How to extract environment variables from system restore point, Windows 7 64-bit

Question

Recently a (badly written) piece of software erased my PATH variable. I've been installing software for years and recovering every single entry would be cumbersome. An even more cumbersome solution would be to restore from previous system restore point. Any ideas on how to get the PATH variable alone from the restore point?

Answer 1

You can mount the old version of the registry.

1. Open Regedit

Restoring User PATH:
2. Select HKEY_USERS
3. File->Load Hive
4. Navigate to your user folder, click the little button to the right of "Open" for "Show Previous Versions"
5. Select appropriate revision
6. Select NTUSER.DAT (must have Show Hidden Files enabled)
7. Give it a name (e.g. "Old")
8. Navigate to "Old"\Environment

Restoring System PATH:
2. Select HKEY_LOCAL_MACHINE
3. File->Load Hive
4. Navigate to your C:\Windows\System32\config\RegBack, click the little button to the right of "Open" for "Show Previous Versions":
5. Select appropriate revision
6. Select SYSTEM.OLD
7. Give it a name (e.g. "Old")
8. Navigate to HKEY_LOCAL_MACHINE\"Old"\ControlSet001\Control\Session Manager\Environment
9. Open the PATH value and copy it to clipboard, then paste into system environment variables screen.

Note that for System, depending on how long ago this was, you can just go back into HKLM\(old control set version)\Control\Session Manager\Environment without loading an old hive, but this is a generally useful way to apply "Restore Previous Versions" to the registry.

'Show Previous Versions' explained, in detail with screenshots.

Special thanks to Microsoft for removing "Restore Previous Versions" from Windows 8.

Answer 2

Thanks indeed to Microsoft for eliminating "Restore Previous Versions". However, if you have system protection enabled on your system drive (usually C:) you can STILL get to the old versions back. Just because they took away the UI doesn't mean they took away the underlying backups.

First off, download Shadow Explorer. Then bow at their feet for writing it. http://www.shadowexplorer.com/

After installing it, you can navigate to the files referenced in the accepted answer by Mark Sowul. Note that you select the date/version you want to browser with the pulldown in shadow explorer:

• To restore earlier env vars for the user account, go to c:\users[your username]\NTUSER.DAT
• To restore earlier env vars for the system, go to C:\Windows\System32\config\RegBack\SYSTEM
• Once you select the date/version you want and the file, right click the file and choose export
• Export to a temporary folder
• Then follow the instructions above for "Load Hive" above, but choose this temporary file you have just exported.

Answer 3

Well, this would be kinda hackish, but you could restore back to get the path and restore forward again to your current state.