explaingit

qhencoder/sysrestoredriver

Analysis updated 2026-05-18

★ 29CAudience · ops devopsComplexity · 5/5Setup · hard

TLDR

SysRestoreDriver is a Windows kernel driver that wipes any changes made to a protected disk drive every time the computer restarts.

Mindmap

mindmap
  root((SysRestoreDriver))
    What it does
      Reverts disk on reboot
      Redirects writes silently
      Per-volume protection toggle
    Tech stack
      C
      Windows Driver Kit
      NTFS
    Use cases
      Public computer labs
      Internet cafes
      Shared kiosk machines
    Audience
      System administrators

Code map

Detail Auto

An interactive map of this repo's files and how they connect — its source is parsed live in your browser. Click Visualize to build it.

filefunction / class

What do people build with it?

USE CASE 1

Keep a shared or public computer, like a lab or internet cafe machine, resetting to a clean state after every reboot.

USE CASE 2

Protect a system drive or data drive from permanent changes made by untrusted users.

USE CASE 3

Toggle protection on and off for individual NTFS volumes using the included desktop management app.

USE CASE 4

Test disk-reverting behavior on a virtual machine before deploying to real hardware.

What is it built with?

CWindows Driver KitNTFS

How does it compare?

qhencoder/sysrestoredrivercocomelonc/tabbyar0x4/tunnel-vision-toolkit
Stars292930
LanguageCCC
Setup difficultyhardmoderatehard
Complexity5/55/55/5
Audienceops devopsresearcherresearcher

Figures from each repo's GitHub metadata at analysis time.

How do you get it running?

Difficulty · hard Time to first run · 1h+

Kernel-level driver in early release (v0.1), test on a virtual machine and back up data first, as it can corrupt the file system if misused.

Open source, though the README does not name a specific license.

In plain English

SysRestoreDriver is an open-source Windows kernel driver that makes a hard drive automatically revert to a clean state every time the computer restarts. Once protection is turned on for a volume, any file write that would normally go to the disk is silently redirected to free space elsewhere on the drive. When the machine reboots, those redirected writes are discarded and the disk looks exactly as it did when protection was first enabled. The effect is similar to commercial products used in internet cafes and school computer labs, but built entirely from scratch under an open-source license. The project comes with a desktop management application called QHEngineUI, which provides a simple window where an administrator can choose which disk volumes to protect and toggle protection on or off. The driver file is embedded inside this application, so there is only one executable to run. Both the driver and the UI are built using Microsoft's own driver development toolkit with no third-party dependencies. The driver works only on NTFS-formatted volumes and has been tested on Windows 10 and Windows 11. It can protect multiple volumes independently, including the system drive, data drives, USB drives, and external media. Non-NTFS volumes are automatically skipped. Turning protection off requires a reboot to take effect, by design: while protection is active the disk's internal metadata is frozen at the moment protection was enabled, and simply unloading the driver mid-session would corrupt the file system. The README includes measured performance numbers from benchmark testing. Sequential large-file writes slow down by roughly 35 to 59 percent under protection, while small random reads and writes show less than 6 percent overhead. The author notes that the primary bottleneck is the defensive copy step required before each write. The project is in early release (v0.1) and the README carries a clear data-safety warning: test on a virtual machine first and keep a full backup before deploying on any machine with important data.

Copy-paste prompts

Prompt 1
Explain how SysRestoreDriver redirects disk writes and discards them on reboot.
Prompt 2
What is the performance overhead of running this driver, based on the README's benchmarks?
Prompt 3
Walk me through using QHEngineUI to enable protection on a specific volume.
Prompt 4
Why does the README recommend backing up data before installing this driver?

Frequently asked questions

What is sysrestoredriver?

SysRestoreDriver is a Windows kernel driver that wipes any changes made to a protected disk drive every time the computer restarts.

What language is sysrestoredriver written in?

Mainly C. The stack also includes C, Windows Driver Kit, NTFS.

What license does sysrestoredriver use?

Open source, though the README does not name a specific license.

How hard is sysrestoredriver to set up?

Setup difficulty is rated hard, with roughly 1h+ to a first successful run.

Who is sysrestoredriver for?

Mainly ops devops.

Open on GitHub → Explain another repo

This repo across BitVibe Labs

Verify against the repo before relying on details.

Alternatives & similar repos