Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I had some rogue or poorly-written software execute the equivalent of CTRL+A -> SHIFT+DEL on my C: drive right after a reboot required by a driver install. Every file that hadn't been running and hadn't been system-protected was deleted. The registry seems to be mostly OK because all keys dealing with autoruns & installed software are in place.

Despite having experienced a few other omfg-my-hard-drive-is-empty moments, I still don't use Windows Backup. Though, luckily, the reboot was caused by a driver install (that's the main suspect, by the way), so I have a restore point and a full shadow copy image of the disk a few hours older than the incident.

I've tried to simply copy the data from the shadow copy to the live drive. That went mostly smoothly (save for locked system files). This way I've restored all non-software data. The problem is that I'm still missing most systems settings as well as at least MS Office (in fact, more than half of Start Menu content isn't showing up despite being physically present in \Program Data\Microsoft\Windows\Start Menu\).

I'm thinking of extracting the shadow copy onto an external drive, then copying everything but the obvious system files (whatever's needed for restore) onto C: using a VSS-based copy utility, and then running System Restore to make sure that Windows recognizes the overwritten settings.

Will this work? Or is there a software that can "reimage" a drive using the shadow copy data?

In terms of available tools, I have Windows 8 Consumer Preview installed on this machine. I thought of using it to do "external" restore but then my research turned up the "nice" fact that "Restore previous versions" had been removed from the new OS.

I also have a stock UBCD4Win labeled as v3.5 (WinXP SP3-based), a custom distro of Windows 7 SP1 loaded onto a bootable flash drive, and the full suite of SysInternals utilities (which I've already used to look for suspicious processes in the currently active & autoruns).

share|improve this question
    
Have you tried using Windows System Restore built into W7? It can be run from inside windows or from the Windows Recovery Environment by booting from a W7 install DVD, or using F8 and select "repair your computer" if the hidden system partition is intact it will load WinRE. –  Moab May 22 '12 at 21:27
1  
I think you need to lean towards using deleted file recovery software. –  Moab May 22 '12 at 21:36
    
@Moab: I haven't tried System Restore yet. I want to make sure I've recovered as much data as possible before doing something that can affect the shadow copy. File recovery software won't help at this point because I've overwritten the surface with my manual restore attempt. How certain are you about the restore system built-into the install? –  dnbrv May 22 '12 at 21:45
    
All I have ever used it for is to roll back after a bad driver or software install, and works well for that. Not sure what exactly it backs up when it it sets a restore point....windows.microsoft.com/en-US/windows7/What-is-System-Restore –  Moab May 23 '12 at 2:43
    
@Moab: In the future, please don't advice rebooting computers with file damage. Somehow, my 3 recent restore points disappeared and System Restore offers only some strange checkpoints from November 2010. And I can't get even to Safe Mode to run in-place upgrade. –  dnbrv May 24 '12 at 19:57
show 1 more comment

Know someone who can answer? Share a link to this question via email, Google+, Twitter, or Facebook.

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.