I keep a text log of all the changes made to my system excluding daily updates for anti-virus and other such updates but including all software installs and updates and software removal and any other tweaks or hardware changes. The filenames of my images, which are done every 1-2 weeks, reflect whether they are after OS updates, general software updates or just new images. The frequency really depends upon how easy it would be to reverse any changes made. I can always find an image going back about two months but mostly restoring the last image solves any problems I have had. I have restored many times using Macrium Refect free and all have been successful - not malware related I might add.
ps I have a separate partition just for images - on internal second drive and on external USB drive.