In a previous article, we created an image backup using Windows 10’s built-in image backup tool, which it refers to as the “Windows 7 Backup.” We’ve also looked at how to restore that image, in its entirety, to your hard disk.
But what if you don’t want to restore the entire image? What if all you want is just a single file or set of files contained within the image? That’s why image backups are awesome, after all. They contain everything.
The good news is you don’t need to restore everything if you don’t want to.
Let’s restore a single file contained within a Windows 10 image backup.
Where’s the backup?
The first thing we need to do is to locate the backup. Windows “conveniently” hides all the actual files involved on the backup drive you selected, in a single folder called “WindowsImageBackup”.
If you examine the contents of that folder (you’ll likely be asked to confirm that you want to, and give yourself permission), you’ll find a folder with the same name as your machine name.1
Viewing the contents of that folder (once again, after confirming your intent) you’ll find a series of folders named “Backup”, followed by a date and time — one for each image backup stored on the drive. View the contents of the folder corresponding to the date and time of the backup image you want to examine.
Here is where you’ll finally find the files you’re looking for, though with names that might make no sense to you.
The files we care about — the files that actually contain the image backup — are those with the filename extension “.vhdx”. In the “type” column you’ll see them described as “Hard Disk Image File”.
Choosing the right file
If your backup contains multiple partitions — and most backups do these days — you’ll have more than one “.vhdx” file, with names that don’t relate to anything you might recognize. Each corresponds to one backed-up partition. In the example above, for example, one is the “System Reserved Partition”, and the other is my “C:” drive.
Which is which? We’ll use the size of the image to guide us. Looking at the sizes of the two files, you’ll see that one is significantly larger than the other.
That tells us that the first one is the larger of the partitions on my hard disk, and would contain the backup image of the “C:” drive. Note that this size will not match the actual size of the partition — it contains only data, and may also be compressed — but the relative size of the files should correspond to the relative size of your partitions. Reserved or recovery partitions are almost always significantly smaller than the data partitions of a hard disk.
This technique is quick and easy, but it doesn’t always work. If you have multiple partitions containing roughly the same amount of data, their backup images may be roughly the same size. In these cases, it’s easiest to simply pick one and examine its contents, as we’re about to do. If it’s the wrong one, repeat the process with the other.2
Mounting the hard disk image
Right-click on the image file containing the image you want to examine, and click on Mount.
This instructs Windows to take that image file and treat it as if it were an actual hard disk.
You may get a warning.
In our case, the warning simply indicates that the drive we’re interested in has not yet been assigned a drive letter — normally a part of the mounting process. The instructions it provides to proceed are correct: we’ll need to run the Disk Management tool.
Assigning a drive letter
In Windows 10, right-click on the Start menu and click on Disk Management (or, in any version of Windows, simply run “diskmgmt.msc”).
You may need to scroll down within the resulting display, but you should find a large disk partition that has no drive letter.
The “Capacity” listed should match the capacity of the partition you backed up, and the free space should roughly match the free space on the drive at the time it was backed up.
Right-click on the disk in the lower pane, and click on Change Drive Letter and Paths… in the resulting pop-up menu (not shown). The next dialog will present a list of currently-assigned drive letters and paths showing empty ones, as none have been assigned yet.
Click the Add… button.
The next dialog will give you a choice to add a drive letter or a path. Make sure “Assign the following drive letter” is selected. Next to that is a drop-down list of drive letters not currently being used by your system. You can select a different letter if you like, or simply accept the default — “F:” in the example below.
Your backup image is now mounted as drive F: on your system.
Examining the image
The reason for going through this lengthy process of locating, mounting, and assigning a drive letter should hopefully now be clear: all you need to do is use whatever tool you like to examine the contents of your backup image. For example, I’ve opened up drive “F:” in Windows File Explorer, below.
The contents of my “F:” drive look almost exactly like my “C:” drive, which makes sense, since what we mounted was a backup image of the C: drive. (If the contents don’t look like the contents of the drive you expect, make sure you selected the correct “.vhdx” file earlier.)
Restoring individual files or folders is simple: just locate them within the mounted image partition — drive F: in my example above — and use whatever technique you’re comfortable with to copy them back to your C: drive. That’s all there is to it.
Since people often ask: you shouldn’t be able to modify the contents of a mounted image. Even if you could, you shouldn’t, as it would no longer be an image of the drive when the backup was taken; it would be an image “plus random changes”, which in the long term can get confusing.
When you’re done
When you’re done restoring images from the backup, you need to unmount the drive.
Return to Disk Management, right-click on the disk, and click on Detach VHD.
You may be asked to confirm (not shown), after which the mounted drive will disappear.