How to extract environment variables from system restore point, Windows 7 64-bit

You can mount the old version of the registry.

Open Regedit

Restoring User PATH:
2. Select HKEY_USERS
3. File->Load Hive
4. Navigate to your user folder, click the little button to the right of "Open" for "Show Previous Versions"
5. Select appropriate revision
6. Select NTUSER.DAT (must have Show Hidden Files enabled)
7. Give it a name (e.g. "Old")
8. Navigate to "Old"\Environment

Restoring System PATH:
2. Select HKEY_LOCAL_MACHINE
3. File->Load Hive
4. Navigate to your C:\Windows\System32\config\RegBack, click the little button to the right of "Open" for "Show Previous Versions": enter image description here
5. Select appropriate revision
6. Select SYSTEM.OLD
7. Give it a name (e.g. "Old")
8. Navigate to HKEY_LOCAL_MACHINE\"Old"\ControlSet001\Control\Session Manager\Environment
9. Open the PATH value and copy it to clipboard, then paste into system environment variables screen.

Note that for System, depending on how long ago this was, you can just go back into HKLM\(old control set version)\Control\Session Manager\Environment without loading an old hive, but this is a generally useful way to apply "Restore Previous Versions" to the registry.

'Show Previous Versions' explained, in detail with screenshots.

Special thanks to Microsoft for removing "Restore Previous Versions" from Windows 8.

Mark Sowul

Posted 2011-04-01T22:25:55.487

Reputation: 2 877

1i used windows 7 64 bit and i couldn't see the show previous versions either.(fyi, the open button was not split since there are not previous version available)..any other solution.. – Lucky – 2015-02-17T08:25:20.973

Easyer method http://superuser.com/a/798874/213990

– Sven van den Boogaart – 2015-08-13T11:42:30.323

To show the NTUSER.DAT, this settings must be unchecked in Windows Folder option: Hide protected operating system files – ceilfors – 2016-04-05T12:54:18.357

1I just did this but didn't need to load an older version (thankfully, because don't have one). I went to HKEY_LOCAL_MACHINE\ControlSet001\Control\Session Manager\Environment and it was still there. Maybe it's because I still have a command line open? – Rob Gray – 2016-05-19T00:51:09.093

1The system stores previous versions of SYSTEM\CurrentControlSet at a higher level, by backing up to ControlSet001, 2, 3, etc. So if you want to examine CurrentControlSet's recent history, you don't necessarily need to reload the whole registry. – Mark Sowul – 2016-05-19T13:28:02.357

@endolith same here. OP, I can see my single previous version of Regback, but when I open it and look for SYSTEM.OLD, i dont see one, further there is no option to rename the SYSTEM file that I do see. what do i do? – Ungeheuer – 2016-10-18T02:56:18.880

@endolith I don't know why i don't see a SYSTEM.OLD either, I am using Windows 7 64 bit but this worked for me. Double click SYSTEM and you will be prompted to give it a name, type in Old. Follow directions from there. – Pace – 2017-06-27T21:06:10.263

1FYI, when you are done, select the "old" folder and choose "File -> Unload Hive" to kick it back out. – Pace – 2017-06-27T21:07:18.063

Niice. That's what I was looking for. Thanks. – Kiril Stefanov – 2011-04-02T11:48:10.330

This might seem naive but what little button to right of open? – Ron – 2013-01-22T18:39:11.863

The 'open' button is split, it looks like Open | \/ - click the little thing on the right. – Mark Sowul – 2013-01-24T19:02:20.527

10Windows 8.1: "click the little button to the right of "Open" for "Show Previous Versions" <-- No such thing based on these directions – rainabba – 2014-01-01T06:37:35.797

1Yes, see at the bottom, "Special thanks to Microsoft for removing [it] from Windows 8" – Mark Sowul – 2014-01-04T14:57:40.020

2I didn't have a SYSTEM.OLD, just a SYSTEM – endolith – 2014-06-11T02:15:13.457

How to extract environment variables from system restore point, Windows 7 64-bit

Answers