Question about System Restore

Can the System Restore function in Vista cause deletion of files like pictures? I just rec'd a phone call from a client, he said "I ran the System Restore, and set the date to like a month ago 'cuz my PC was running OK back then, but now all my pictures are gone. I had thousands of pictures and I can't find 'em anywhere". After asking more questions, it appears that he also ran CCleaner at some point, and it appears that he is also unable to 'un-do' the System Restore. I didn't get the whole story, and I think this may be a malware issue; he did not divulge the reason why he felt the need to roll back the PC by 4 weeks other than "it was running OK back then". I'll be getting the laptop tomorrow, but is it possible to lose thousands of pictures via System Restore? I was under the impression that System Restore had no effect on documents, pictures, installed software, etc; that it only affected the OS....

(probably a question for another thread, but if the pics are indeed "gone", is it possible to bring 'em back with some data recovery software? or does the System Restore throw stuff in to an unrecoverable abyss?)

 

Who knows what he may have done if "it was running OK back then" is the only reason for doing a SR to that specific date, it don't sound very technical to me.

If the pictures were kept where they should have been, in the My Docs or My Pictures folders, then system restore will not have touched them.

Worth trying Recuva to see if you can find the pictures. If so, save them somewhere safe, like the, er. er. My Pictures folder :-D.
Then scan for any malware.

dave

 

I would first do an Explorer search for all photos to be sure that they were removed for certain.

 

I recommend installing Everything search engine.

When it is first run it will build a database of files on the computer, which is fairly quick.
Then you can do a search like *.jpg or *.bmp, etc.

If they are still there, it will find them.
The search results can be sorted by clicking the column headings.
Each click Reverses the current sort order.

 

System Restore doesn't mess with ANY user files, it only restores driver and system settings to a previous state. Why system restore points take so much space is beyond me, but either way... it DOES sometime cause files to be "moved around", and that's in quotes because I use the term loosely.

I helped a woman find her pictures because they were suddenly ALL GONE. They weren't gone, she'd just lost her usual way of getting to them (recent documents shortcut or something). It's likely your client has some sort of picture importation software installed, and it puts the pictures in somewhere other than the easiest possible place to look.

 

Like a special folder in the programs file?
Hadn't thought of that myself.

 

I thought that System Restore would only preserve files that were in the MY Documents folder.

http://support.microsoft.com/kb/261716

http://www.microsoft.com/windowsxp/using/helpandsupport/expert/russel_sysrestore.mspx

Edit:
To work around this behavior, run the System Restore utility again and then click Undo my last restoration.

 

The owner of the PC in question was supposed to bring me his laptop this morning (Weds Apr 6); he didn't show. Maybe he found the missing pics? Who knows.

The laptop's owner claims to have done this already. (the owner of the PC is a fairly "vague" guy and doesn't really offer any useful descriptions of his actions- why? when? what? he has a remarkable talent for circumventing to-the-point questions with useless answers)

The owner of PC claims to have tried this but it was unsuccessful for whatever reason. (I'll say it again- the owner of the PC is a fairly "vague" guy and doesn't really offer any useful descriptions of his actions- why? when? what? he has a remarkable talent for circumventing to-the-point questions with useless answers :banghead ).

As I said above - I was supposed to have the PC "in hand" this morning, but I got a "no call, no show" so I have no idea what's happening. However - I have rec'd some EXCELLENT info on the somewhat mysterious topic of "System Restore", and I truly appreciate it. I personally have NEVER been a fan of System Restore as it seems to be too unreliable, or "moody", or inconsistent. It never seems to do the same thing twice. On the other hand, it has been a lifesaver in some scenarios (not for me personally -I have NEVER needed to use System Restore on my personal main home PC).

If I ever get the laptop in my hands again, I'll add more to this thread.... and thanks again for the input! It was VERY helpful!
:-D

 

I have not used Minitools Power Data Recovery for recovering files after a system restore but it is supposed to be able to.

How to recover data after system restore?

 

Yeah, and if you read the KB link, it clearly states the only files that get messed with are system-type files (.exe, .com, .dll, etc.). System Restore doesn't mess with picture, video, document, etc. files. Also, the only executables, etc. that get messed with will be in Windows system file areas, not any place someone or a program would normally save anything.


And yes, hrlow2, I've seen some programs put the pictures several folders deep within Program Files. I've also seen them use a massive folder tree inside My Pictures, making it difficult to manually get to the pictures. I've ALSO seen them put stuff in the AppData folder (Windows Vista/Windows 7) in the user profile.


Personally, I've never been able to resolve ANYTHING using System Restore. I think it's a useless waste of time and storage space, personally. I always disable it on all drives on my computers, as every time I've ever used it, it takes awhile to give absolutely no positive results. I'm sure it's helped someone sometime somewhere, but it's never been an experience I've witnessed.

 

My view is that I would never advise anyone to disable System Restore on the system disk or partition.

I can give an example of a case where system restore was the ONLY way I could fix
a problem, short of doing a re-install.

After running the full malware cleanup procedure, I had no sound in my web browser.
Everything else was working. I did quite a bit of web searching and found several possible
solutions but none of them worked.

I also had regular registry backups that had been made with ERUNT, but none of those was
able to fix the problem.

Using a Restore Point from two or three days earlier DID repair the missing browser sound.

There may have been one or two other incidents but that's the one that I remember because
it was such a bugger.

The only thing that I DO suggest is to lower the amount of disk space allocated for system
restore. The default Percentage setting is Much too high, particularly with current common
disk capacities.

 

to mjnc:
And I have seen cases where the machine was reinfected from a System Restore that was created AFTER the infection occured.
I turn off System Restore to clear out all the previous points, then after I do the cleanup to my personal satisfaction, then I turn System Restore back on at a lower setting (about 3%) and create a new fresh restore point that the owner can have some confidence in.

 

I think that is exactly what the major geeks malware team recommends.

I have also done that a few times and I currently use a setting of 3% for system restore
space on the system partition.

 

May be what they recommend, but I worked it out by trial and much errors on my part before I figured it out.
Now a procedure I do on any machine I work on.

 

I had a lady who lost her pictures, after a friend took it away to clean it up (she was brow beaten , as I always kept her laptop in condition, and the same chap offered to help me teach, saying he was a teacher?????) :cry
Now I am just an old fogey who has dabbled for years, and somehow learnt a little, but I used system restore to the day before he messed with it, and all her pictures were there.rolleyes
So, debatable, yes, but System Restore can still be useful at times.
Of course, a Lynux disc might have found the pictures, as , if I understand it correctly, it looks for the correct binaries, or, something like that, and can spot them, I believe, but I have never had to try it myself. But System restore should not overwrite the pictures, as, normally, you can go back to the future, if you want to (undo restore) so the pictures are still findable on the hard drive, with the right tool.
I have tried other tools, like ' pci file recovery ' with some success.

 

I have gone back to the future with System Restore maybe once or twice.

But now I can't - I sold my DeLorean.