{"id":80597,"date":"2026-03-30T12:00:13","date_gmt":"2026-03-30T06:30:13","guid":{"rendered":"https:\/\/www.winhelponline.com\/blog\/?p=80597"},"modified":"2026-04-09T11:23:22","modified_gmt":"2026-04-09T05:53:22","slug":"recover-registry-files-shadow-copy","status":"publish","type":"post","link":"https:\/\/www.winhelponline.com\/blog\/recover-registry-files-shadow-copy\/","title":{"rendered":"Recover Registry Hives from a System Restore Point or Shadow Copy"},"content":{"rendered":"

This article explains how to restore registry hives or files from shadow copies. This can be helpful if the current registry hives are damaged and cannot be loaded.<\/p>\n

Shadow copy, or Volume Shadow Copy Service (VSS), is a Windows feature that creates snapshots or backup copies of files and volumes, even while they are in use. When you create a System Restore Point, it also creates a shadow copy because System Restore is based on VSS.<\/p>\n

If System Restore Points or shadow copies are available on the computer, you should be able to recover files or registry hives from that shadow copy. To see the list of shadow copies available, open Command Prompt (admin)<\/a> and run the following command:<\/p>\n

vssadmin list shadows | findstr \/i time<\/pre>\n
\"vssadmin<\/p>\n
It might show an output like below:<\/p>\n
   Contained 1 shadow copies at creation time: 3\/24\/2026 9:21:02 PM\r\n   Contained 1 shadow copies at creation time: 3\/29\/2026 8:26:55 AM\r\n   Contained 1 shadow copies at creation time: 3\/29\/2026 8:27:04 AM\r\n<\/pre>\n
If the above command throws an empty output even when run from the admin<\/strong> Command Prompt, it means no shadow copies exist on the computer. In that case, you cannot<\/strong> recover the registry hives from VSS.<\/div>\n
And, if you open System Restore (rstrui.exe<\/strong>), you may see that the System Restore feature created the above shadow copies.<\/p>\n
\"list<\/p>\n
Note:<\/strong> A shadow copy can exist even if no restore points exist on the computer. System Restore is a subset of VSS.<\/p>\n
Restore Registry Hives from Shadow Copy<\/h2>\n
If restore points or shadow copies exist on your computer, follow the instructions below to mount the shadow copy and recover files from it.<\/p>\n
Here’s the list of per-system (machine-wide) registry hives:<\/p>\n
C:\\windows\\system32\\config\\COMPONENTS\r\nC:\\windows\\system32\\config\\DRIVERS\r\nC:\\windows\\system32\\config\\SAM\r\nC:\\windows\\system32\\config\\SECURITY\r\nC:\\windows\\system32\\config\\SOFTWARE\r\nC:\\windows\\system32\\config\\SYSTEM\r\n<\/pre>\n
The per-user registry hives are below. They’re present under each user profile.<\/p>\n
C:\\Users\\%username%\\NTUSER.DAT\r\nC:\\Users\\%username%\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat\r\n<\/pre>\n
To recover the registry hives, you may use ShadowExplorer (free).<\/p>\n
Download ShadowExplorer<\/a>\u00a0and run it.<\/p>\n
Select the drive letter from the list. To restore the registry hives, select the OS partition (i.e., usually volume C: )<\/p>\n
\"restore<\/p>\n
Select the shadow copy from which you want to restore the registry hives.<\/p>\n
Extract the System registry hives<\/h3>\n
In that shadow copy, go to the C:\\Windows\\System32\\Config<\/strong> directory.<\/p>\n
Sort the results by “Type”.<\/p>\n
Select the registry hives, namely, COMPONENTS<\/strong>, DRIVERS<\/strong>, SAM<\/strong>, SECURITY<\/strong>, SOFTWARE<\/strong>, and SYSTEM<\/strong>.<\/p>\n
\"restore<\/p>\n
Right-click on the selection and click Export<\/strong>.<\/p>\n
In the resulting dialog, select a folder you want to extract to, and click OK.<\/p>\n
\"restore<\/p>\n
That’s it. The selected registry hives are extracted to the chosen folder:<\/p>\n
\"restore<\/p>\n
Extract the\u00a0User-specific registry hives<\/h3>\n
If required, extract the user-specific registry hives below:<\/p>\n
C:\\Users\\%username%\\NTUSER.DAT\r\n\r\nC:\\Users\\%username%\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat<\/pre>\n
\"restore<\/p>\n
\"restore<\/p>\n
Additional Information<\/h2>\n
There are also other portable freeware tools that can restore files from shadow copies.<\/p>\n
How to Recover Deleted Files Using Previous versions (Shadow Copy) in Windows<\/a><\/p>\n
[PreviousFilesRecovery] Search and Recover Files from Shadow Copy Easily<\/a><\/p>\n
ShadowCopyView Recovers Files From Volume Shadow Copy Snapshots<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"
This article explains how to restore registry hives or files from shadow copies. This can be helpful if the current registry hives are damaged and cannot be loaded. Shadow copy, or Volume Shadow Copy Service (VSS), is a Windows feature that creates snapshots or backup copies of files and volumes, even while they are in … Read more<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[6,8,869],"tags":[441],"class_list":["post-80597","post","type-post","status-publish","format-standard","hentry","category-utilities","category-windows-10","category-windows-11","tag-registry"],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"jetpack-related-posts":[{"id":5506,"url":"https:\/\/www.winhelponline.com\/blog\/recover-registry-keys-restore-point-shadow-copy-windows\/","url_meta":{"origin":80597,"position":0},"title":"Recover Registry Keys from a System Restore Point in Windows","author":"Ramesh","date":"October 14, 2017","format":false,"excerpt":"System Restore snapshots or volume shadow copies contain registry hives as well as critical system files. Sometimes you may need to extract individual registry keys from an earlier restore point but don't want to do a complete System Restore rollback. Previously we saw how to open the registry hives from\u2026","rel":"","context":"In "Utilities"","block_context":{"text":"Utilities","link":"https:\/\/www.winhelponline.com\/blog\/category\/utilities\/"},"img":{"alt_text":"registrychangesview options","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2017\/10\/recover-registry-restore-point-1.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2017\/10\/recover-registry-restore-point-1.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2017\/10\/recover-registry-restore-point-1.png?resize=525%2C300&ssl=1 1.5x"},"classes":[]},{"id":9898,"url":"https:\/\/www.winhelponline.com\/blog\/automatically-backup-registry-hives-windows-10\/","url_meta":{"origin":80597,"position":1},"title":"How to Automatically Backup the Entire Registry in Windows","author":"Ramesh","date":"June 22, 2019","format":false,"excerpt":"Every System Restore point or shadow copy maintains a complete backup of the registry hives. However, Windows 10\/11 doesn't automatically create System Restore points every day. Restore Points are created only when installing important updates or drivers. Notwithstanding the System Restore's excellent capabilities, relying upon System Restore as a file\u2026","rel":"","context":"In "Utilities"","block_context":{"text":"Utilities","link":"https:\/\/www.winhelponline.com\/blog\/category\/utilities\/"},"img":{"alt_text":"backup registry daily or weekly - regidlebackup task","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2019\/06\/registry-backup-task-regidlebackup.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2019\/06\/registry-backup-task-regidlebackup.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2019\/06\/registry-backup-task-regidlebackup.png?resize=525%2C300&ssl=1 1.5x"},"classes":[]},{"id":274,"url":"https:\/\/www.winhelponline.com\/blog\/recover-files-previous-versions-shadow-copy-windows-7-vista\/","url_meta":{"origin":80597,"position":2},"title":"How to Recover Deleted Files Using Previous versions (Shadow Copy) in Windows","author":"Ramesh","date":"May 9, 2008","format":false,"excerpt":"If you accidentally delete a file or folder, you can restore a shadow copy of that file or folder using the Previous Versions feature in Windows Vista and higher. Shadow Copy, a useful innovation included first in Windows Vista, automatically creates point-in-time copies of files as you work, so you\u2026","rel":"","context":"In "Windows"","block_context":{"text":"Windows","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/prevversions1.gif?resize=350%2C200&ssl=1","width":350,"height":200},"classes":[]},{"id":31266,"url":"https:\/\/www.winhelponline.com\/blog\/0x81000203-vss-system-restore-error\/","url_meta":{"origin":80597,"position":3},"title":"[Fix] System Restore Encountered an Error 0x81000203","author":"Ramesh","date":"December 25, 2022","format":false,"excerpt":"When you open the System Properties dialog (sysdm.cpl) and click System Protection, the error 0x81000203 occurs. Here's the full error message verbatim: There was an unexpected error in the property page: System Restore encountered an error. Please try to run System Restore again. (0x81000203) Please close the property page and\u2026","rel":"","context":"In "Windows 10"","block_context":{"text":"Windows 10","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/windows-10\/"},"img":{"alt_text":"8004230f windows upgrade - vss error","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2022\/12\/home-to-pro-upgrade-activation-error-1.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2022\/12\/home-to-pro-upgrade-activation-error-1.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2022\/12\/home-to-pro-upgrade-activation-error-1.png?resize=525%2C300&ssl=1 1.5x"},"classes":[]},{"id":26688,"url":"https:\/\/www.winhelponline.com\/blog\/restore-path-environment-variable-deleted\/","url_meta":{"origin":80597,"position":4},"title":"How to Recover PATH Variable After Deleting it Accidentally","author":"Ramesh","date":"May 18, 2022","format":false,"excerpt":"The PATH is a variable that Windows uses to locate needed executables, especially from the command line. Unfortunately, there are situations where users accidentally delete the PATH variable. This can happen when users inadvertently overwrite the PATH data rather than appending them. There are also cases where some buggy applications\u2026","rel":"","context":"In "Windows"","block_context":{"text":"Windows","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/"},"img":{"alt_text":"recover path environment variable - shadow copy hive","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2022\/05\/recover-path-variable-shadowcopy.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2022\/05\/recover-path-variable-shadowcopy.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2022\/05\/recover-path-variable-shadowcopy.png?resize=525%2C300&ssl=1 1.5x"},"classes":[]},{"id":785,"url":"https:\/\/www.winhelponline.com\/blog\/restore-registry-hives-system-restore-snapshot-xp\/","url_meta":{"origin":80597,"position":5},"title":"How to Restore the Registry Hives from a System Restore Snapshot in Windows XP","author":"Ramesh","date":"November 27, 2008","format":false,"excerpt":"This article describes how to restore the registry hives from a recent System Restore snapshot in Windows XP, in the event of registry corruption that prevents your Windows XP computer from starting. If the registry hives become corrupted, the following errors are displayed when starting up. Windows XP could not\u2026","rel":"","context":"In "Windows XP"","block_context":{"text":"Windows XP","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/windows-xp\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/archived\/xp-icon.gif?resize=350%2C200&ssl=1","width":350,"height":200},"classes":[]}],"_links":{"self":[{"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/posts\/80597","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/comments?post=80597"}],"version-history":[{"count":0,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/posts\/80597\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/media?parent=80597"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/categories?post=80597"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/tags?post=80597"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}