Shadow Copy

From Wikipedia, the free encyclopedia
Jump to: navigation, search
Shadow Copy
A component of Microsoft Windows
Previous Versions Vista.png
Previous Versions in Windows Vista, a part of Windows Explorer that allows persistent shadow copies to be created
Other names
  • Volume Snapshot Service[1]
  • Previous Versions
  • Shadow Copies for Shared Folders
  • VSS[2]
Included with Windows XP with Service Pack 2 and newer versions of Windows
Also available for Windows 2000, Windows XP RTM/SP1
Service name VSS[2]
Description Volume Shadow Copy
Related components
Backup and Restore, File History

Shadow Copy (also known as Volume Snapshot Service,[1] Volume Shadow Copy Service[2] or VSS[2]) is a technology included in Microsoft Windows that allows taking manual or automatic backup copies or snapshots of computer files or volumes, even when they are in use. It is implemented as a Windows service called the Volume Shadow Copy service. A software VSS provider service is also included as part of Windows to be used by Windows applications. Shadow Copy technology requires the file system to be NTFS to be able to create and store shadow copies. Shadow Copies can be created on local and external (removable or network) volumes by any Windows component that uses this technology, such as when creating a scheduled Windows Backup or automatic System Restore point.


VSS operates at the block level of the file system.

Snapshots have two primary purposes: they allow the creation of consistent backups of a volume, ensuring that the contents cannot change while the backup is being made; and they avoid problems with file locking. By creating a read-only copy of the volume, backup programs are able to access every file without interfering with other programs writing to those same files.

The data copy process can be handled by the file system or by specialized hardware; in the latter case a hardware VSS provider abstracts the functionality to the operating system. Applications can provide specific support for VSS through VSS writers which control how data is set to a consistent state at the beginning of a VSS operation and maintain that consistency throughout the process, among other functions.

Through the integration between the Volume Shadow Copy Service, hardware or software VSS providers, application level writers and backup applications, VSS enables integral backups that are point in time and application level consistent without the backup tool having knowledge about the internals of each application. For example, in a virtualization product such as Virtual Server 2005 R2 SP1 or Hyper-V in Windows Server 2008, a whole backup of an environment including several virtual machines can be created in a single operation, and the backups produced for the different VSS compatible guests in the system are transactionally consistent at the guest application level and point in time consistent among the different VMs, without the need for the guests to have backup agents installed. Windows software and services that support VSS include Windows Backup, Hyper-V, Virtual Server, Active Directory, SQL Server, Exchange Server and SharePoint.

The end result is similar to a versioning file system, allowing any file to be retrieved as it existed at the time any of the snapshots was made. Unlike a true versioning file system, however, users cannot trigger the creation of new versions of an individual file, only the entire volume. As a side-effect, whereas the owner of a file can create new versions in a versioning file system, only a system administrator or a backup operator can create new snapshots (or control when new snapshots are taken), because this requires control of the entire volume rather than an individual file. Also, many versioning file systems (such as the one in VMS) implicitly save a version of files each time they are changed; systems using a snapshotting approach like Windows only capture the state periodically.


Windows XP and Server 2003[edit]

Volume Snapshot Service was first added to Microsoft Windows in Windows XP. It can only create temporary snapshots, used for accessing stable on-disk version of files that are opened for editing (and therefore locked). This version of VSS is used by NTBackup.

The creation of persistent snapshots (which remain available across reboots until specifically deleted) has been added in Windows Server 2003, allowing up to 512 snapshots to exist simultaneously for the same volume. In Windows Server 2003, VSS is used to create incremental periodic snapshots of data of changed files over time. A maximum of 64 snapshots are stored on the server and are accessible to clients over the network. This feature is known as Shadow Copies for Shared Folders and is designed for a client–server model.[3] Its client component is included with Windows XP SP2 or later, and is available for installation on Windows 2000 SP3 or later, as well as Windows XP RTM or SP1.[4]

Windows XP[5] and later include a command line utility called vssadmin that can list, create or delete volume shadow copies and list installed shadow copy writers and providers.[6]

Windows Vista, 7 and Server 2008[edit]

A number of Microsoft Windows components have been updated to make use of Shadow Copy. Backup and Restore in Windows Vista, Windows Server 2008, Windows 7 and Windows Server 2008 R2 use shadow copies of files in both file-based and sector-by-sector backup. VSS is also used by the System Protection component which creates and maintains periodic copies of system and user data on the same local volume (similar to the Shadow Copies for Shared Folders feature in Windows Server) but allows it to be locally accessed by System Restore.

System Restore allows reverting to an entire previous set of shadow copies called a restore point. Prior to Windows Vista, System Restore was based on a file-based filter that watched changes for a certain set of file extensions, and then copied files before they were overwritten.[7][8][9] In addition, a part of Windows Explorer called Previous Versions allows restoring individual files or folders locally from restore points as they existed at the time of the snapshot, thus retrieving an earlier version of a file or recovering a file deleted by mistake. Finally, Windows Server 2008 introduces the diskshadow utility which exposes VSS functionality through 20 different commands.[10]

Shadow copies are created automatically once per day, or manually when triggered by the backup utility or installer applications which create a restore point.[11][12] The "Previous Versions" feature is available in the Business, Enterprise, and Ultimate editions of Windows Vista[13] and in all Windows 7 editions. The Home Editions of Vista lack the "Previous Versions" feature, even though the Volume Snapshot Service is included and running. Using third party tools it is still possible to restore previous versions of files on the local volume.[14] Some of these tools also allow users to schedule snapshots at user-defined intervals, configure the storage used by volume shadow copies and compare files or directories from different points-in-time using snapshots.[15] Windows 7 also adds native support through a GUI to configure the storage used by volume shadow copies.

Windows 8 and Server 2012[edit]

On Windows 8 persistent shadow copies are no longer available. Therefore the ability to browse, search and/or recover older versions of files via the Previous Versions tab of the Properties dialog of files was removed for local volumes. The feature is still available in Windows Server 2012.[16]

Samba Server[edit]

Samba on Linux is capable of providing Shadow Copy Service on an LVM-backed storage.[17]


While the different NTFS versions have a certain degree of both forward and backward compatibility, there are certain issues when mounting newer NTFS volumes containing persistent shadow copies in older versions of Windows. This affects dual-booting, and external portable hard drives. Specifically, the persistent shadow copies created by Windows Vista on an NTFS volume are deleted when Windows XP or Windows Server 2003 mount that NTFS volume. This happens because the older operating system does not understand the newer format of persistent shadow copies.[18] Likewise, System Restore snapshots created by Windows 8 are deleted if they are exposed by a previous version of Windows.[19]

See also[edit]


  1. ^ a b "Volume Snapshot Service (VSS)". Glossary. Symantec. Retrieved 2 May 2013. 
  2. ^ a b c d "Volume Shadow Copy Service Overview". MSDN Library. Microsoft. 5 November 2012. Retrieved 2 May 2013. 
  3. ^ "Shadow Copy Client Download". TechNet. Microsoft. Retrieved 21 October 2014. 
  4. ^ Oltean, Adi (December 17, 2004). "Tips for deploying Shadow copies [sic] for Shared Folders". Antimail. Microsoft. Retrieved 2009-04-21. 
  5. ^ "Volume Shadow Copy Service". MSDN. Microsoft. Retrieved 31 May 2013. 
  6. ^ "Vssadmin". Windows Server 2008 and Windows Server 2008 R2 documentations. TechNet Library. Microsoft. 28 September 2007. Windows Server Commands, References, and Tools. Retrieved 27 March 2012. 
  7. ^ Russinovich, Mark E.; Solomon, David A. (2005). Microsoft Windows Internals: Microsoft Windows Server 2003, Windows XP, and Windows 2000 (4 ed.). Redmond, WA: Microsoft Press. pp. 706–711. ISBN 0-7356-1917-4. 
  8. ^ "Windows Backup". Windows Vista portal. Microsoft. Archived from the original on 10 May 2007. Retrieved 11 January 2014. 
  9. ^ Fok, Christine (September 2007). "A Guide to Windows Vista Backup Technologies". TechNet Magazine (Microsoft). Retrieved 11 January 2014. 
  10. ^ "Diskshadow". Windows Server 2008 and Windows Server 2008 R2 documentations. TechNet Library. Microsoft Corporation. 28 September 2007. Windows Server Commands, References, and Tools. Retrieved 27 March 2012. 
  11. ^ "Selected Scenarios for Maintaining Data Integrity with Windows Vista". TechNet. Microsoft Corporation. 
  12. ^ "A Guide to Windows Vista Backup Technologies". Microsoft. 
  13. ^ "Volume Shadow Copy and "Previous Versions" feature in Windows Vista". Microsoft Corporation. 
  14. ^ ShadowExplorer allows restoring lost or altered files
  15. ^ TimeTraveler adds a timeline to Windows Explorer allowing the user to open, restore or compare files or directories from points-in-time
  16. ^ "Previous versions UI removed for local volumes (Windows)". Retrieved 17 Nov 2012. 
  17. ^ "Samba HOWTO Collection, Part III. Advanced Configuration". Retrieved 2012-10-02. 
  18. ^ "How restore points and other recovery features in Windows Vista are affected when you dual-boot with Windows XP". File Cabinet Blog. Microsoft. July 14, 2006. Retrieved 2007-03-21. 
  19. ^ "Calling SRSetRestorePoint". MSDN Library. Microsoft. Retrieved 2015-02-01. Snapshots of the boot volume created by System Restore running on Windows 8 may be deleted if the snapshot is subsequently exposed by an earlier version of Windows. 

Further reading[edit]