Shadow Copy

Shadow Copy (Volume Snapshot Service or Volume Shadow Copy Service or VSS), is a technology included in Microsoft Windows that allows taking manual or automatic backup copies or snapshots of data, even if it has a lock, on a specific volume at a specific point in time over regular intervals. It is implemented as a Windows service called the Volume Shadow Copy service. A software VSS provider service is also included as part of Windows to be used by Windows applications. Shadow Copy technology requires the file system to be NTFS to be able to create and store shadow copies. Shadow Copies can be created on local and external (removable or network) volumes by any Windows component that uses this technology, such as when creating a scheduled Windows Backup or automatic System Restore point.

Overview

VSS operates at the block level of the file system.

Snapshots have two primary purposes: they allow the creation of consistent backups of a volume, ensuring that the contents cannot change while the backup is being made; and they avoid problems with file locking. By creating a read-only copy of the volume, backup programs are able to access every file without interfering with other programs writing to those same files.

The data copy process can be handled by the file system or by specialized hardware; in the latter case a hardware VSS provider abstracts the functionality to the operating system. Applications can provide specific support for VSS through VSS writers which control how data is set to a consistent state at the beginning of a VSS operation and maintain that consistency throughout the process, among other functions.

Through the integration between the Volume Shadow Copy Service, hardware or software VSS providers, application level writers and backup applications, VSS enables integral backups that are point in time and application level consistent without the backup tool having knowledge about the internals of each application. For example, in a virtualization product such as Virtual Server 2005 R2 SP1 or Hyper-V in Windows Server 2008, a whole backup of an environment including several virtual machines can be created in a single operation, and the backups produced for the different VSS compatible guests in the system are transactionally consistent at the guest application level and point in time consistent among the different VMs, without the need for the guests to have backup agents installed. Windows Server applications and services that support VSS include Windows Server Backup, Hyper-V, Virtual Server, Active Directory, SQL Server, Microsoft Exchange, and other Microsoft and third-party solutions such as Cobian Backup.

The end result is similar to a versioning file system, allowing any file to be retrieved as it existed at the time any of the snapshots was made. Unlike a true versioning file system, however, users cannot trigger the creation of new versions of an individual file, only the entire volume. As a side-effect, whereas the owner of a file can create new versions in a versioning file system, only a system administrator or a backup operator can create new snapshots (or control when new snapshots are taken), because this requires control of the entire volume rather than an individual file. Also, many versioning file systems (such as the one in VMS) implicitly save a version of files each time they are changed; systems using a snapshotting approach like Windows only capture the state periodically.

Use by Windows components

Windows XP and Windows Server 2003

The Volume Snapshot Service was first added to Microsoft Windows in Windows XP; this version of VSS is used by NTBackup, however it can only create non-persistent snapshots (a temporary snapshot, usually used for creating a file-based backup or more generally, accessing copies of files that have been locked by applications for editing); therefore NTBackup uses a proprietary BKF file format to store the shadow copies permanently.

The creation of persistent snapshots (multiple snapshots which remain available across reboots until specifically deleted from the system) has been added in Windows Server 2003, allowing up to 512 snapshots to exist simultaneously for the same volume. In Windows Server 2003, VSS is therefore used to create incremental periodic snapshots of data or deltas (differences) of changed files over time. A maximum of 64 snapshots is stored on the server and accessible by clients or on the same server through network shares. This feature is known as Shadow copies for Shared Folders and is designed for a client–server model. The Shadow copies for Shared Folders client is required to be installed on Windows 2000 and Windows XP RTM and SP1. A copy of this client for 32-bit Windows platforms is available on the server or downloadable from Microsoft. It is built into the OS beginning with Windows XP SP2.^[1] ShadowConnect, a client for Macintosh computers accessing Windows servers, is available from a third-party.

Windows Vista and later

A number of Microsoft Windows components have been updated to make use of Shadow Copy. The Backup and Restore Center in Windows Vista and later operating systems performs block-based backups when doing full system backups. The file backup feature also uses shadow copy but stores files inside ZIP files.

Beginning with Windows Vista, VSS is also used by the System Protection component which creates and maintains periodic copies of system and user data on the same local volume (similar to the Shadow Copies for Shared Folders feature in Windows Server) but allows it to be locally accessed by System Restore. System Restore allows reverting to an entire previous set of shadow copies called a Restore point. Prior to Windows Vista, System Restore was based on a file-based filter that watched changes for a certain set of file extensions, and then copied files before they were overwritten.^[2]

Additionally, a property sheet shell extension called Previous Versions allows restoring individual files or folders locally from the restore point, as they existed at the time of the snapshot, thus retrieving an earlier version of a file or recovering a file deleted by mistake.

The shadow copy is not created every time a file is changed; backup copies are created automatically once per day, or manually when triggered by the backup utility or installer applications which create a restore point.^[3] The "Previous Versions" feature is available in the Business, Enterprise, and Ultimate editions of Windows Vista^[4] and in all Windows 7 editions. The Home Editions of Vista lack the "Previous Versions" feature, even though the Volume Snapshot Service is included and running. Using third party tools it is still possible to restore previous versions of files on the local volume.^[5] Some of these tools also allow users to schedule snapshots at user-defined intervals, configure the storage used by volume shadow copies and compare files or directories from different points-in-time using snapshots.^[6] Windows 7 also adds native support through a GUI to configure the storage used by volume shadow copies.

NTFS forward compatibility

While the different NTFS versions have a certain degree of both forward and backward compatibility, there are certain issues when mounting newer NTFS volumes containing persistent shadow copies in older versions of Windows, prior to Windows Vista. This affects dual-booting, and external portable hard drives. Specifically, the shadow copies on an NTFS volume are deleted when the older operating system mounts that NTFS volume. This happens because the older operating system does not understand the newer format of persistent shadow copies.^[7]

Command line interface

Windows XP and later also include a command line utility called vssadmin that can manipulate current volume shadow copy backups and all installed shadow copy writers and providers.^[8] Additionally, Windows Server 2008 introduces the diskshadow utility which makes it possible to script VSS operations ^[9]

Example

The following command displays all installed volume shadow copy providers:

vssadmin list providers

The following command creates a new Volume Shadow Copy for volume C: :

vssadmin create shadow /for=c:

See also

• List of Microsoft Windows components
• Snapshot (computer storage)
• Copy-on-write

References

Further reading

• Russinovich, Mark E.; Solomon, David A.; Ionescu, Alex (2009). "Storage Management". Windows Internals (5th ed.). Microsoft Press. pp. 688–698. ISBN 978-0-7356-2530-3. 
• "How Volume Shadow Copy Service Works". Microsoft TechNet. Microsoft. 2003-03-28. http://technet.microsoft.com/en-us/library/cc785914(WS.10).aspx. Retrieved 2011-01-04. 
• "Selected Scenarios for Maintaining Data Integrity with Windows Vista". Microsoft TechNet. Microsoft. http://technet.microsoft.com/en-us/library/cc749185(WS.10).aspx. Retrieved 2011-01-04. 
• "Volume Shadow Copy Service". MSDN. Microsoft. 2010-12-16. http://msdn.microsoft.com/en-us/library/bb968832(VS.85).aspx. Retrieved 2011-01-04. 
• Oltean, Adi (2006-09-19). "A bit of black magic: How to assign drive letters to VSS shadow copies... on Windows XP!". MSDN Blogs. Microsoft. http://blogs.msdn.com/adioltean/archive/2006/09/18/761515.aspx. Retrieved 2011-01-04. 
• Oltean, Adi (2004-12-14). "Creating shadow copies from the commandline". MSDN Blogs. Microsoft. http://blogs.msdn.com/adioltean/archive/2004/12/14/301868.aspx. Retrieved 2011-01-04. 
• "Volume Shadow Copy Service Troubleshooting Guide". BackupChain Tutorials. FastNeuron Inc. 2010-07-21. http://backupchain.com/Volume-shadow-copy-service-error-troubleshooting.html. Retrieved 2011-01-04. 
• "Volume Shadow Copy Service (VSS) Express Writers". Microsoft. http://blogs.technet.com/b/filecab/archive/2009/06/17/volume-shadow-copy-service-vss-express-writers.aspx.