A recovery mechanism restarts jobs following correction of a system failure and automatically marks the jobs for interruption at a logical boundary. The logical boundary is above logical file updating functions such that logical files are in a known state when jobs reach the boundary. When a system failure is detected which has not yet resulted in lost data, an image of working memory, including hardware status is saved on nonvolatile storage. After the failure has been resolved, the system is initially loaded with operating programs (IPL) and working memory is reloaded from the nonvolatile storage. All jobs which were reloaded are marked for interrupt at a machine instruction boundary, and processing is started. After all jobs have reached the boundary, or a predetermined time has elapsed, processing is stopped and the system is re-IPLed. There are few system index recoveries to be performed, since most jobs reached a point where logical files were synchronized with corresponding data.