Technology in terms you understand. Sign up for my weekly newsletter, "Confident Computing", for more solutions you can use to make your life easier. Click here.

Restore Individual Files from a Windows Image Backup

In a previous article, we created an image backup using Windows 10’s built-in image backup tool, which it refers to as the “Windows 7 Backup.” We’ve also looked at how to restore that image, in its entirety, to your hard disk.

But what if you don’t want to restore the entire image? What if all you want is just a single file or set of files contained within the image? That’s why image backups are awesome, after all. They contain everything.

The good news is you don’t need to restore everything if you don’t want to.

Let’s restore a single file contained within a Windows 10 image backup.

Become a Patron of Ask Leo! and go ad-free!

Where’s the backup?

The first thing we need to do is to locate the backup. Windows “conveniently” hides all the actual files involved on the backup drive you selected, in a single folder called “WindowsImageBackup”.

If you examine the contents of that folder (you’ll likely be asked to confirm that you want to, and give yourself permission), you’ll find a folder with the same name as your machine name.1

Viewing the contents of that folder (once again, after confirming your intent) you’ll find a series of folders named “Backup”, followed by a date and time — one for each image backup stored on the drive. View the contents of the folder corresponding to the date and time of the backup image you want to examine.

Here is where you’ll finally find the files you’re looking for, though with names that might make no sense to you.

The files we care about — the files that actually contain the image backup — are those with the filename extension “.vhdx”. In the “type” column you’ll see them described as “Hard Disk Image File”.

Backup Image Files

Choosing the right file

If your backup contains multiple partitions — and most backups do these days —  you’ll have more than one “.vhdx” file, with names that don’t relate to anything you might recognize. Each corresponds to one backed-up partition. In the example above, for example, one is the “System Reserved Partition”, and the other is my “C:” drive.

Which is which? We’ll use the size of the image to guide us. Looking at the sizes of the two files, you’ll see that one is significantly larger than the other.

Backup Image File Sizes

That tells us that the first one is the larger of the partitions on my hard disk, and would contain the backup image of the “C:” drive. Note that this size will not match the actual size of the partition — it contains only data, and may also be compressed — but the relative size of the files should correspond to the relative size of your partitions. Reserved or recovery partitions are almost always significantly smaller than the data partitions of a hard disk.

This technique is quick and easy, but it doesn’t always work. If you have multiple partitions containing roughly the same amount of data, their backup images may be roughly the same size. In these cases, it’s easiest to simply pick one and examine its contents, as we’re about to do. If it’s the wrong one, repeat the process with the other.2

Mounting the hard disk image

Right-click on the image file containing the image you want to examine, and click on Mount.

Mount menu item

This instructs Windows to take that image file and treat it as if it were an actual hard disk.

You may get a warning.

Couldn't Mount File

In our case, the warning simply indicates that the drive we’re interested in has not yet been assigned a drive letter — normally a part of the mounting process. The instructions it provides to proceed are correct: we’ll need to run the Disk Management tool.

Assigning a drive letter

In Windows 10, right-click on the Start menu and click on Disk Management (or, in any version of Windows, simply run “diskmgmt.msc”).

You may need to scroll down within the resulting display, but you should find a large disk partition that has no drive letter.

Disk Management Tool

The “Capacity” listed should match the capacity of the partition you backed up, and the free space should roughly match the free space on the drive at the time it was backed up.

Right-click on the disk in the lower pane, and click on Change Drive Letter and Paths… in the resulting pop-up menu (not shown). The next dialog will present a list of currently-assigned drive letters and paths showing empty ones, as none have been assigned yet.

Change Drive Letter and Paths

Click the Add… button.

The next dialog will give you a choice to add a drive letter or a path. Make sure “Assign the following drive letter” is selected. Next to that is a drop-down list of drive letters not currently being used by your system. You can select a different letter if you like, or simply accept the default — “F:” in the example below.

Add a Drive Letter

Click OK.

Your backup image is now mounted as drive F: on your system.

Examining the image

The reason for going through this lengthy process of locating, mounting, and assigning a drive letter should hopefully now be clear: all you need to do is use whatever tool you like to examine the contents of your backup image. For example, I’ve opened up drive “F:” in Windows File Explorer, below.

Examining a backup image in Windows File Explorer

The contents of my “F:” drive look almost exactly like my “C:” drive, which makes sense, since what we mounted was a backup image of the C: drive. (If the contents don’t look like the contents of the drive you expect, make sure you selected the correct “.vhdx” file earlier.)

Restoring individual files or folders is simple: just locate them within the mounted image partition — drive F: in my example above — and use whatever technique you’re comfortable with to copy them back to your C: drive. That’s all there is to it.

Since people often ask: you shouldn’t be able to modify the contents of a mounted image. Even if you could, you shouldn’t, as it would no longer be an image of the drive when the backup was taken; it would be an image “plus random changes”, which in the long term can get confusing.

When you’re done

When you’re done restoring images from the backup, you need to unmount the drive.

Return to Disk Management, right-click on the disk, and click on Detach VHD.

Detach VHD

You may be asked to confirm (not shown), after which the mounted drive will disappear.

Podcast audio


Backing Up In Windows 10

This article is included in my book, Backing Up In Windows 10, available now. Top-to-bottom, end-to-end, Backing Up In Windows 10 will walk you through all the steps you need to keep your data safe, using Windows 10’s built in tools, as well as a free alternative.

More for Patrons of Ask Leo!

Silver-level patrons have access to this related video from The Ask Leo! Video Library.

Extracting Individual Files from a Windows 10 Image Backup   Extracting Individual Files from a Windows 10 Image Backup

Footnotes & references

1: If you back up multiple machines to the same drive, this keeps the backups for each machine separate.

2: There are probably other ways to determine which partition is which in cases like this, including understanding something about the filenames, or examining the contents of other files. Honestly, just looking inside is probably the easiest and will take about the same amount of time.

4 comments on “Restore Individual Files from a Windows Image Backup”

  1. Everything went as you said until the last step to “Detach VHD”
    When I right-clicked the new drive I had just created, the menu did not include “Detach VHD.”
    The menu looked the same as the pop-up menu that came up in the step to add the new drive.
    The only command on that pop-up menu that seemed to hold any promise was the same “Change Drive Letter and Paths” entry that I used to add the new drive.
    I clicked that entry and there was an option “”Remove” that I tried, with some trepidation, as it was not clear that I was just disengaging the drive or removing its content.
    The drive disappeared and I still had the backup file on my backup drive.
    I have Windows 8.1.

  2. All fine and good but I believe there is a slight wrinkle in ALL IMAGING BACKUP SOLUTIONS, an exemplar of which I encountered the other day.

    If you need to examine a backed up file under C:\Users\\ and you mount the backup image on a system OTHER THAN WHERE IT WAS ORIGINALLY CREATED you might be in for a world of hurt. Unless you have a network or roaming User ID the “you” on one system is not the “you 2” on the laptop a room away, and then Windows privacy protections will make it extremely cumbersome and time consuming to assume ownership of the files – even as administrator on all of your systems — you wish to examine and/or retrieve on that foreign system.

    After hours of struggling and watching the “ownership” change crawl through 65K files — 99.9999% of which I did not care about — in my “me 2” system I gave up, rearranged some USB ports on the hub and completed what I wanted in 45 minutes on the original system.

    I have used Shadow Protect Desktop for almost 10 years but I believe this issue applies to all imaging backup programs because the fundamental barriers are erected by Windows itself and inherently preserved in any mounted virtual backup image.

    I thought of several alternatives including file backups independent of the scheduled imaging jobs, a single network or MSA user name and working with common files somewhere outside of C:\Users\. In my case the log files I wanted to examine were buried 4 levels deep under AppData and this is so common as a “dumping ground” as to make the alternate personal folder location solution and the file backup solution hardly worth the effort and most importantly: the testing. To me it seems that the best solution is the single user identity, across as many systems as you have. Then all backups are universally readable and accessible from any system.

    I would be interested to hear what the solution is in a large family setting to avoid the excuse “Dad’s backup program locked up my homework” when Dad is say in China for a two week business trip.

    A single network login will be my new approach when I complete my 3 laptop migration to Creators Update (aka Version 1703 of Windows 10).

    J. Niemuth

    • To start with your last point, Macrium Reflect, EaseUS Todo and MS built-in backups allow you to work while the backup is in progress.

  3. As far as I know “Remove” is used to hide the partition, but it doesn’t dismount it. Your mounted partition is still there but hidden. I was wondering if one goes to File Explorer and right-click on the mounted drive, which is F:/ in Leo’s example, and click on “Eject” wouldn’t be as good as “Detach VHD” in Disk Management. Probably, Leo can correct me if I am wrong…

    BTW, another very good article from Leo. I was always baffled by windows backup/restore system Tool. I can say, without a doubt, that I have learned something very interesting about the Windows Kernel today.

    Thanks again Leo.

Leave a reply:

Before commenting please:

  • Read the article.
  • Comment on the article.
  • No personal information.
  • No spam.

Comments violating those rules will be removed. Comments that don't add value will be removed, including off-topic or content-free comments, or comments that look even a little bit like spam. All comments containing links and certain keywords will be moderated before publication.

I want comments to be valuable for everyone, including those who come later and take the time to read.