{"id":5506,"date":"2017-10-14T17:42:39","date_gmt":"2017-10-14T17:42:39","guid":{"rendered":"http:\/\/198.58.113.91\/blog\/?p=5506"},"modified":"2019-06-14T05:33:48","modified_gmt":"2019-06-14T05:33:48","slug":"recover-registry-keys-restore-point-shadow-copy-windows","status":"publish","type":"post","link":"https:\/\/www.winhelponline.com\/blog\/recover-registry-keys-restore-point-shadow-copy-windows\/","title":{"rendered":"Recover Registry Keys from a System Restore Point in Windows"},"content":{"rendered":"

System Restore snapshots or volume shadow copies contain registry hives as well as critical system files. Sometimes you may need to extract individual registry keys from an earlier restore point but don’t want to do a complete System Restore rollback.<\/p>\n

Previously we saw how to open the registry hives from shadow copies using “Previous Versions” tab and load the registry hives<\/a> to extract the required keys. There is now a more comfortable option to extract specific registry keys from a restore point.<\/p>\n

Check out one of the latest utilities from Nirsoft.net, named RegistryChangesView<\/a>. While the primary purpose of this program is to compare snapshots of Windows Registry, it can also be used to extract registry data from an existing shadow copy or restore point. It can be used to recover registry keys which may have accidentally deleted.<\/p>\n

Scenario:<\/strong>\u00a0Let’s say you’ve accidentally deleted the Print Spooler service, and want to recover the following Print Spooler service registry key from a restore point.<\/p>\n

HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\Spooler<\/pre>\n
Extract Registry Keys from a System Restore Point<\/h2>\n
    \n
  1. Start RegistryChangesView and configure it as shown below.
    \n\"registrychangesview<\/li>\n
  2. Set “Registry Data Source 1” to Current Registry<\/strong><\/li>\n
  3. Set “Registry Data Source 2” to Shadow Copy<\/strong><\/li>\n
  4. Select one of the shadow copy paths from the list shown.\n
    The highest numbered item in the Shadow Copy Path list represents the most recent shadow copy or restore point. You can find the list of shadow copies using vssadmin list shadows<\/code> command-line from an admin Command Prompt window<\/a>. For more information, check out the article How to Delete Individual System Restore Points in Windows.<\/a><\/li>\n
  5. Select the appropriate registry hives to include for comparison. For this article, we’ll be selecting the following checkbox only, as that’s the location which stores the Services registry keys:\n
    HKEY_LOCAL_MACHINE\\SYSTEM<\/pre>\n<\/li>\n
  6. Click OK. RegistryChangesView will enumerate and compare the selected keys in the source and destination registry hives and show the results.<\/li>\n
  7. From the View menu, enable the option named Use Quick Filter<\/strong>. [Ctrl<\/kbd> + Q<\/kbd>]\"registrychangesview<\/li>\n
  8. In the Quick Filter text box, type in \\spooler<\/code> or services\\spooler<\/code> to filter entries where the keys start with the word “spooler”. The idea is to limit the results to the following key and subkeys only.\n
    HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\Spooler<\/pre>\n
    \"registrychangesview<\/li>\n
  9. Select all the entries (that contain the above branch), and press Ctrl<\/kbd> + E<\/kbd> to export the results to a REG file. Or, click File > Export Selected Items to .Reg file<\/strong><\/li>\n
  10. Save the REG file to Desktop, and open it with Notepad.
    \n\"registrychangesview<\/li>\n
  11. Replace every occurrence of the string ControlSet001<\/code> with CurrentControlSet<\/code>, and save the file.
    \n\"registrychangesview<\/li>\n
  12. Double-click the REG file to add its contents (“Spooler” key) to the registry.<\/li>\n<\/ol>\n
    You have now restored the missing Print Spooler service registry key!<\/h4>\n
    Small glitch<\/h3>\n
    One small problem I noticed is that the current version of RegistryChangesView, when exporting the entries to the REG file, writes expandable string values as REG_SZ<\/code> value type. For example, the ImagePath<\/code> registry value contains an environment variable, and the value type should be REG_EXPAND_SZ<\/code> instead of REG_SZ<\/code>.<\/p>\n
    \"registrychangesview<\/p>\n
    You’ll need to edit the registry to fix such flaws manually. Note down the value name and value data in Notepad, delete the value name from the registry and create a value with the same name and value data, but of type REG_EXPAND_SZ<\/code>.<\/p>\n
    \"registrychangesview<\/p>\n
    \n
    That’s about it! As always, there are other ways to restore the registry data. You can also mount the shadow copy volume using ShadowCopyView or ShadowExplorer utilities, and load\/extract the registry hives. Check out article ShadowCopyView Recovers Files From Volume Shadow Copy Snapshots<\/a> and Restore Previous Versions of Registry Hives From System Restore Snapshots in Windows<\/a> for more details.<\/p>\n<\/div>\n
    The RegistryChangesView method discussed in this post should work on any version of Windows, up to Windows 10. Both 32-bit and 64-bit systems are supported.<\/p>\n","protected":false},"excerpt":{"rendered":"
    System Restore snapshots or volume shadow copies contain registry hives as well as critical system files. Sometimes you may need to extract individual registry keys from an earlier restore point but don’t want to do a complete System Restore rollback.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[6,7],"tags":[441,562],"class_list":["post-5506","post","type-post","status-publish","format-standard","hentry","category-utilities","category-windows","tag-registry","tag-system-restore"],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"jetpack-related-posts":[{"id":80597,"url":"https:\/\/www.winhelponline.com\/blog\/recover-registry-files-shadow-copy\/","url_meta":{"origin":5506,"position":0},"title":"Recover Registry Hives from a System Restore Point or Shadow Copy","author":"Ramesh","date":"March 30, 2026","format":false,"excerpt":"This article explains how to restore registry hives or files from shadow copies. This can be helpful if the current registry hives are damaged and cannot be loaded. Shadow copy, or Volume Shadow Copy Service (VSS), is a Windows feature that creates snapshots or backup copies of files and volumes,\u2026","rel":"","context":"In "Utilities"","block_context":{"text":"Utilities","link":"https:\/\/www.winhelponline.com\/blog\/category\/utilities\/"},"img":{"alt_text":"list system restore points","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2026\/03\/list-system-restore-points.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2026\/03\/list-system-restore-points.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2026\/03\/list-system-restore-points.png?resize=525%2C300&ssl=1 1.5x"},"classes":[]},{"id":9898,"url":"https:\/\/www.winhelponline.com\/blog\/automatically-backup-registry-hives-windows-10\/","url_meta":{"origin":5506,"position":1},"title":"How to Automatically Backup the Entire Registry in Windows","author":"Ramesh","date":"June 22, 2019","format":false,"excerpt":"Every System Restore point or shadow copy maintains a complete backup of the registry hives. However, Windows 10\/11 doesn't automatically create System Restore points every day. Restore Points are created only when installing important updates or drivers. Notwithstanding the System Restore's excellent capabilities, relying upon System Restore as a file\u2026","rel":"","context":"In "Utilities"","block_context":{"text":"Utilities","link":"https:\/\/www.winhelponline.com\/blog\/category\/utilities\/"},"img":{"alt_text":"backup registry daily or weekly - regidlebackup task","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2019\/06\/registry-backup-task-regidlebackup.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2019\/06\/registry-backup-task-regidlebackup.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2019\/06\/registry-backup-task-regidlebackup.png?resize=525%2C300&ssl=1 1.5x"},"classes":[]},{"id":785,"url":"https:\/\/www.winhelponline.com\/blog\/restore-registry-hives-system-restore-snapshot-xp\/","url_meta":{"origin":5506,"position":2},"title":"How to Restore the Registry Hives from a System Restore Snapshot in Windows XP","author":"Ramesh","date":"November 27, 2008","format":false,"excerpt":"This article describes how to restore the registry hives from a recent System Restore snapshot in Windows XP, in the event of registry corruption that prevents your Windows XP computer from starting. If the registry hives become corrupted, the following errors are displayed when starting up. Windows XP could not\u2026","rel":"","context":"In "Windows XP"","block_context":{"text":"Windows XP","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/windows-xp\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/archived\/xp-icon.gif?resize=350%2C200&ssl=1","width":350,"height":200},"classes":[]},{"id":26688,"url":"https:\/\/www.winhelponline.com\/blog\/restore-path-environment-variable-deleted\/","url_meta":{"origin":5506,"position":3},"title":"How to Recover PATH Variable After Deleting it Accidentally","author":"Ramesh","date":"May 18, 2022","format":false,"excerpt":"The PATH is a variable that Windows uses to locate needed executables, especially from the command line. Unfortunately, there are situations where users accidentally delete the PATH variable. This can happen when users inadvertently overwrite the PATH data rather than appending them. There are also cases where some buggy applications\u2026","rel":"","context":"In "Windows"","block_context":{"text":"Windows","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/"},"img":{"alt_text":"recover path environment variable - shadow copy hive","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2022\/05\/recover-path-variable-shadowcopy.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2022\/05\/recover-path-variable-shadowcopy.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2022\/05\/recover-path-variable-shadowcopy.png?resize=525%2C300&ssl=1 1.5x"},"classes":[]},{"id":1088,"url":"https:\/\/www.winhelponline.com\/blog\/regfileexport-export-registry-key-hive-offline\/","url_meta":{"origin":5506,"position":4},"title":"RegFileExport Helps you Export Data from Offline Registry Hives","author":"Ramesh","date":"September 20, 2010","format":false,"excerpt":"RegFileExport is a useful console application from NirSoft, which helps you extract data from offline Registry hives that are not currently in use by the Operating System. RegFileExport reads the registry hive and then exports the specified branch or the entire branch to a .reg file. Regedit.exe can do this\u2026","rel":"","context":"In "Utilities"","block_context":{"text":"Utilities","link":"https:\/\/www.winhelponline.com\/blog\/category\/utilities\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":1825,"url":"https:\/\/www.winhelponline.com\/blog\/error-rename-move-folder-not-exist\/","url_meta":{"origin":5506,"position":5},"title":"Fix: Cannot Rename or Move Folders – The File or folder does not exist","author":"Ramesh","date":"March 4, 2016","format":false,"excerpt":"When you try to move or rename a folder in Windows 10 or 11, the errors Can't find the specified file, and The file or folder does not exist occur. Also, duplicate icons with no text appear for special folders, namely Documents, Downloads, Music, Pictures, and Videos, under This PC\u2026","rel":"","context":"In "Windows 10"","block_context":{"text":"Windows 10","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/windows-10\/"},"img":{"alt_text":"cannot rename folders - windows 11 - folderdescriptions","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2016\/03\/cant-rename-folder-windows-11.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2016\/03\/cant-rename-folder-windows-11.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2016\/03\/cant-rename-folder-windows-11.png?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2016\/03\/cant-rename-folder-windows-11.png?resize=700%2C400&ssl=1 2x"},"classes":[]}],"_links":{"self":[{"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/posts\/5506","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/comments?post=5506"}],"version-history":[{"count":0,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/posts\/5506\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/media?parent=5506"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/categories?post=5506"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/tags?post=5506"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}