Main Forum > General Computer Support

Deleted system restore points

(1/2) > >>

smccaffr39:
this is a long shot, but thought i'd ask.  i have a customer who was hit with cryptodefense.  it deleted system restore points, but i was able to run a recovery to get 14.5GB of files from the "c:\system volume information" folder that were older than the infection.  if i place those files back in that folder, can this program re-associate those restore points so that i can try to use "restore previous versions" to replace the encrypted files?

Shane:
My program doesnt do anything like that with the system restore. best thing to do is make a copy of that fiel you have just in case then in safe mode, put the restore point back in that folder and reboot and see if system restore sees it.

MS is very very quite on how system restore works and what it needs, so there is no way to tell how or what it needs to see the restore point, so best to simply give it a try :-)

If it fails then the best thing to do would be to extract the files out of the restore point and restore them manually. :wink:

Shane

smccaffr39:
thank you very much for your input.  i have tried to access the data manually, but the files are not set up the way that i've read they're supposed to be.  the sizeable files have names like "{87105b49-abab-11e3-866e-88532e5cda77}{3808876b-c176-4e48-b7ae-04046e6cc752}" without the "_restore" prefix.  if you have some idea how to get at them without the use of the built-in system restore utility, i'd love to hear it!  i'm trying to get 10 years of this guy's life back.

Shane:
See if this helps :-)

http://www.sevenforums.com/tutorials/193282-system-restore-points-manually-extract-files-folders.html

Shane

smccaffr39:
thanks again, but all these tools rely on what windows tells it is available.  i would need something that can look at a system restore file, outside of the affected system itself.

Navigation

[0] Message Index

[#] Next page