In a previous article, we created an image backup using Windows 10’s built-in image backup tool, which it refers to as the “Windows 7 Backup.” We’ve also looked at how to restore that image, in its entirety, to your hard disk.
But what if you don’t want to restore the entire image? What if all you want is just a single file or set of files contained within the image? That’s why image backups are awesome, after all. They contain everything.
The good news is you don’t need to restore everything if you don’t want to.
Let’s restore a single file contained within a Windows 10 image backup.
Backing Up In Windows 10
This article is excerpted from Backing Up In Windows 10, available now. Top-to-bottom, end-to-end, Backing Up In Windows 10 will walk you through all the steps you need to keep your data safe, using Windows 10's built-in tools, as well as a free alternative.
Where’s the backup?
The first thing we need to do is to locate the backup. Windows “conveniently” hides all the actual files involved on the backup drive you selected, in a single folder called “WindowsImageBackup”.
If you examine the contents of that folder (you’ll likely be asked to confirm that you want to, and give yourself permission), you’ll find a folder with the same name as your machine name.1
Viewing the contents of that folder (once again, after confirming your intent) you’ll find a series of folders named “Backup”, followed by a date and time — one for each image backup stored on the drive. View the contents of the folder corresponding to the date and time of the backup image you want to examine.
Here is where you’ll finally find the files you’re looking for, though with names that might make no sense to you.
The files we care about — the files that actually contain the image backup — are those with the filename extension “.vhdx”. In the “type” column you’ll see them described as “Hard Disk Image File”.
Choosing the right file
If your backup contains multiple partitions — and most backups do these days — you’ll have more than one “.vhdx” file, with names that don’t relate to anything you might recognize. Each corresponds to one backed-up partition. In the example above, for example, one is the “System Reserved Partition”, and the other is my “C:” drive.
Which is which? We’ll use the size of the image to guide us. Looking at the sizes of the two files, you’ll see that one is significantly larger than the other.
That tells us that the first one is the larger of the partitions on my hard disk, and would contain the backup image of the “C:” drive. Note that this size will not match the actual size of the partition — it contains only data, and may also be compressed — but the relative size of the files should correspond to the relative size of your partitions. Reserved or recovery partitions are almost always significantly smaller than the data partitions of a hard disk.
This technique is quick and easy, but it doesn’t always work. If you have multiple partitions containing roughly the same amount of data, their backup images may be roughly the same size. In these cases, it’s easiest to simply pick one and examine its contents, as we’re about to do. If it’s the wrong one, repeat the process with the other.2
Mounting the hard disk image
Right-click on the image file containing the image you want to examine, and click on Mount.
This instructs Windows to take that image file and treat it as if it were an actual hard disk.
You may get a warning.
In our case, the warning simply indicates that the drive we’re interested in has not yet been assigned a drive letter — normally a part of the mounting process. The instructions it provides to proceed are correct: we’ll need to run the Disk Management tool.
Assigning a drive letter
In Windows 10, right-click on the Start menu and click on Disk Management (or, in any version of Windows, simply run “diskmgmt.msc”).
You may need to scroll down within the resulting display, but you should find a large disk partition that has no drive letter.
The “Capacity” listed should match the capacity of the partition you backed up, and the free space should roughly match the free space on the drive at the time it was backed up.
Right-click on the disk in the lower pane, and click on Change Drive Letter and Paths… in the resulting pop-up menu (not shown). The next dialog will present a list of currently-assigned drive letters and paths showing empty ones, as none have been assigned yet.
Click the Add… button.
The next dialog will give you a choice to add a drive letter or a path. Make sure “Assign the following drive letter” is selected. Next to that is a drop-down list of drive letters not currently being used by your system. You can select a different letter if you like, or simply accept the default — “F:” in the example below.
Click OK.
Your backup image is now mounted as drive F: on your system.
Examining the image
The reason for going through this lengthy process of locating, mounting, and assigning a drive letter should hopefully now be clear: all you need to do is use whatever tool you like to examine the contents of your backup image. For example, I’ve opened up drive “F:” in Windows File Explorer, below.
The contents of my “F:” drive look almost exactly like my “C:” drive, which makes sense, since what we mounted was a backup image of the C: drive. (If the contents don’t look like the contents of the drive you expect, make sure you selected the correct “.vhdx” file earlier.)
Restoring individual files or folders is simple: just locate them within the mounted image partition — drive F: in my example above — and use whatever technique you’re comfortable with to copy them back to your C: drive. That’s all there is to it.
Since people often ask: you shouldn’t be able to modify the contents of a mounted image. Even if you could, you shouldn’t, as it would no longer be an image of the drive when the backup was taken; it would be an image “plus random changes”, which in the long term can get confusing.
When you’re done
When you’re done restoring images from the backup, you need to unmount the drive.
Return to Disk Management, right-click on the disk, and click on Detach VHD.
You may be asked to confirm (not shown), after which the mounted drive will disappear.
Do this
Subscribe to Confident Computing! Less frustration and more confidence, solutions, answers, and tips in your inbox every week.
I'll see you there!
Podcast audio
More for Patrons of Ask Leo!
Silver-level patrons have access to this related video from The Ask Leo! Video Library.
Extracting Individual Files from a Windows 10 Image Backup
Everything went as you said until the last step to “Detach VHD”
When I right-clicked the new drive I had just created, the menu did not include “Detach VHD.”
The menu looked the same as the pop-up menu that came up in the step to add the new drive.
The only command on that pop-up menu that seemed to hold any promise was the same “Change Drive Letter and Paths” entry that I used to add the new drive.
I clicked that entry and there was an option “”Remove” that I tried, with some trepidation, as it was not clear that I was just disengaging the drive or removing its content.
The drive disappeared and I still had the backup file on my backup drive.
I have Windows 8.1.
I know this reply is late, but for anyone else who had this issue as I did – if your right-click menu does NOT contain “Detach VHD” it is because you right-clicked in the wrong place. If you were on the partition itself (the one with the drive letter, such as F:) with the white and grey striped background and the blue line overtop – this is not where you need to be! You should instead right-click on the very left-most item that says “Disk 2”, which is a solid grey square. Then you will see “Detach VHD” in the right-click menu.
I believe you could also go to the drive letter in “My Computer” or “This PC” file explorer, right click on it and select “Eject” – although I haven’t tried this.
Hope this helps someone!
All fine and good but I believe there is a slight wrinkle in ALL IMAGING BACKUP SOLUTIONS, an exemplar of which I encountered the other day.
If you need to examine a backed up file under C:\Users\\ and you mount the backup image on a system OTHER THAN WHERE IT WAS ORIGINALLY CREATED you might be in for a world of hurt. Unless you have a network or roaming User ID the “you” on one system is not the “you 2” on the laptop a room away, and then Windows privacy protections will make it extremely cumbersome and time consuming to assume ownership of the files – even as administrator on all of your systems — you wish to examine and/or retrieve on that foreign system.
After hours of struggling and watching the “ownership” change crawl through 65K files — 99.9999% of which I did not care about — in my “me 2” system I gave up, rearranged some USB ports on the hub and completed what I wanted in 45 minutes on the original system.
I have used Shadow Protect Desktop for almost 10 years but I believe this issue applies to all imaging backup programs because the fundamental barriers are erected by Windows itself and inherently preserved in any mounted virtual backup image.
I thought of several alternatives including file backups independent of the scheduled imaging jobs, a single network or MSA user name and working with common files somewhere outside of C:\Users\. In my case the log files I wanted to examine were buried 4 levels deep under AppData and this is so common as a “dumping ground” as to make the alternate personal folder location solution and the file backup solution hardly worth the effort and most importantly: the testing. To me it seems that the best solution is the single user identity, across as many systems as you have. Then all backups are universally readable and accessible from any system.
I would be interested to hear what the solution is in a large family setting to avoid the excuse “Dad’s backup program locked up my homework” when Dad is say in China for a two week business trip.
A single network login will be my new approach when I complete my 3 laptop migration to Creators Update (aka Version 1703 of Windows 10).
J. Niemuth
To start with your last point, Macrium Reflect, EaseUS Todo and MS built-in backups allow you to work while the backup is in progress.
As far as I know “Remove” is used to hide the partition, but it doesn’t dismount it. Your mounted partition is still there but hidden. I was wondering if one goes to File Explorer and right-click on the mounted drive, which is F:/ in Leo’s example, and click on “Eject” wouldn’t be as good as “Detach VHD” in Disk Management. Probably, Leo can correct me if I am wrong…
BTW, another very good article from Leo. I was always baffled by windows backup/restore system Tool. I can say, without a doubt, that I have learned something very interesting about the Windows Kernel today.
Thanks again Leo.
Any advice for those recovering a file on another system (Windows 10)? It continually says “I don’t have access… click to gain permanent access” which on a 1 TB backup, I can’t even tell if anything is happening. Surprised this wasn’t addressed in the article; everything else was so thorough.
Is it even possible to recover a single file or handful of files from another system without permanently changing ownership of the entire backup?
If you can see within the image, try running as administrator.
If you can’t even open the image itself, and IT is the file with an ownership problem, try this article: https://askleo.com/how-do-i-gain-access-to-files-windows-says-i-dont-have-permission-to-access/
WOW! Thank you, thank you, thank you, Leo!!!
After many hours of frustration this was exactly what this comp-illiterate needed :)
This is a very interesting article but what if DVDs were used to do the image backup? The there are .VHD files are on each disk. I was not able to figure out how to view them with the method described.
Is there a way to mount and assign a drive letter when using multiple disks?
You know, I honestly don’t know. If I had to guess I’d say mount the first one, and begin navigating to where the files you’re looking for reside, and hopefully you’ll be prompted to insert the correct disc(s).
As an alternative, You could restore the entire backup to a different drive (an external HD, even), and then pick the files you want from the result.
Thanks for the prompt reply Leo
I’ve tried just about everything but doing a complete restore fails in the first disk. It reads the disk and proceeds normally but then asks to insert disk one. Obviously there is a problem as disk one was already read.
If I right click on one of the .Vhd files there is no option to mount the drive. If I use the diskmgmt command I can’t see the DVD disk to be able to assign a drive letter.
It’s frustrating to know the data is there but just out of reach
If you copy the VHD file to your hard disk, and then use Disk Management, can you mount it?