Find System Restore Points and Shadow Copies in Regedit

This article explains how to locate the registry keys associated with Windows System Restore points and Volume Shadow Copy Service (VSS) metadata using the Registry Editor (Regedit). While the raw snapshot data and restore files reside inside the protected System Volume Information folder on each drive, Windows tracks configuration states, sequence numbers, provider metadata, and diagnostic logs within specific registry branches.

1. System Restore Configuration and Sequence Data

To view the registration parameters and the current sequence tracking for System Restore points, navigate to:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore

Key values to inspect in this location include: * RestorePointSequenceNumber: Displays the sequence number assigned to the most recently initiated restore point. * RPSessionInterval: Indicates the interval settings for automatic creation routines. * DisableSR: Shows whether System Restore is currently enabled (0) or disabled (1) on the system.

2. Volume Shadow Copy (VSS) Metadata and Providers

System Restore relies directly on the Volume Shadow Copy Service (VSS). To examine registered VSS hardware and software providers, navigate to:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS\Providers

Under this key, expand the GUID subkeys (such as {b5946137-7b9f-4925-af80-51abd60b20d5} for the standard Microsoft Software Shadow Copy Provider) to view registered snapshot handlers and service properties.

3. VSS Diagnostic and Snapshot Tracking

To view diagnostic logs and operational metadata generated during shadow copy creation, navigate to:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS\Diag

Windows stores trace data, provider verification records, and volume tracking states under this branch, which helps verify active shadow copy sessions.

4. Backup and Restore Exclusion Rules

To check which registry keys and file paths are excluded from restore points and shadow copies by default, inspect:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\BackupRestore

This key contains subfolders such as FilesNotToBackup and KeysNotToRestore, defining the exact data parameters VSS ignores during the creation of a restore snapshot.