Sometimes when NTLite breaks some function, that function can be restored by simply restoring files and/or registry entries that are removed, but I can't find which exact files and/or registry entries NTLite removes in NTLite logs. Am I missing something?
Neither NTLite or DISM logs will reveal those details. They report on the component level.
Component manifests will list which files are to be installed, their destinations & ownership/permissions, and registry changes.
Unfortunately in recent Windows editions, manifests are delta compressed and unreadable without using sxsexp.exe
Friend garlin Pl pardone me if i am wrong somewhere regarding this topic %Windir%\Servicing\Sessions\Sessions.xml plus %Windir%\Servicing\Sessions\SessionsBackup.xml retrieves the info about removed componenets using any software on offline either online OS image.
Correct, Sessions.xml captures both offline & online component changes. But why bother when /forcelistcomponents does the same work on any loaded image for removals? DISM commands can list installed features & updates.
Servicing logs are too large to read, unless you know how to write a parser script.