Solved Would I be able to view restricted-access directories using a Disk-Image?

W11: 23H2

I want to make a Disk-Image of the "C:" drive of my Windows OS. I want to do this as I want to browse through its files without being hindered by file and folder permission-restrictions (which restrictions I understand now have good reason for existing otherwise). I was advised to try Macrium Reflect's software for this. I got in touch with them and they told me—albeit without any elaboration—that yes this would be possible. This webpage they referenced corroborates with what they say, please see the attached screenshot of the relevant section of that webpage at the bottom of this post.

Could anyone confirm that I would indeed be able to view all files and folders of "C:" through such a Disk-Image? files and folders which would normally be inaccessible to an ordinary User due to permission-restrictions. To be clear, I would be "mounting" the Disk-Image on the same PC that the Disk-Image would itself be an "image" of.

Thanks.

_william said:

Could anyone confirm that I would indeed be able to view all files and folders of "C:" through such a Disk-Image?

Click to expand...

Yes, after selecting the C: partition to mount, tick the box for 'Enable access to restricted folders'.



You can then explore any restricted folder, such as System Volume Information.

@Bree Brilliant! Thank you so much.

_william said:

confirm that I would indeed be able to view all files and folders of "C:" through such a Disk-Image?

Click to expand...

Looking at this in a simplified manner, the key word is VIEW. Even viewing restricted files within Macrium, you will not see any files within the image that you cannot also see in your list of files by showing hidden files and folders in Windows folder options. That's why it's called an "image".
The backup image is read-only so you cannot change its contents. You can either open the files directly if you have an application capable of doing it(but you will not be able to save them) or you can copy and paste them to the desired location using Windows Explorer.
For example if you delete one of your personal files accidentally you can mount an image you made before the deletion and copy the file you lost from it.

Depending on the permission level, System Permissions deny the user right to alter/open the contents of/delete many files and it's that way for a reason.
Even if the permissions are changed to give the user full read/write access to all files, most system files still can not be manipulated by the user due to their file type. Normal users would not have the programming language applications to open such files or the knowledge of how to deal with the code within the file contents even if they were able to open them. I take it you are not a programmer or a hacker since you asked this question in the first place.


,

Curious if you can't just boot using a bootable flash drive with Linux and view the restricted folders?

glasskuter said:

Even viewing restricted files within Macrium, you will not see any files within the image that you cannot also see in your list of files by showing hidden files and folders in Windows folder options.

Click to expand...

No, there's more to it than that. If you mount a Macrium image with the 'Enable access to restricted folders' option it bypasses all NTFS permissions and restrictions. Folders like 'System Volume Information' that are so restricted even an administrator can't gain access are freely visible in the mounted .mrimg image.

Bree said:

are freely visible in the mounted .mrimg image.

Click to expand...

OK, sorry for my misrepresentation.But am I not right that the normal user can still not write to such files even though he can see them in an image. It was my understanding one can not save a file to an image.

If you only need to browse files hidden or blocked by system protection, download PowerRun.

PowerRun can open a CMD or Explorer session with TrustedInstaller rights, and view any system protected file. There's no need to copy the system image first, unless you're experimenting. Just be mindful, because your elevated CMD or Explorer will have all EDIT rights.

glasskuter said:

....am I not right that the normal user can still not write to such files even though he can see them in an image. It was my understanding one can not save a file to an image.

Click to expand...

Yes, that's right. You cannot modify the original image file.

There is an option when mounting a Reflect image to make it writeable (at the bottom of my screenshot in post #2) but any changes you make to the mounted image won't get saved to the image file when you dismount it. There's nothing to stop you making a new image of the mounted drive though, should you have a need to save your changes.

glasskuter said:

OK, sorry for my misrepresentation.But am I not right that the normal user can still not write to such files even though he can see them in an image. It was my understanding one can not save a file to an image.

Click to expand...

As far as I know macrium images are read only.

Some other imaging methods can be read/write.

garlin said:

If you only need to browse files hidden or blocked by system protection, download PowerRun.

PowerRun can open a CMD or Explorer session with TrustedInstaller rights, and view any system protected file. There's no need to copy the system image first, unless you're experimenting. Just be mindful, because your elevated CMD or Explorer will have all EDIT rights.

Click to expand...

Thanks for that other option.

Can do similar with the explorer in dism++


https://github.com/Chuyu-Team/Dism-.../download/v10.1.1002.2/Dism++10.1.1002.1B.zip

I find the ability to mount a Reflect image and copy any file is very useful when you only need to recover a specific file.

Steve C said:

I find the ability to mount a Reflect image and copy any file is very useful when you only need to recover a specific file.

Click to expand...

Yes, a great feature that I use when reinstalling or setting up a new PC. The configuration folders for Edge, Firefox, Thunderbird, and some other apps and files are extracted from a mounted image to replicate the previous setup.