Shadow Copy

Shadow Copy (also called Volume Snapshot Service or VSS, or Previous Versions in Windows Vista) is a feature introduced with Windows XP with SP1, Windows Server 2003, and available in all releases of Microsoft Windows thereafter, that allows taking manual or automatic backup copies or snapshots of a file or folder on a specific volume at a specific point in time. It is used by NTBackup and the "Volume Shadow Copy" service to back up files. In Windows Vista, it is used by Windows Vista's backup utility, System Restore and the "Previous Versions" feature.

Overview

VSS operates at the block level of the file system.

Snapshots have two primary purposes: they allow the creation of consistent backups of a volume, ensuring that the contents cannot change while the backup is being made, and they avoid problems with file locking. By creating a read-only copy of the volume, backup programs are able to access every file without interfering with other programs writing to those same files. Microsoft's NTBackup utility included in Windows XP Professional, MCE, Windows Server 2003 and later makes use of this mechanism. Also, users can access their files as they existed at the time of the snapshot, thus retrieving an earlier version of a file or recovering a file deleted by mistake.

The data copy process can be handled by the file system or by specialized hardware, in the latter case a hardware VSS provider abstracts the functionality to the Operating System. Applications can provide specific support for VSS through VSS Writers which control how data is set to a consistent state at the beginning of a VSS operation and maintain that consistency throughout the process, among other functions.

Through the integration between the Volume Shadow Copy Service, hardware or software VSS providers, application level writers and backup applications, VSS enables integral backups that are point in time and application level consistent without the backup tool having knowledge about the internals of each application. For example, in a virtualization system such as Virtual Server 2005 R2 SP1 or Hyper-V in Windows Server 2008, a whole backup of an environment including several virtual machines can be created in a single operation, and the backups produced for the different VSS compatible guests in the system are transactionally consistent at the guest application level and point in time consistent among the different VMs, without the need for the guests to have backup agents installed. Applications and services that support VSS include Hyper-V, Virtual Server, Active Directory, SQL Server, Microsoft Exchange and other Microsoft and third party solutions.

The end result is similar to a versioning file system, allowing any file to be retrieved as it existed at the time any of the snapshots was made. Unlike a true versioning file system, however, users cannot trigger the creation of new versions of an individual file, only the entire volume. As a side-effect, where the owner of a file can create new versions in a versioning file system, only a system administrator or a backup operator can create new snapshots (or control when new snapshots are taken), because this requires control of the entire volume rather than an individual file. Also, many versioning file systems (such as the one in VMS) implicitly save a version of files each time they are changed; systems using a snapshotting approach like Windows Vista only capture the state periodically.

History

The snapshot facility was first added to Microsoft Windows in Windows XP; this version could only create non-persistent snapshots (a temporary snapshot, usually used for creating a backup or more generally accessing copies of files that have been locked by applications for editing). The creation of persistent snapshots (multiple snapshots which remain available until specifically deleted from the system) was added in Windows Server 2003, allowing up to 512 snapshots to exist simultaneously for the same volume, from which maximum 64 snapshots could be used for the "Shadow copies for Shared Folders" feature. The "Shadow copies for Shared Folders" feature "automatically" created incremental periodic snapshots or "Deltas" (differences) of changed files over time. This feature was however designed for a client-server model where the snapshots on a server could be remotely accessed over the network by the client, and doing so on client platforms earlier than Windows XP SP2 required the addition of client software. A copy of this software for 32-bit Windows platforms is available on the server. The client software is included in Windows XP Service Pack 2 by default.

Windows Vista Shadow Copy

In Windows Vista, the rewritten backup utility also uses Shadow Copy to manually back up files. In addition, the "Shadow Copy for Shared Folders" feature is now called "Previous Versions" and has been enabled for files on standalone computers. It stores backup copies of files on local volumes using incremental snapshots and can restore them later. The shadow copy is not created every time a file is changed. The backup copies are only created, either automatically once per day or also created manually when triggered by the backup utility or installer applications. [ [http://technet2.microsoft.com/WindowsVista/en/library/4ac505e6-dd8b-4ae7-80fa-b9d77cd8104d1033.mspx?mfr=true Selected Scenarios for Maintaining Data Integrity with Windows Vista] ] The "Previous Versions" feature is available in the Business, Enterprise, and Ultimate editions. [ [http://www.microsoft.com/windows/products/windowsvista/footnotes.mspx Volume Shadow Copy and "Previous Versions" feature in Windows Vista] ] The Home Editions lack the "Previous Versions" feature, even though the "Volume Snapshot Service" is included and running. Using third party tools it is still possible to restore lost or altered files [ [http://www.shadowexplorer.com/ ShadowExplorer allows restoring lost or altered files] ]

The Windows Vista version of System Restore is also now based on Shadow Copy. Prior to Windows Vista, System Restore was based on a file-based filter that watched changes for a certain set of file extensions, and then copied files before they were overwritten. [ [http://www.microsoft.com/middleeast/windowsvista/features/foreveryone/backup.mspx Systems Restore in Windows Vista and other backup features] ]

NTFS forward compatibility

While the different NTFS versions have a certain degree of both forward and backward compatibility, there are technical considerations for mounting newer NTFS volumes containing persistent shadow copies in older versions of Windows, prior to Windows Vista. This affects dual-booting, and external portable hard drives. Specifically, the shadow copies on an NTFS volume are deleted when the older operating system mounts that NTFS volume. This happens because the older operating system does not understand the newer format of persistent shadow copies. [cite web | url=http://blogs.technet.com/filecab/archive/2006/07/14/441829.aspx | title=How restore points and other recovery features in Windows Vista are affected when you dual-boot with Windows XP | author=cfsbloggers | date=July 14, 2006 | work=The Filing Cabinet | accessdate=2007-03-21 ]

Command line interface

Windows includes a command called vssadmin that can display current volume shadow copy backups and all installed shadow copy writers and providers. [ [http://technet.microsoft.com/en-us/library/bb491031.aspx Microsoft TechNet Vssadmin article] ]

Example

The following command displays all installed volume shadow copy providers:

vssadmin list providers

ee also

* List of Microsoft Windows components
* File locking

References

Resources

* cite web
url=http://technet2.microsoft.com/WindowsServer/en/Library/2b0d2457-b7d8-42c3-b6c9-59c145b7765f1033.mspx?mfr=true
title=How Volume Shadow Copy Service Works
date=March 28 2003
accessdate=2006-05-10
work=TechNet
publisher=Microsoft
* cite web
url=http://www.microsoft.com/technet/windowsvista/library/4ac505e6-dd8b-4ae7-80fa-b9d77cd8104d.mspx
title=Selected Scenarios for Maintaining Data Integrity with Windows Vista
accessdate=2006-05-10
work=TechNet
publisher=Microsoft
* cite web
url=http://msdn.microsoft.com/en-us/library/bb968832(VS.85).aspx
title=Volume Shadow Copy Service
accessdate=2008-04-30
work=MSDN
publisher=Microsoft