Windows 10: Possible to open "Restore Point" files from "system volume information

Hello!
I've a customer with a vista computer (i know, spare the flame:ing *Smile) it was infected with crypt0l0cker and after restoring it to a previous restore point it seems like the SAM hives or something broke down on it since i cant create new users and some services isnt working as it should included VSS (so I cant do a new system restore).

So I can't use "system restore" app but the files/snapshots are still present under "system volume information", is there a way to open these files on another computer, to browse them and save some of the files in it?

EDIT: I found a good solution please se my reply further down. (this will work on other systems then Vista)


//BR
Patrik

:)

 

5800 XM " General: System Error " on saving music file

WHAT CAN I DO NOW

 

" NOKIA X2 " How to Hide Files (Photos/Videos) from Gallery view..??

hi .. i hav found one trick by which we can hide all photos and videos/mp3 from gallery.

m using this ith my nokia c3 . very nice privacy trick.



Best Way To Hide Files Folders in Nokia s40 Symbian OS

 

Your problem statement isn't entirely clear- it does seem as though you can boot..

You may be able to fix VSS with a utility from Macrium Reflect
How to troubleshoot Microsoft Volume Shadow copy Service errors (VSS)

If you can't boot, then you might consider trying to restore your registry backup- which is possible.

& see
Vista Forums

Good luck

 

Ok! Found a solution!

I read that the shadow copies have links to \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy

So I created a symlink on the machine with the following command:

ex: mklink /D C:\shadow_volume_1 \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\

which mounts the first shadowcopy to a folder in C: named shadow_volume_1 and there I could explore all the files. So I found which shadowcopy which was closest to before the files were encrypted and then copied them to a external drive.

I also found out that there are some tools for this ex. libvshadow, VSC toolset, etc.

Info can be found here:

Mount shadow volumes on disk images - ForensicsWiki

Windows Shadow Volumes - ForensicsWiki

 

Sounds like you'll have a very happy customer! Well done. (Encourage them to start using disk imaging)