3

I have recently found out that Windows System Restore monitors a large list of file extensions and all are reverted or deleted when a system restore is executed. These extensions are in many cases associated to other programs and the recovery may result in inconsistency or data loss.

In my case I became aware of this behaviour because of some *.idb files used by MySql to store table data were deleted by the restore process.

With a quick search I found out that the extension list can't be edited in any way and excluding file using the registry key FilesNotToSnapshot is not a viable solution because in this case they will be completely deleted as if they were never there.

There are however some programs that can be used to recover last version and restore it but to do this I should know that a system recovery has been performed.

Can I check if a system restore was performed, is there a registry a variable or something that I can monitor with a custom program?

1 Answer 1

1

This probably isn't the best solution but it fits my needs.

In windows application event log there are some events relative to system restore points Id 8202 is associated to a successfully restore executed from a restore point.

I've written a small program and set it up to run at startup to read event log and check for event 8202. It compares the date of last 8202 event with the previously stored date local txt files. If the date differs program window stays open otherwise it closes. Stored date is updated every time window is manually closed.

The relevant bits of code for reading event log are

//init log reader
string eventLogName = "Application";

eventLog = new EventLog();
eventLog.Log = eventLogName;

// read events and store relevant ones in a local variable
List<EventLogEntry> entries = new List<EventLogEntry>();

foreach (EventLogEntry log in eventLog.Entries)
{
       if (log.EventID != 8202)
       {
           continue;
       }
       entries.Add(log);
}

Then i check then content of entries variable.

I've only tested it against a manually launched restore point and it has done its job.

Note that if the program is stored in a monitored disk a restore point should be manually created after adding it or the first restore will remove it as "exe" is a monitored extension.

0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .