How and Where System Restore Points are saved:
Restore points are saved in under x:\system volume information\_restore{558C94FD-3C7F-4954-A02D-
26679E6D849E}. Each restore point's files are saved in a folder named RPXX where XX is a two digit number
corresponding to the restore point.
System Restore: Description and Functionality of Srdiag.exe
The file Srdiag.exe is a tool developed specifically for capturing System Restore files and putting them into a text format or other format so that a support professional or an advanced user can easily view the contents of such files to try to diagnose problems that are occurring with System Restore.
Srdiag.exe collects all information that is related to System Restore and puts it in a .cab file. The .cab file name is then
automatically generated by using the computer name, followed by a timestamp for the month, day, and year, as well as a timestamp for the hour, minutes and seconds of the .cab file creation. More Information.
What is restored on my machine when I use System Restore and what is not?
The following are restored when you use System Restore to restore your system to a previous time using a restore point:
Registry
Profiles (local only—roaming user profiles not impacted by restore)
COM+ DB
WFP.dll cache
WMI DB
IIS Metabase
Files type which are monitored by System Restore as specified in the SDK available from http://msdn.microsoft.com/library/en-us/sr/sr/monitored_file_extensions.asp.
The following are not restored by System Restore:
DRM settings
Passwords in the SAM hive.
WPA settings (Windows authentication information is not restored)
Specific directories/files listed in the Monitored File Extensions list in the System Restore section of the Platform SDK e.g. 'My Documents' folder.
Any file types not monitored by System Restore like personal data files e.g. .doc, .jpg, .txt etc.
Items listed in both Filesnottobackup and KeysnottoRestore (hklm->system->controlset001->control->backuprestore->filesnottobackup and keysnottorestore) in the registry.
User-created data stored in the user profile
Contents of redirected folders
Restore points are saved in under x:\system volume information\_restore{558C94FD-3C7F-4954-A02D-
26679E6D849E}. Each restore point's files are saved in a folder named RPXX where XX is a two digit number
corresponding to the restore point.
System Restore: Description and Functionality of Srdiag.exe
The file Srdiag.exe is a tool developed specifically for capturing System Restore files and putting them into a text format or other format so that a support professional or an advanced user can easily view the contents of such files to try to diagnose problems that are occurring with System Restore.
Srdiag.exe collects all information that is related to System Restore and puts it in a .cab file. The .cab file name is then
automatically generated by using the computer name, followed by a timestamp for the month, day, and year, as well as a timestamp for the hour, minutes and seconds of the .cab file creation. More Information.
What is restored on my machine when I use System Restore and what is not?
The following are restored when you use System Restore to restore your system to a previous time using a restore point:
Registry
Profiles (local only—roaming user profiles not impacted by restore)
COM+ DB
WFP.dll cache
WMI DB
IIS Metabase
Files type which are monitored by System Restore as specified in the SDK available from http://msdn.microsoft.com/library/en-us/sr/sr/monitored_file_extensions.asp.
The following are not restored by System Restore:
DRM settings
Passwords in the SAM hive.
WPA settings (Windows authentication information is not restored)
Specific directories/files listed in the Monitored File Extensions list in the System Restore section of the Platform SDK e.g. 'My Documents' folder.
Any file types not monitored by System Restore like personal data files e.g. .doc, .jpg, .txt etc.
Items listed in both Filesnottobackup and KeysnottoRestore (hklm->system->controlset001->control->backuprestore->filesnottobackup and keysnottorestore) in the registry.
User-created data stored in the user profile
Contents of redirected folders
