Techniques are disclosed for creating an application restore point when an application is installed or updated and for restoring the application and other elements of a computing system modified by the installation and update processes to a state as they exist at the application restore point. The application restore point captures information about which files are modified, created, or deleted by the installation and update processes. In one embodiment, a user invokes an installer process to install or update the application. When the installer process modifies or creates a file, an original copy of the file, or a reference to the file is placed into the application restore point. To restore the application, files of the computing system having original copies in the application restore point are replaced with the original copies while all new files referred to in the application restore point are deleted.