Returnil System Restore question.

Does it work like Comodo Time Machine / Rollback RX?

Will/can it restore the whole system drive to an earlier time?

 

I asked a similar question in the following thread: https://www.wilderssecurity.com/showthread.php?t=279711.

From the answer I received, it appears that RVS works in a different way.

 

after reading the whole thread.. i still cant understand how Returnil System Restore works... (im dumb lol)

so.. are there any difference between Windows System Restore and Returnil? looks the same to me

 

Returnil is an example of partition virtualisation. From the user perspective, it does appear that the changes made to the system partition (usually C: drive) while in the virtual mode are taking place within the underlying file system, but this is an illusion as all changes to the disk are in reality being redirected to a temporary area that is discarded on exit from the virtual mode at reboot.

With paid versions of the program, it is possible to selectively save some or all of the changes to the real system before exiting a virtual session in order to avoid losing them on the reboot. Alternative ways to save data while in a virtual session include saving data to an alternative (non-system) partition or allowing Returnil to create a virtual disk (usually Z: drive) that can be used to permanently save data.

Windows System Restore on the other hand does not use virtualisation. All changes to the system partition while using the machine are made to the real system but System Restore periodically saves the program and system files so that they can be restored to an earlier point if required.

Comodo Time Machine and Rollback RX use disk sector mapping, which means that whilst changes occur within the real file system, the original disk sectors and sector maps are preserved as snapshots that can be restored later if required. Functionally, disk sector mapping is similar to Windows System Restore insofar as it is a kind of "note/restore" operation as opposed to the "pretend/really" approach of virtualisation but technically sector mapping is very different from Windows System Restore which uses the Windows file system.

Virtualisation and disk sector mapping approaches are guaranteed to restore the machine exactly to a previous known state while Windows System Restore is not a full restore of all changes to the disk and therefore may not always be successful.

A potential drawback with disk sector mapping is that it involves preserving disk sectors that Windows thinks have been released for reuse. This means maintaining a file system outside of Windows that the operating system has no knowledge of, with the consequent risk of system corruption if something does go wrong. Virtualisation is safer in this respect, which is a point to consider when evaluating alternative approaches.