A system restore point will recover:

system settings and installed programs. Restore points roll back system configuration. They do not touch user documents, which is why they are the wrong tool for data loss.

A computer is stable in safe mode but crashes normally. This suggests:

a driver or startup program is at fault. Safe mode omits exactly those items. If the fault vanishes when they are not loaded, one of them is responsible.

Recovery media must be created:

while the machine still works. A machine that will not boot cannot be used to write its own rescue disk. Preparing it in advance is the entire point.

Storing a backup on a second partition of the same disk is inadequate because:

a disk failure destroys both partitions. A partition is a logical division of one physical device. When the device fails, every partition on it fails together.

Which recovers a machine after total disk failure with least effort?

A system image. The image contains the operating system, programs and settings as well as the data, so the replacement disk is restored exactly rather than rebuilt from scratch.

Disk health monitoring is useful because it:

often warns of failure before it happens. Drives track their own error counters, and a rising count frequently gives days of notice — enough time to copy the data off.

The most important property of a backup arrangement is that it is:

automatic and tested. A backup depending on someone remembering will eventually be forgotten, and one never restored from is only assumed to work.

System Recovery and Advanced Maintenance — Computer Science Notes, Worked Examples and Quiz

Q: Defragmenting an SSD is:

harmful and pointless. There is no seek time to save, and the millions of extra writes consume the flash cells' limited endurance.

System Recovery and Advanced Maintenance

Getting a machine back, and making sure you can

This topic appears in:

Recovery is planned before the failure, not after

Every recovery option depends on something prepared in advance. A restore point must have been created before the fault. A backup must exist before the disk failed. Recovery media must have been written while the machine still worked.

That is the real content of this chapter: the techniques are straightforward, and the examinable insight is that none of them helps a person who did nothing beforehand.

Tool	Recovers from	Prepared in advance?
System restore point	a bad update or driver	yes — a snapshot of settings
File backup	deleted or corrupted files	yes — a copy elsewhere
System image	total disk failure	yes — a full copy of the drive
Recovery media	a machine that will not boot	yes — a bootable USB
Safe mode	a faulty driver or startup program	no — built into the OS
Reset / reinstall	irrecoverable corruption	no, but it erases your data

Restore points, images and backups are three different things

Students routinely treat these as interchangeable, and the exam distinguishes them sharply.

A system restore point saves system files, settings and installed programs — not your documents. It undoes a bad driver or update; it will not bring back a deleted essay. A file backup copies your documents but not the operating system; restoring one onto a dead machine still leaves you with no machine. A system image is a complete copy of the whole drive, which restores everything exactly but is large and quickly out of date.

A sensible strategy uses more than one: frequent file backups for the documents that change daily, plus an occasional system image so a failed disk can be replaced without reinstalling everything.

What a restore point will not do

Restoring to a point from last Tuesday does not recover files deleted since then, and it does not remove a virus that has infected your documents. It rolls back system configuration only. Students frequently offer it as the answer to data loss, and it is the wrong tool for that job.

Safe mode and startup repair

When a machine will not start normally, safe mode loads the operating system with only the essential drivers and no startup programs. If the fault disappears in safe mode, it was caused by one of the things safe mode left out — a driver, or a program launching at startup — which narrows the search enormously.

From there the process is elimination: disable startup items, re-enable them in groups, and find the one that reintroduces the fault. If the machine will not reach safe mode either, the problem is deeper and recovery media is needed — a bootable USB that starts an independent copy of the OS from which the disk can be repaired or data rescued.

Worked example

A computer shows a blue error screen a few seconds after logging in, every time. Describe how to diagnose it.

Note the error code or message shown, then boot into safe mode.The code often names the failing driver directly, and safe mode loads almost none of them.
If safe mode is stable, the fault lies in a driver or startup program, not in the core system.This single test rules out most of the possibilities in one step.
Recall what changed recently — a new device, a driver update, newly installed software.A fault that appeared on Tuesday almost always follows something that happened on Monday.
Roll back or uninstall the suspect item, or use a system restore point from before the change.This is the situation a restore point is actually designed for.
If safe mode also fails, boot from recovery media and run startup repair or a disk check.A fault present even in safe mode points at the disk, the file system or the memory.

Test in safe mode first: stable there means a driver or startup program, and a restore point from before the change is the fix.

Advanced maintenance

Beyond recovery, the syllabus expects the routine tasks that keep a system healthy and the reasons for them.

Disk clean-up removes temporary files and caches that accumulate steadily. Defragmentation reassembles files scattered across a mechanical hard disk so the head moves less — but it should not be run on an SSD, which has no moving parts and whose cells wear out with each write. Updates close security holes as well as fixing faults. Disk health monitoring reports the drive's own error counters, often warning of failure days before it happens.

Why defragmenting an SSD is harmful

On a hard disk, a fragmented file makes the head travel, which costs time. An SSD reaches any location equally fast, so there is nothing to gain — and every write consumes a little of the limited number a flash cell can take. Defragmenting an SSD performs millions of pointless writes and shortens its life. Modern operating systems refuse to do it, and knowing why is worth a mark.

Before you leave this chapter

Every recovery option depends on preparation done before the failure.
Restore point = system settings only. Backup = your files only. Image = everything.
Safe mode loads minimal drivers; if the fault vanishes there, it is a driver or startup program.
Recovery media must be created while the machine still works.
Never defragment an SSD — there is nothing to gain and it wears the drive.

Practice questions

6 questions · 20 marks · full working on every one

Try each one on paper first, then open the working. The marks are shown where they are actually awarded, because that is where they are actually lost.

Short questions

3 · 6 marks

Two marks each, in the style of the short-question section of the paper. Answer in two or three lines.

SQ1[2 marks]

Differentiate between a system restore point and a file backup.

Model answer

A system restore point saves system files, settings and installed programs, and is used to undo a bad update or driver. A file backup copies the user's own documents. A restore point will not recover a deleted file, and a backup will not repair a broken operating system.

Examiner tip. Say what each one cannot do. That contrast is what the mark scheme is testing.

SQ2[2 marks]

What is safe mode, and what does it tell you?

Model answer

Safe mode starts the operating system with only essential drivers and no startup programs. If the machine is stable in safe mode, the fault must lie in one of the drivers or startup programs that safe mode did not load — which narrows the search considerably.

Examiner tip. The diagnostic value is the second mark. Describing what safe mode loads without saying what that tells you is only half the answer.

SQ3[2 marks]

Why should an SSD not be defragmented?

Model answer

An SSD has no moving parts and reaches every location equally quickly, so there is no time to be saved. Defragmentation performs a very large number of writes, and each flash cell tolerates only a limited number, so it shortens the drive's life for no benefit.

Examiner tip. Both halves are needed: no benefit, and active harm through write wear.

Solved numericals

2 · 8 marks

Full working, one step per line, with the marks shown where they are awarded.

N1[4 marks]

A user's computer will not start after installing a new graphics driver. Describe the steps to recover it.

Full working

Boot into safe mode, which loads a basic display driver instead of the new one[1]
Uninstall the new driver, or use Device Manager to roll it back to the previous version[1]
Alternatively use a system restore point created before the driver was installedthis is exactly what restore points are for[1]
Restart normally and confirm the machine boots; then install a driver version known to workverification is part of the process[1]

Safe mode, then roll back or uninstall the driver — or restore to a point from before the installation.

Examiner tip. Name safe mode first. Any answer that begins by reinstalling the operating system has thrown away the user's data unnecessarily.

N2[4 marks]

Explain the difference between a system image and a file backup, and state when each should be used.

Full working

A system image is a complete copy of the entire drive, including the operating system, programs and settings[1]
A file backup copies only the user's chosen documents and data[1]
Use an image after a total disk failure or major corruption, so the machine is restored exactly without reinstalling everything[1]
Use file backups frequently, since documents change daily, whereas an image is large and slow and is made occasionallythe frequency point is the practical insight[1]

An image restores the whole machine; a backup restores the documents. Image occasionally, files frequently.

Examiner tip. The reason for using both is the frequency: documents change every day, the operating system does not.

Long questions

1 · 6 marks

Theory and numerical together, as they appear in the long-question section.

LQ1[6 marks]

A small office has ten computers with no backup arrangements. One has just failed, losing three years of records.

Recommend a backup strategy, explaining the role of each part.
Explain why storing the backup on a second partition of the same disk would be inadequate.
Suggest one maintenance task that might have given warning before the disk failed.

Mark scheme

Automatic daily file backups of documents, so no more than one day's work is ever lostautomatic, not left to the user[1]
Periodic system images so a failed machine can be restored without reinstalling everything[1]
Follow the 3-2-1 rule — three copies, two media types, one off-site or in the cloud — and test a restorean untested backup is an assumption[1]
A second partition is on the same physical disk, so a disk failure destroys both partitions at oncethe key point[1]
It also offers no protection against theft, fire or ransomware, all of which reach everything on the machine[1]
Disk health monitoring reports the drive's own error counters and often warns of impending failure days in advanceaccept regular disk checks[1]

(a) daily automatic file backups plus periodic images, following 3-2-1 and tested (b) a partition shares the physical disk, so both die together (c) disk health monitoring

Examiner tip. The partition point is the one being examined. Partitions are a logical division of one physical device — if the device fails, every partition on it fails together.