FolderRisk: Caution
restore C:\Windows\System32\restore
System Restore configuration files (monitored file list); restore points are stored elsewhere.
What it’s for
System32\restore holds the configuration of System Restore, the feature that saves restore points: snapshots of system files, installed apps, the Registry and settings. A restore point lets you roll the system back to an earlier stable state without touching personal files. System Protection, which creates these points, is not turned on by default on every installation, but it is recommended.
What it contains
filelist.xml, which defines the files and folders monitored or excluded by System Restore.- No restore points: they are stored on the volume, in the protected
System Volume Informationfolder.
Risks and best practices
- Deleting or editing these files can degrade or disable restore.
- Turn on System Protection and create a restore point before a risky operation (driver, major update, Registry change). The maximum space it can use is set in System Properties > System Protection > Configure.
- A restore point does not protect personal documents, so do not count on it to recover them.
Useful commands
# Folder contents (read-only)Get-ChildItem "$env:windir\System32\restore" -Force
# Existing restore points (Windows PowerShell 5.1, as administrator)Get-ComputerRestorePoint
# As administrator: create a restore point# Checkpoint-Computer -Description 'Before change' -RestorePointType MODIFY_SETTINGS:: Space allocated to System Protection (as administrator)vssadmin list shadowstorage