C:\System Volume Information\
folder and see its contents. You might see a file with a GUID name (e.g. {4136e8c9-7553-4fd1-b220-8186bf3dcd47}
) that represents a backup of the syscache.hve
file, in which case you can restore it (making sure to rename the old syscache.hve
, syscache.log1
, and syscache.log2
files both for posterity and because the log files are specific to the current syscache.hve
and if you leave them around the system will think they're for the just-restored one and end up corrupting it.)syscache.hve
? syscache.hve
is undocumented, all I know about it is what I've been able to reverse engineer from my work on EasyRE. It contains some arcane bits of information to do with applocker and some software policies but the most important thing about them is that they contain (primarily?) generated/derived data that gets updated and replaced over time. \System Volume Information
is meant to be modified (or even seen - hence the need for doing these changes from a Linux CD) and Microsoft is free to do whatever it likes (including trash your installation) if it's not happy with what finds in there.