system restore point from a day you know your computer was working correctly, and when you reboot you should hopefully find you have a working system again. If not, repeat these instructions and maybe choose a restore point that was further back in time.

I was asked recently how the previous file versions where created by Windows, and if there was a way to change the amount of file versions to go back.

The restore previous versions feature is directly linked to the Windows System Restore and Data Backup features. If both features are turned off, it is not possible to restore previous versions of files in Windows. The creation of system restore points or system backups is therefor not only mandatory for the feature itself, but also for the amount of different file versions available.

The less space you assign to the features, the less file versions you will be able to restore at a later point in time.

Users who only create no more than one or two System Restore points will see fewer file versions in the listing than users who have given the System Restore feature more space on their hard drives. The same is true for users who regularly backup data on their computer.

File versions are only saved in restore points when the System Restore feature creates one. This means that users won’t see different versions of a file that they have edited and saved multiple times on a day. That is, unless they create System Restore points manually to pick up the changes every time. They still have to keep an eye on the size of all System Restore points to make sure that previous file versions do not get deleted when an old System Restore point is deleted.

The feature falls short, especially when it comes to storing all previous file versions of a file for backup and restoration purposes. Users who want to make sure they can restore all file revisions need to look elsewhere for that functionality.

There are better options to make sure you have a backup of different file revisions in the Windows operating system. Among them previously reviewed programs like File Hamster or an online file syncing service like Dropbox.

Refresh PC is a free program for Windows that adds a similar restoration option to current Microsoft operating systems. The freeware is not restoring the whole system like Windows 8′s feature, but only select parts of it.

Refresh PC offers to restore all Registry settings and system services to their default state. Say you have used Windows tweakers or manual editing of the Registry. Later you found out that the settings caused problems that you cannot seem to fix anymore. Another example would be a virus attack or other malicious code that changed system settings. And while you managed to clean the malware from your system, you do not know which Registry settings you need to change to restore the system to its previous state.

That’s where RefreshPc offers to help as it can reset those settings when you run it.

You need to install the program after you have downloaded it. The program recommends to create a System Restore point when you run it which you should create unless you are using other means of backup. Just make sure you have a backup in reach in case you need to restore your system.

The program detects your operating system and version on startup, and displays the information in the program interface.

The interface itself has only one button that will restore the settings to their factory defaults when activated.

RefreshPC restores the Registry settings and system services, and cleans the temp folders and prefetch files at the same time. There is no option to select only some of the options. When you press the button, all actions are carried out.

Refreshing the system services will restore the services to their initial values. The Registry refresh requires some explanation. The program will only reset Registry settings that ship with Windows. It will not reset keys that have been added by third party installations.

RefreshPC can be a handy tool if other means of restoration like using system restore or backups have not been successful. The program can only be used if it is possible to boot into the Windows installation, which limits its reach somewhat. An option to only select some of the refresh options in the interface would be handy as well.

The application is compatible with all 32-bit and 64-bit editions of the Windows operating system, from Windows XP to Windows 7. It can be downloaded from the developer website.

The main problem that most Windows users have is that System Restore is not really that easy to configure and manage (Windows 7 users find the configuration in the Control Panel under System and Security > System > Computer (right-click) -> Properties). The option to enable, disable and change the size allocation for instance is hidden deep inside the Control Panel.

System Restore Manager is offered as an alternative to the default System Restore management and configuration options in Windows.

The free software displays System Restore points and configuration options in its interface.

Previously created System Restore points are displayed with their date and time, event that triggered the creation and restore point type. System Restore Manager offers options to delete selected restore points, create a new point or restore the system using the selected point.

Options are displayed on the right side. The program displayed an error on startup on our British Windows 7 64-bit system, the allocated disk space, disk space used and maximum space to use were not showing any values but that was the only problem we encountered during our tests, and it did not seem to have an impact on the program’s other features.

The program by default should display the disk space values of the main Windows drive here. A pulldown menu is available to switch to another drive to see its allocations.

The two remaining options can be used to change the restore point interval which is set to 1 day by default. Windows will create System Restore points based on the interval specified, plus additional system restore points whenever a monitored event (e.g. Windows Update) is initiated.

Restore Point Time to Live on the other hand specifies the retention time of individual System Restore points. Please note that this is the maximum value. Entries are deleted automatically if the allocated space for System Restore runs out of storage.

System Restore Manager is a handy program for Windows. It is not clear if the program has any dependencies and if it is compatible with all Windows editions supporting System Restore. It worked fine on a Windows 7 Professional 64-bit system except for the aforementioned bug that the disk space allocations where not shown. It can be downloaded from The Windows Club website. (via)

Windows 7 users can for instance access the feature by right-clicking on a file in Windows Explorer and selecting the Restore Previous Versions context menu entry.

The feature is turned on in all editions of Vista and Windows 7 by default.

Shadow Explorer is a third party tool that offers the following feature set:

• Show available point-in-time copies
• Browse through Shadow Copies
• Retrieve versions of files and folders

The hard drive partition, date and time are selectable at the top of the application. Shadow Explorer displays recoverable files grouped into their folders on the left side.

Both files and folders can be exported with a right-click and the selection of export from the menu.

The main advantage of Shadow Copy is the interface which is easier to navigate and use, especially if multiple files or folders need to be recovered on the system.

A lot has changed since our first review in 2008. Shadow Copy for instance does not need elevated privileges anymore to run. The latest version is now showing all modified, accessed and created timestamps as well which are preserved when files or folders are exported.

Shadow Explorer is available for download from the developer website. It is available for 32-bit and 64-bit editions of Windows Vista and Windows 7.

System Restore is only backing up key elements of the operating system like the Windows Registry, user profile or Windows File Protection files.

One of the limitations of System Restore is that old restore points will be deleted automatically based on the available hard drive space for the feature. This means that it is only possible to restore recent system states.

Some users might want to backup an early System Restore point before it gets deleted to be able to restore it at a later time. This can be done by copying a restore folder and saving it into a different location.

Two barriers need to be passed for this to happen. The first is the hidden state of the System Volume Information folder, the second the access rights.

The option to hide protected operating system files needs to be disabled so that the System Volume Information folder becomes visible in Windows Explorer. This is done in the folder options. Windows 7 users open Windows Explorer, click on Tools > Folder options to open the configuration menu. The view tab contains the option to hide protected operating system files.

The System Volume Information folder should now be visible in Windows Explorer. It is not possible to access it right away because of the access rights of the folder. The rights can be changed with a right-click on the folder and the selection of properties. This opens a configuration window.

Switch to the Security tab in that folder.

Click the continue button. This opens a new window that lists all users or groups that have access rights. Click the add button in that window.

Enter the user name of the user who should be able to access and work with the folder. Click the check names button to find the username and ok to apply the changes.

It is now possible to access the System Volume Information folder in Windows Explorer. The system restore points use cryptic names. The best way to identify them is to look at the date they were created or modified. Pick the ones that you want to backup. It is advised to copy the System Restore points to a different location.

You can now revert the changes made to the System Restore folder and the folder visibility. If you want to restore a previously backed up System Restore point you need to copy it back into that folder to be able to do so.

Comodo Time Machine is another software program that can create system snapshots and restore them if necessary. The system snapshot will create a copy of all files and settings of the hard drive Windows is running on. This includes Windows files, Registry settings, programs and documents and other files stored by the user.

The program will automatically take a system snapshot during installation which is called the baseline snapshot in the program. The program can create new snapshots automatically or on the user’s request with further options to delete previously taken snapshots (except for the baseline snapshot) to free up disk space.

Snapshots can be mounted right in the applications’s interface by right-clicking a snapshot and selecting the mount option. It is possible to mount the snapshot with full access rights or read-only rights. All files of the snapshot become then accessible in Windows like any other directory.

Files can also be recovered individually without mounting with the help of the Recover Files menu in the Time Machine application. This feature provides a file search option to search for files in the selected snapshot. This makes it rather complicated to use, a Windows Explorer like approach would be helpful here.

The creation and restoration of system snapshots can be scheduled in the application which offers several interesting possibilities. Public computer administrators can for instance schedule a restoration of a snapshot whenever the computer starts to ensure that data that has been tampered with won’t affect the system after a restart.

Users who have full disk encryption software programs installed will not be able to use Comodo Time Machine as it requires the uninstallation of those programs before it will commence the installation. That’s a rather strict and unfortunate rule that will likely turn away users from testing or using the program regularly.

Comodo Time Machine can be managed from the command line as well. Commands like taking or restoring a snapshot can be issued from the command line.

There is finally a so called sub console that is displayed during system startup if the user presses the Home key. This sub-console loads before Windows and offers the means to restore the system, take a snapshot, uninstall the program or compact the snapshots to save hard drive space.

Comodo Time Machine is compatible with most Microsoft operating systems including 32-bit and 64-bit editions of Windows Vista and Windows 7. Its features make it an interesting program for public computers, test systems, multi-user systems and computer systems where the user wants to be able to restore a previous snapshot in case of emergency. The recovery system that loads before Windows and the ability to schedule snapshots make Comodo Time Machine a clever product for that purpose. Only the incompatibility with file encryption software like True-Crypt put a dent in the otherwise interesting program.

The software can be downloaded from the Comodo website (via BlogsDNA)

A solution for this is provided by Doug Knox who created the application Sys Restore Point which can create a System Restore Point by double-clicking the executable of the program. The software works from every directory it is placed in and does not have to be installed.

It is furthermore compatible to Windows XP and Windows Vista and creates System Restore Points without user input. The Microsoft .net 2.0 Framework is required to run the latest version of the software.

Doug gives the tip to create a shortcut to the file executable and place that shortcut in a location where it can be launched quickly. It is even possible to add it to a scheduler to create a System Restore Point as part of a scheduled process.

System Restore Points are created when several events trigger. Those are for example the initial booting of the system, before program installations and every 24 hours of uptime. System Restore is enabled by default.

Restore Point Analyzer is a forensic tool that can determine the original paths and file names of files stored inside restore points. It has been created by the company Mandiant and was used by one of their forensic experts to determine if a client’s notebook had been compromised.

A simple xml file in C:\WINDOWS\system32\Restore called filelist.xml is responsible for file inclusions and exclusions and it is immanent to check if this file has been altered in any way. The best way to do this is to make a copy of the file when System Restore is activated for the first time. You can then use a simple File Comparison tool like Winmerge to compare both files.

Restore Point Analyzer helps in determining when a file was added to System Restore, it’s name and location on the system. This gives the analyst excellent information if the intruder was clever enough to delete the files that he did use to gain access to a computer.

The software can list all of the files in a System Restore directory. Unfortunately though those files are not listed with their original name but with a seemingly random name. The file change.log keeps record of those changes and can be consulted to find out the new file name of the file that you are looking for.

I suggest you read the excellent White Paper that is available on the Mandiant website as well to receive further information on the process.

System Restore might be a good way to give users the option to fallback when something goes wrong but the amount of data used is more often than less way out of proportion. You can check your System Restore settings by opening the Control Panel, selecting System from the links in there and the tab System Restore in the new window.

System Restore can either be deactivated for all drives, activated for some drives or for all drives. If it is activated the settings button will display information about the maximum amount of space which is 12% of the space on the hard drive.

You can find out about the space that System Restore is currently occupying by using Windows Explorer. Right-click on the System Volume Information folder and select Properties from the menu.

If you feel that the file size of the restore points is to big you could decrease the amount Windows uses in the System Restore menu in the Control Panel. Or, you could do the bold and turn of System Restore on all drives. I have it turned off since the beginning and I never had a problem.

To just get rid of all System Restore points is also easy. Turn off System Restore and turn it back on again afterwards. This cleans all System Restore points that are currently on the hard drive.

Are you using System Restore or do you prefer another method of backing up your files ?

In their drive for a uncomplicated system they restrict user possibilities to create a system the way they like. It is becoming a closed system with the owner of the computer being a user instead of someone who can actively alter his system the way he wants. To change the System Restore size in Microsoft Windows Vista you have to rely on the command line utility vssadmin.

Open the command line and use the following command to change the size of System Restore in Windows Vista:

vssadmin resize shadowstorage /on=c: /for=c: /maxsize=4GB

This would change the allocated size of System Restore on drive C: for drive C: to 4 gigabytes. Please note that the on: parameter is the drive letter where the System Restore files are stored while the for: parameter defines the drive that the files should be backed up from. The maxsize parameter is pretty obvious. It can’t go below 300 Megabytes. If you remove the maxsize parameter the settings will be changed to the default ones again.

If you select a size that is lower than the current amount of space the oldest entries in System Restory will be deleted first.