A method for assisting an administrator to identify files suspected of causing instability on a personal computer comprises periodically creating file content sharing logs concurrently with archiving files of a plurality of personal computers by de-duplicating, when a notification is received regarding instability of a personal computer, then analyzing archive file content sharing log of the personal computer made immediately after receiving the notification for unique system and program files, missing files and newly installed files to generate an instability report. A missing or corrupted file can be restored back on the unstable personal computer by performing a backup restore operation on the unstable personal computer.