Q: How can I retrieve personal files erased by Windows XP through its System Restore "feature"? (Even though Windows wasn't supposed to touch them--bad Windows!) Where are those files stored, and how can I access them? --HYC 05:09, 20 August 2006 (UTC)
A: System Restore files are stored in the "System Volume Information" directory, which is not normally accessible by users. However, the System Restore directories (and their sub-directories) are not protected, and therefore any local user can access their files as long as the path is known. To obtain the path of the System Restore directory, the following command line can be used:[1] c:\> reg query "HKLM\System\CurrentControlSet\Control\BackupRestore\FilesNotToBackup" /v "System Restore"
The path, then, can be entered in Windows Explorer's address line in this format: C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}
B: An alternate way to access them is, after disabling hidden and system file protections: (a) login in safe mode as an administrator and (b) go to System Volume Information folder's Properties > Security tab to add the user's name. The System Volume Information folder now can be opened.[2][3]
C: Using the CACLS command-line tool to display or modify file or folder access control lists (ACLs):[4]
to gain access: c:\> cacls "driveletter:\System Volume Information" /E /G username:F -- this will add the specified user to the folder with Full Control permissions;
to remove the permissions: c:\> cacls "driveletter:\System Volume Information" /E /R username
Google search keywords: where are "system restore files" stored --HYC (talk) 01:31, 18 December 2008 (UTC).
D: To exclude all files and directories you don't want Windows to track, list them in this registry key:[5] HKLM\System\CurrentControlSet\Control\BackupRestore\FilesNotToBackup --HYC (talk) 07:15, 18 December 2008 (UTC)
