- Where Did Device Driver Rollback Start?
- How Device Driver Rollback Works
- At the Heart of the Matter: System Restore
- What's in the Snapshot?
- Summary
At the Heart of the Matter: System Restore
Device Driver Rollback is one feature of the broader initiative that Microsoft is rolling out in Windows XP, which is System Restore. Taking into account changes in operating system files in addition to application, device driver and network-centric files, System Restore's features also make it possible to create a preventative maintenance strategy for PCs and workstations running Windows XP. The lessons learned from Windows 95 and 98 of booting into Safe Mode or Normal Mode are also included in Windows XP. Specifically, Windows XP will save all previous application-layer data activity, so no emails, browsing favorites, or documents are lost in the event the system stops or is rebooted.
Just as Windows 2000 includes the pagefile.sys for creating and then using a disk cache, System Restore in Windows XP uses a comparable approach to disk cache for creating a mirror of the system registry. For the System Restore capability to work on a system running Windows XP, at least 200MB of disk space is needed. The folks at Microsoft feel that this technology is so promising that they have created a script that will check for 200MB of disk space if it is not immediately available. When the space comes available, it will prompt and ask you if you want to install all System Restore features. Figure 2 shows that the level of integration System Restore (SR) is within both the Kernel Mode and User Modes of Windows XP. Note that System Restore is fully independent of the file system used (FAT, NTFS, HPFS) and in User Mode, a module independent of the Win16 and Win32 APIs.
){kind=link}
Figure 2 Comparing System Restore's role in Kernel and User Modes in Windows XP.
How then does System Restore know when a device driver is OK, and the SR commands take a snapshot of the registry and store it on disk cache? The answer is that instead of simply being periodic about when System Restore functions are completed, there are "trigger events" that make System Restore events take place to ensure that the files pertaining to system configuration and device drives are saved in the context of the registry snapshot. The following events trigger a restore point at the System Restore level:
If an application that is being installed accidentally causes harm to another application's DLLs or other files. When an application install script starts a snapshot of the registry is captured in cache.
A user for downloading and installing updates from the Microsoft Web site initiates Microsoft AutoUpdate installation. Once the update is downloaded, the user is presented with the opportunity to install the update on the user's system. When the user chooses to install the update, the System Restore feature will create a restore point before the actual installation of the update begins. If the user restores after files are downloaded but before the installation of the update occurs, the downloaded files will not be removed by the restore operation.
Restore operation initiated by administrators. If a user, for example, accidentally chooses the wrong system state to restore back to, the user can undo the restore operation by choosing a restore point before this operation. The user can then choose the correct restore point.
Microsoft Backup Utility Recovery. Before Microsoft Backup Utility performs a backup recovery, System Restore will create a restore point. In the event the recovery is cancelled or leaves the system in an undesirable state, users can use this restore point to revert the system to the point before the recovery started.
Unsigned driver installation. Before the installation proceeds, a restore point is created; so if the installation results in a harmful impact to the system, users can restore to the point immediately before the unsigned driver installation.
Manual Restore points. At any time, users (administrator/owner users only) may create and name an on-demand restore point. This is useful for creating a "checkpoint" to return to before making a particularly risky change, before a shared system is left to other users, or at a particular state the user perceives to be optimal.
Because there are several events that can trigger a registry to be turned into a snapshot and saved to the disk cache area, it will be common to see Windows XP with several system instances of device driver/system configuration options to restore from. The System Restore Wizard provides an interface for administrators to select the date and time that designates to the system configuration that best matches the needs of the restore functionality. Figure 3 shows how the restore process works in Windows XP. Note that the entire configuration—including device drivers, system configuration files, and networking files—can be reverted back to by using the wizard.
){kind=link}
Figure 3 How the System Restore process works in Windows XP.
In Figure 3, it's easy to see that the entire configuration is both created in a snapshot of the registry and then reinvoked at the request for Device Driver Rollback. While the restore process is welcome news for administrators who have tens to hundreds of PCs to deal with when a device driver changes, the Rollback feature does pick up all the attributes of the previous configuration, including the dial-up and network configuration settings. At the present time, it is not possible to selectively roll back certain components over others; hopefully, Microsoft will provide for this functionality in the future. That would be exactly what administrators would need: selectively do en masse system rollbacks for troublesome software components.