Shadow Copy

From Wikipedia, the free encyclopedia

Shadow Copy in Windows Vista
Shadow Copy in Windows Vista

Shadow Copy (also called Volume Snapshot Service or VSS, or Previous Versions in Windows Vista) is a feature introduced with Windows XP with SP1, Windows Server 2003, and available in all releases of Microsoft Windows thereafter, that allows taking manual or automatic backup copies or snapshots of a file or folder on a specific volume at a specific point in time. It is used by NTBackup and the Volume Shadow Copy service to backup files. In Windows Vista, it is used by Windows Vista's backup utility, System Restore and the Previous Versions feature.

Contents

[edit] Overview

VSS operates at the block level of the file system.

Snapshots have two primary purposes: they allow the creation of consistent backups of a volume, ensuring that the contents cannot change while the backup is being made, and they avoid problems with file locking. By creating a read-only copy of the volume, backup programs are able to access every file without interfering with other programs writing to those same files. Microsoft's NTBackup utility included in Windows XP Professional, MCE, Windows Server 2003 and later makes use of this mechanism. Also, users can access their files as they existed at the time of the snapshot, thus retrieving an earlier version of a file or recovering a file deleted by mistake.

The data copy process can be handled by the file system or by specialized hardware, in the latter case a hardware VSS provider abstracts the functionality to the Operating System. Applications can provide specific support for VSS through VSS Writers which control how data is set to a consistent state at the beginning of a VSS operation and maintain that consistency throughout the process, among other functions.

Through the integration between the Volume Shadow Copy Service, hardware or software VSS providers, application level writers and backup applications, VSS enables integral backups that are point in time and application level consistent without the backup tool having knowledge about the internals of each application. For example, in a virtualization system such as Virtual Server 2005 R2 SP1 or Hyper-V in Windows Server 2008, a whole backup of an environment including several virtual machines can be created in a single operation, and the backups produced for the different VSS compatible guests in the system are transactionally consistent at the guest application level and point in time consistent among the different VMs, without the need for the guests to have backup agents installed. Applications and services that support VSS include Hyper-V, Virtual Server, Active Directory, SQL Server, Microsoft Exchange and other Microsoft and third party solutions.

The end result is similar to a versioning file system, allowing any file to be retrieved as it existed at the time any of the snapshots was made. Unlike a true versioning file system, however, users cannot trigger the creation of new versions of an individual file, only the entire volume. As a side-effect, where the owner of a file can create new versions in a versioning file system, only a system administrator or a backup operator can create new snapshots (or control when new snapshots are taken), because this requires control of the entire volume rather than an individual file. Also, many versioning file systems (such as the one in VMS) implicitly save a version of files each time they are changed; systems using a snapshotting approach like Windows Vista only capture the state periodically.

[edit] History

The snapshot facility was first added to Microsoft Windows in Windows XP; this version could only create non-persistent snapshots (a temporary snapshot, usually used for creating a backup or more generally accessing copies of files that have been locked by applications for editing). The creation of persistent snapshots (multiple snapshots which remain available until specifically deleted from the system) was added in Windows Server 2003, allowing up to 512 snapshots to exist simultaneously for the same volume, from which maximum 64 snapshots could be used for the Shadow copies for Shared Folders feature. The Shadow copies for Shared Folders feature automatically created incremental periodic snapshots or Deltas (differences) of changed files over time. This feature was however designed for a client-server model where the snapshots on a server could be remotely accessed over the network by the client, and doing so on client platforms earlier than Windows XP SP2 required the addition of client software. A copy of this software for 32-bit Windows platforms is available on the server. The client software is included in Windows XP Service Pack 2 by default.

[edit] Windows Vista Shadow Copy

In Windows Vista, the rewritten backup utility also uses Shadow Copy to manually backup files. In addition, the Shadow Copy for Shared Folders feature is now called "Previous Versions" and has been enabled for files on standalone computers. It stores backup copies of files on local volumes using incremental snapshots and can restore them later. The shadow copy is not created every time a file is changed. The backup copies are only created, either automatically once per day or also created manually when triggered by the backup utility or installer applications. [1] The Previous Versions feature is available in the Business, Enterprise, and Ultimate editions. [2] The Home Editions lack the Previous Versions feature, even though the Volume Snapshot Service is included and running. Using third party tools it is still possible to restore lost or altered files [3]

The Windows Vista version of System Restore is also now based on Shadow Copy. Prior to Windows Vista, System Restore was based on a file-based filter that watched changes for a certain set of file extensions, and then copied files before they were overwritten. [4]

[edit] NTFS forward compatibility

While the different NTFS versions have a certain degree of both forward and backward compatibility, there are technical considerations for mounting newer NTFS volumes containing persistent shadow copies in older versions of Windows, prior to Windows Vista. This affects dual-booting, and external portable hard drives. Specifically, the shadow copies on an NTFS volume are deleted when the older operating system mounts that NTFS volume. This happens because the older operating system does not understand the newer format of persistent shadow copies. [5]

[edit] See also

[edit] References

  1. ^ Selected Scenarios for Maintaining Data Integrity with Windows Vista
  2. ^ Volume Shadow Copy and 'Previous Versions' feature in Windows Vista
  3. ^ ShadowExplorer allows restoring lost or altered files
  4. ^ System Restore in Windows Vista and other backup features
  5. ^ cfsbloggers (July 14, 2006). How restore points and other recovery features in Windows Vista are affected when you dual-boot with Windows XP. The Filing Cabinet. Retrieved on 2007-03-21.

[edit] Resources

v • d • e
Microsoft Windows components
Core
Management
tools
Applications
Games
Kernel
Services
File systems
Server
Architecture
Security
Compatibility