restore points

I have rebuilt entire systems by copying everything out of a shadow copy. It can be done from within winpe. I made my own little thing to do it.



Now Nir Sofer's shadowcopyview is generally better than my attempt. It also runs in winpe.
You don't have to rely on windows system restore program to access shadow copies. Shadow copies aren't the answer to everything, but they can be surprisingly useful.

One of my computers had a crash and none of the Windows advanced troubleshooting options are available using the computer or the iso. Zbook

I made the Windows 10 installation stick from the MCT> ISO> Rufus.
This is another device you are referring to which allows advanced users like you to do many things as above, correct?

SIW2 ,

On the web I had had seen a computer that had a recovery from malware using a shadow copy.
That was the first time that I had seen that reported but did not follow the method.
If possible please explain how it's done or if you have a link/references please post them.

When event logs are viewed on computer's to troubleshoot other problems they may display:

Code:

Event ID:  25  The shadow copies of volume C: were deleted because the shadow copy storage could not grow in time.  Consider reducing the IO load on the system or choose a shadow copy storage volume that is not being shadow copied.

Code:

Event ID: 24  There was insufficient disk space on volume C: to grow the shadow copy storage for shadow copies of C:.  As a result of this failure all shadow copies of volume C: are at risk of being deleted.

Code:

Event ID: 35  The shadow copies of volume C: were aborted because the shadow copy storage failed to grow.

What troubleshooting steps can be done for these?

If possible please explain how it's done or if you have a link/references please post them.

Same basic steps as restoring from an image.

1. Copy the contents to a new drive/partition

2. Reset the os letter against the volume value

3. Create boot menu entry

Access the shadow with Nir Sofer's shadowcopyview program. Copy from there. You can create the Documents and settings link with mklink. Windows directory is very large. Seems to work better copying it bit by bit.

The minmum to copy:
Program Files
Program Files (x86)
ProgramData
Users
Windows

How do you find the appropriate shadow copy?
Once the shadow copy is found what is the next step with this file?
What pitfalls are there in the restoring of the shadow copy?

Fire up shadowcopyview and it lists them, with the dates. Click the shadow you want to highlight it in blue.
Then in the lower pane, rt click what you want to copy to get the menu. Select "Copy selected files to...." Then it asks where you want to copy to.

1.You can see the shadow I selected was created on 30-7-2018.



2. I rt clicked Program Files (x86), selected Copy Selected Files To......



3. Then browse to destination ( in my case D:\ ) , or type it in. Then click Do it!

If the software is not installed and there are problems with Windows are there options without the software?

One computer had a crash and fortunately I had a backup users and a macrium image.
Soon I will clean install. This is the first time using Macrium to restore an image.

Knowing how to use shadow copies may come in handy.
Not every computer will have this software after a crash or a malware problem.
So if it is possible to use the shadow copy as a repair tool without the software it may be a great tool to have available.


Just installed the software and it displayed:

ShadowCopyView doesn't need installing. It runs as an executable. It can be run from within winpe, as I posted earlier.

You don't need to include it in your winpe. You can reach down and run it from wherever it is, e.g. on a flash drive.

If you don't already have a copy handy, then you can d/l it onto a flash drive using another PC.

Or, if you have a decent winpe, you could use your winpe browser to get it from nir sofer's site. Or there is other software that can be used. I posted a screenshot of something I made myself, for example.

I have done it a few times. Worked perfectly every time.

Exactly like this:
1. Copy the contents to a new drive/partition

2. Reset the os letter against the volume value

3. Create boot menu entry

Number 2 is a complete mystery to most people. I have made something to do it.

Because I have copied the contents of the Shadow to D, I select D in the dropdown, then click FIX


It is much too difficult to explain to other people what that does. That is why I made it, so other people can use it.

When you use the windows advanced troubleshooting menu on the computer versus a Windows 10 iso are you using winpe or winre? When is one preferred over the other?

If not using third party software did you have to download winpe to be able to use the shadow copy?
Download WinPE (Windows PE) | Microsoft Docs
Create a WinPE USB or ISO | Windows 10 Tutorials