How Windows XP System Restore Protected System Files

Introduced to mainstream consumers in Windows XP, System Restore provided a reliable way to roll back critical system malfunctions without erasing personal data. By relying on a combination of kernel-level file system monitoring, explicit file extension filters, and protected directory exclusions, the operating system was able to capture snapshots of core system components while completely ignoring everyday user documents.

The Filter Driver: sr.sys

At the heart of the mechanism was a kernel-mode file system filter driver named sr.sys. Loaded directly above the file system driver, sr.sys intercepted file operations (creates, writes, renames, and deletes) across all supported volumes. Instead of taking full disk images, the driver actively listened for modifications made exclusively to system-critical files, leaving general file traffic untouched.

Selective Extension Monitoring and filelist.xml

System Restore did not track every file on the hard drive. Instead, it relied on a predefined configuration file called filelist.xml, managed by the PC Health subsystem. This file maintained strict inclusion and exclusion lists:

  • Included Extensions: System Restore tracked executable files, system binaries, dynamic-link libraries, and configuration files (such as .exe, .dll, .sys, .ini, .com, and .inf).
  • Excluded Extensions: Personal file types, including .doc, .xls, .pdf, .jpg, .mp3, and .txt, were explicitly ignored by the tracking engine.

If a user edited, created, or deleted a photo or word processing document, sr.sys ignored the operation entirely because the file extension was absent from the monitoring list.

Directory Exclusions

Windows XP also enforced location-based rules. Key directories associated with user data—most notably the My Documents folder and its subdirectories—were completely bypassed by the tracking system. Even if an executable or monitored script file was saved directly into My Documents, System Restore would not track its changes or delete it during a rollback. Conversely, the Windows Registry hives, the Windows\System32 directory, and specific application installation paths were tightly tracked.

Copy-on-Write and Restore Points

When a change was about to occur to an approved, monitored system file, sr.sys utilized a copy-on-write technique. Before the modification was written to the disk, the driver copied the original, unedited version of the file to a hidden, protected directory located in the root of the drive (System Volume Information\_restore{GUID}). Along with these file copies, snapshots of the registry hives were bundled into distinct "Restore Points."

The Restoration Process

When a user initiated a rollback, the System Restore process only interacted with the catalog of files and registry entries captured in the selected Restore Point:

  1. Monitored system files altered or deleted after the snapshot were replaced with the saved versions from the System Volume Information archive.
  2. The current registry hives were swapped out for the archived registry hives.
  3. User profiles, browser bookmarks, emails, and all excluded personal file extensions were ignored by the restore engine.

Through this combination of kernel-level monitoring, extension whitelisting, and directory boundaries, Windows XP successfully repaired operating system stability while ensuring that user data remained intact.