You have lost a critical file : Roll back time with ShadowExplorer

By : Li_in
Recover deleted or modified file from shadow copy with shadow explorer

đŸ€– TL;DR

If you save over a file by accident on Windows, and you had System Protection or backups enabled, VSS probably created a shadow copy — a hidden snapshot of your file from earlier.

ShadowExplorer gives you an easy, GUI-based way to browse and export those previous versions. No time machine needed đŸ€—!

The Oops Moment 🙊!

Let’s set the scene

I was reviewing some notes — pretty important ones. The kind you don’t want to lose 😭. Somewhere between the 8th coffee and my 24th opened applications, I hit Ctrl+S. A good habit… except this time, I’d pasted the wrong content into the wrong file and hit save without thinking.

Poof. The original file? Gone, overwritten with nonsense.

Classic case of finger muscle memory betrayal. But instead of despairing, I reached into my forensics toolkit and pulled out a trick that non-tech folks rarely hear about but should absolutely know: ShadowExplorer 🚀

Why this works 🧐?

Quick primer on VSS (Volume Shadow Copy Service)

Behind the scenes, Windows often takes snapshot-style backups of your files and folders, these are called Volume Shadow Copies. They’re part of the Volume Shadow Copy Service (VSS), introduced in Windows XP and still present in modern systems.

Here’s the basic idea:

  • VSS creates read-only point-in-time snapshots of files on NTFS volumes.
  • These snapshots are used by System Restore, backup tools, and yes, they often include your user files.
  • They’re stored in the System Volume Information folder and are generally invisible to you.

So when you overwrite or delete a file, there’s a good chance an older version still exists in one of those snapshots: like a parallel version of your hard drive from earlier in the week.

The only catch? Windows doesn’t give you a built-in UI to browse those copies easily. That’s where ShadowExplorer steps in .

How to use ShadowExplorer to restore an old version of a file ?

1 – Launch ShadowExplorer (As Admin)

You already have it — nice. But for anyone else:
Download it from https://www.shadowexplorer.com and install it.

Run it as Administrator, otherwise you won’t have access to the shadow copies đŸ« .

2 – Select a Snapshot Date

  • Use the drop-down at the top-left to select a snapshot date.
  • These correspond to VSS snapshots created by your system.
  • Pick a date just before you fat-fingered your save 🙈.

If you don’t see any snapshots — i’m sorry for you, but you won’t be able to use this technic to recover your file :

spiderman crying
  • VSS may be disabled (check via vssadmin list shadows)
  • Or the system hasn’t made any restore points (often disabled by default on Windows Home editions)

3 – Browse to the File’s Location

  • Use the left-hand tree to navigate to the folder that contained the overwritten file.
  • On the right side, you’ll see the contents of that folder as they were on the snapshot date.

4 – Export the File

  • Right-click the file.
  • Select Export.
  • Save it somewhere else — don’t overwrite the current version again unless you’re sure 😅.

🎉 And that’s it — your overwritten file is back from a previous point in time, no forensic carving necessary.