Point the SPF file extractor at a folder of .spf and .spi images. It reads the chain, lists every file inside and saves the ones you choose.
Version 26.7 | Windows 11, Windows 10, Windows 8.1, Windows 7 and Windows Server
An SPF folder holds five kinds of file, although only three decide whether it opens.
Inside the image
The tool reads all of this from the chain before you export.
A .spf holds the full image, so each .spi that follows holds only what moved. The tool loads the folder and resolves the chain, then shows the volume as it stood.
There is no drive letter to mount and no volume to copy from. Tick the documents you need and the tool writes them out, keeping their original sizes and dates.
Nothing from the original backup software has to be installed, because the tool reads the image straight off disk. No licence check runs at any point.
Reading runs from the first byte to the last, so the folder you were handed is never written to. A demo run costs the images nothing.
An old server image can hold a great many folders. Type part of a name or an extension and the list narrows to what you are actually after.
Ask for a Tuesday and the tool applies every increment up to that Tuesday. You get the version of the file that existed on the day you chose.
A folder of SPF and SPI files opens without the software that wrote it.
Try the Free Demo 100% Safe and SecureFrom a folder Windows will not open to the file you need.
Point it at the folder, not one file
Use Open Folder and select the directory the backup job wrote to, whether that sits on a NAS, a USB disk or a network share. An increment means nothing on its own, so the tool needs to see what sits beside it.
The extension does not have to be right
You do not have to fix the name first. Matching happens on the header bytes, which matters here because the same three letters belong to several unrelated products. Each entry tells you whether it is a base or a later addition to the chain.
You pick the date, not the file
Ask for a Tuesday and the tool applies every increment up to that Tuesday. Below the rebuilt volume sits the partition layout, then whichever filesystem was running on it.
Search rather than browse
An old server volume holds a great many folders. Type part of a name or an extension and the list narrows to what you are actually after.
Tick it and export
Choose a folder on a working disk and the tool writes out only the ticked items, keeping their original sizes and dates.
Copy the folder, not the two big files
People move the .spf and the .spi across and leave the small files behind. The .md5 is part of the image and without it the archive will not read.
Not an archive of documents. A copy of the volume those documents were sitting on.
A volume, sector by sector
The image copies the drive at block level, so an MBR or GPT partition table and the filesystem structures come across exactly as they were on the source machine.
NTFS and ReFS inside
The filesystem is ordinary once the tool opens the container. NTFS, ReFS and FAT volumes all read. Directory records, file permissions and modified dates survive in place.
Compressed, sometimes encrypted
The backup job compresses by default to keep the image down. Encryption is a per job setting. When the job used encryption, a key file appears alongside.
One oddity is worth knowing before you go searching, because the extension is heavily overloaded. A widely used file catalogue puts backup images at fewer than one in ten files carrying the extension. The rest are StruCAD 3D models, SlingPlayer favourites, Site Publisher profiles and stitch designs.
Double click one and Windows asks how you want to open it, which is where most of these searches begin. That is why answers about this extension are so unreliable. It is also why identifying the file by its header rather than its name matters more here.
Yes. You do not need a licence on the machine. The pages telling you otherwise have not looked at the format, so they repeat each other.
One states the format opens only in ShadowProtect. Another names a video converter. A third calls it a settings file.
Proprietary describes who published the layout, although it says nothing about who can follow it. An SPF holds a sector level copy of a Windows volume, so nothing is left out. The NTFS or ReFS filesystem inside behaves like any other once the tool reads the container.
What the results tell you
Install ShadowProtect, licence it, mount the backup as a volume, then copy your file off that volume.
What an SPF file extractor does
Point it at the backup folder, search the file list and export the document. No install, no licence, no mount.
Some routes cost nothing and some ship inside the software. Each assumes something you may not have.
| Route | Opens the image |
Walks the chain |
No install needed |
Gives you files |
|---|---|---|---|---|
| Explore Backup Wizard Bundled Built in, mounts the image to a drive letter you browse in Windows Explorer |
||||
| VirtualBoot Bundled Boots the image as a machine instead of reading it |
||||
| A recovery laboratory Quoted per job, the drive leaves your hands |
||||
| SPF file extractor Demo Reads the folder, exports what you tick |
The wizard works well and is the right answer when the software is already licensed on a machine you control. VirtualBoot starts the image as a running system through an .xsp handoff, so take that route when you want a Hyper-V or VMware machine rather than the documents inside. It also produces a VHD or VMDK you can attach elsewhere.
A laboratory is for damaged media, which is the right call when the file is corrupt or ransomware has been through the folder. Because a bare metal restore onto new hardware needs the original software, the SPF file extractor covers the narrower case where the images are healthy and the licence is not there.
ShadowProtect files at a glance
A ShadowProtect folder holds five kinds of file and only three of them matter. Nobody explains which.
Full
.spf
Written once, because everything after it depends on it
Increment
.spi
One per job, so it holds only what moved
Increment
.spi
Repeating forward to the day you want
Break the backup chain anywhere and everything after the gap stops resolving
Keep the .md5
It sits beside each image, because the format counts it as part of that image. Remove one and the image it belongs to stops being readable, however intact the rest looks.
The .bitmap is optional
It speeds work up, although nothing depends on it. If a folder arrived without any, that is normal and costs you nothing.
The .spk is the encryption key and appears only when the job was encrypted. A folder with no .spk was never encrypted, so its absence is not a problem to solve.
One trap is worth naming. ImageManager rolls a long chain into fewer files, although the survivors keep old timestamps from the period they cover.
A folder can look full of stale clutter although every file in it is load bearing. Deleting on age is how most broken chains begin.
ShadowProtect images sit in the Professional tier, alongside the other commercial imaging formats.
Standard, $49
Covers BKF, TAR, ZIP and the consumer imaging formats on two machines. It does not open a .spf.
Professional, $99
Adds ShadowProtect, Veeam, Acronis, tape and virtual disks, on up to ten machines.
Try the demo on your own folder first. It loads the chain and lists everything inside, so you can confirm the document is there before spending anything.
Buy Professional Compare all editions
Everything here describes Backup Extractor 26.7. BitRecover has built data recovery and format conversion tools since 2011.
The images outlast the licence that produced them. Three routes account for most of these folders.
StorageCraft became Arcserve and the product line moved with it. ShadowProtect 4.x has been through end of life. The IT Edition builds, the portable ones technicians carried for one off recoveries, have reached end of sale. End of life follows on 17 November 2026, after which there are no updates, no security patches and no support.
The rest arrive by other routes. A managed service provider returns a NAS at the end of a contract. Decommissioned servers leave their backup volumes behind. Changes of ownership bring the images with the premises.
In every case the images are fine and the software that reads them is not available, which is a licensing problem rather than a data problem.
The things people ask once they have the folder in front of them.
Yes. The SPF file extractor reads the image directly from disk. Nothing is installed on the machine that made the backup and no licence is checked.
The .spf is the full image and anchors everything. Each .spi holds only the blocks that moved during that job, so an increment on its own restores nothing.
The .md5 counts as part of the image and an SPF without it will not read. The .bitmap can go, since nothing depends on it. Copy the whole folder and the question stops mattering.
It holds the encryption key and only exists when the backup job was encrypted. If your folder has no .spk then the job was never encrypted.
Only when the image itself is intact. A truncated or partly overwritten file needs media level recovery, which is laboratory work rather than a software fix. Run the demo first and it will show you what it can still see.
No. ImageManager consolidates a chain into fewer files and the old timestamps are a side effect of that. Age tells you nothing about whether a file is still carrying the chain.
Yes. SPX writes the same .spf and .spi extensions as the earlier versions, so one tool covers both.
Yes. The header identifies it regardless of what the file is called, so a renamed file loads the same way.
Yes. Search the file list, tick what you want and export only that. There is no drive letter to mount and no volume to write back.
Professional at $99. Standard leaves out ShadowProtect, Veeam and Acronis, so the $49 edition will not open a .spf.
Load the folder, search the list and see your files before you decide anything.
Free Demo Download Purchase NowVersion 26.7 · Windows 11, Windows 10, Windows 8.1, Windows 7 and Windows Server · 30 day money back