Windows 10: Possible to open "Restore Point" files from "system volume information

Discus and support Possible to open "Restore Point" files from "system volume information in Windows 10 Backup and Restore to solve the problem; Hello! I've a customer with a vista computer (i know, spare the flame:ing *Smile) it was infected with crypt0l0cker and after restoring it to a... Discussion in 'Windows 10 Backup and Restore' started by PatrikL, Jun 13, 2017.

  1. PatrikL Win User

    Possible to open "Restore Point" files from "system volume information


    Hello!
    I've a customer with a vista computer (i know, spare the flame:ing *Smile) it was infected with crypt0l0cker and after restoring it to a previous restore point it seems like the SAM hives or something broke down on it since i cant create new users and some services isnt working as it should included VSS (so I cant do a new system restore).

    So I can't use "system restore" app but the files/snapshots are still present under "system volume information", is there a way to open these files on another computer, to browse them and save some of the files in it?

    EDIT: I found a good solution please se my reply further down. (this will work on other systems then Vista)


    //BR
    Patrik

    :)
     
    PatrikL, Jun 13, 2017
    #1
  2. atikuruu Win User

    5800 XM " General: System Error " on saving music file

    WHAT CAN I DO NOW
     
    atikuruu, Jun 13, 2017
    #2
  3. " NOKIA X2 " How to Hide Files (Photos/Videos) from Gallery view..??

    hi .. i hav found one trick by which we can hide all photos and videos/mp3 from gallery.

    m using this ith my nokia c3 . very nice privacy trick.



    Best Way To Hide Files Folders in Nokia s40 Symbian OS
     
    rockpop989, Jun 13, 2017
    #3
  4. dalchina New Member

    Possible to open "Restore Point" files from "system volume information

    dalchina, Jun 13, 2017
    #4
  5. PatrikL Win User
    Ok! Found a solution!

    I read that the shadow copies have links to \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy

    So I created a symlink on the machine with the following command:

    ex: mklink /D C:\shadow_volume_1 \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\

    which mounts the first shadowcopy to a folder in C: named shadow_volume_1 and there I could explore all the files. So I found which shadowcopy which was closest to before the files were encrypted and then copied them to a external drive.

    I also found out that there are some tools for this ex. libvshadow, VSC toolset, etc.

    Info can be found here:

    Mount shadow volumes on disk images - ForensicsWiki

    Windows Shadow Volumes - ForensicsWiki
     
    PatrikL, Jun 13, 2017
    #5
  6. dalchina New Member
    Sounds like you'll have a very happy customer! Well done. (Encourage them to start using disk imaging)
     
    dalchina, Apr 5, 2018
    #6
Thema:

Possible to open "Restore Point" files from "system volume information

Loading...
  1. Possible to open "Restore Point" files from "system volume information - Similar Threads - Possible open Restore

  2. Enabling copying restore points from System Volume Information

    in Windows 10 Backup and Restore
    Enabling copying restore points from System Volume Information: Hi, After some manipulations, I gained entry to the "hidden" folder <System Volume Information> and granted access to all functions to both User and Administrator (both me). No major problem there. Purpose is to backup some restore points to a separate disk, so that I can...
  3. System Volume Information

    in Windows 10 Network and Sharing
    System Volume Information: [ATTACH] The drive is empty, no trash, excluded from trash, no indexing, no restore point. Nevertheless, SVI is consuming 310 MB. Why? https://answers.microsoft.com/en-us/windows/forum/all/system-volume-information/e1862c4e-e3a1-4f91-ac4d-3ba3c506c262"
  4. System Volume Information

    in Windows 10 BSOD Crashes and Debugging
    System Volume Information: Is it possible to consolidate the System Volume Information on my HDD, it is currently spread in quite a few places on my hard drive and wish to consolidate it all into one place on my HDD, Is this possible?...
  5. System volume information

    in AntiVirus, Firewalls and System Security
    System volume information: A friend of mine put my pendrive into his pc, after inserting it into pc later I found a fold named system volume information, curiously I clicked on the file in the folder and there was a pop up like command prompt,then nothing happened. After a while all my desktop apps...
  6. "System Restore failed to extract the file (...\OneDrive) from the restore point."

    in Windows 10 BSOD Crashes and Debugging
    "System Restore failed to extract the file (...\OneDrive) from the restore point.": Since updating to Windows 1803, system protection does not work. Restore will not restore from the restore point created during the update. Nor will it restore from any new restore point I create. I get the message: System Restore did not complete successfully. Your...
  7. Is it possible to backup Restore points?

    in Windows 10 Backup and Restore
    Is it possible to backup Restore points?: Hi. Is it possible to backup Restore points? as i have a program that deletes them, so i would like to backup them before installation, and restore them afterwards. Thanks in advance. 57974
  8. System restore points

    in Windows 10 Backup and Restore
    System restore points: Suddenly all my system restore points disappeared. No restore points are being created by windows up dates Manual restore points are working ok since this occurence. 56422
  9. System restore points

    in Windows 10 Backup and Restore
    System restore points: Restore points being deleted. Older restore points are being auto-deleted. And I'd like to keep them. I saved some restore points in October, but now they're gone, and the only ones left, are the ones I created in November. I've allowed 90 Gb of memory space for...
  10. No files are in C:\System Volume Information\SytemRestore

    in Windows 10 Performance & Maintenance
    No files are in C:\System Volume Information\SytemRestore: I cannot find any restore point files in C:\System Volume Information\SystemRestore Where are the files? 48622