System Restore
How it works
- System Restore consists of two parts, file monitoring and restore point management.
- Restore points contains: snapshot of the registry and certain dynamic system files.
- an unsigned driver causes a restore point.
- automatic updates causes a restore point.
- monitors program/system files and user data (file types) if you set it do do so.
- you can turn on/off monitoring in specific drives containing only data (example)
- More details in this MS article
