Volume Shadow Copy Service
Encyclopedia
Shadow Copy is a technology included in Microsoft Windows
that allows taking manual or automatic backup copies or snapshots
of data, even if it has a lock
, on a specific volume
at a specific point in time over regular intervals. It is implemented as a Windows service
called the Volume Shadow Copy service. A software VSS provider service is also included as part of Windows to be used by Windows applications. Shadow Copy technology requires the file system to be NTFS
to be able to create and store shadow copies. Shadow Copies can be created on local and external (removable or network) volumes by any Windows component that uses this technology, such as when creating a scheduled Windows Backup or automatic System Restore
point.
of the file system.
Snapshots have two primary purposes: they allow the creation of consistent backups of a volume, ensuring that the contents cannot change while the backup is being made; and they avoid problems with file locking
. By creating a read-only copy of the volume, backup programs are able to access every file without interfering with other programs writing to those same files.
The data copy process can be handled by the file system or by specialized hardware; in the latter case a hardware VSS provider abstracts the functionality to the operating system. Applications can provide specific support for VSS through VSS writers which control how data is set to a consistent state at the beginning of a VSS operation and maintain that consistency throughout the process, among other functions.
Through the integration between the Volume Shadow Copy Service, hardware or software VSS providers, application level writers and backup applications, VSS enables integral backups that are point in time and application level consistent without the backup tool having knowledge about the internals of each application. For example, in a virtualization product such as Virtual Server 2005 R2 SP1 or Hyper-V in Windows Server 2008, a whole backup of an environment including several virtual machines can be created in a single operation, and the backups produced for the different VSS compatible guests in the system are transactionally consistent at the guest application level and point in time consistent among the different VMs, without the need for the guests to have backup agents installed. Windows Server applications and services that support VSS include Windows Server Backup, Hyper-V
, Virtual Server
, Active Directory
, SQL Server
, Microsoft Exchange
, and other Microsoft and third-party solutions such as Cobian Backup
.
The end result is similar to a versioning file system
, allowing any file to be retrieved as it existed at the time any of the snapshots was made. Unlike a true versioning file system, however, users cannot trigger the creation of new versions of an individual file, only the entire volume. As a side-effect, whereas the owner of a file can create new versions in a versioning file system, only a system administrator
or a backup operator can create new snapshots (or control when new snapshots are taken), because this requires control of the entire volume rather than an individual file. Also, many versioning file systems (such as the one in VMS
) implicitly save a version of files each time they are changed; systems using a snapshotting approach like Windows only capture the state periodically.
; this version of VSS is used by NTBackup
, however it can only create non-persistent snapshots (a temporary snapshot, usually used for creating a file-based backup or more generally, accessing copies of files that have been locked by applications for editing); therefore NTBackup uses a proprietary BKF file format to store the shadow copies permanently.
The creation of persistent snapshots (multiple snapshots which remain available across reboots until specifically deleted from the system) has been added in Windows Server 2003
, allowing up to 512 snapshots to exist simultaneously for the same volume. In Windows Server 2003, VSS is therefore used to create incremental periodic snapshots of data or deltas (differences) of changed files over time. A maximum of 64 snapshots is stored on the server and accessible by clients or on the same server through network shares. This feature is known as Shadow copies for Shared Folders and is designed for a client–server model. The Shadow copies for Shared Folders client is required to be installed on Windows 2000
and Windows XP
RTM and SP1. A copy of this client for 32-bit Windows platforms is available on the server or downloadable from Microsoft. It is built into the OS beginning with Windows XP SP2.
ShadowConnect, a client for Macintosh
computers accessing Windows servers, is available from a third-party.
in Windows Vista and later operating systems performs block-based backups when doing full system backups. The file backup feature also uses shadow copy but stores files inside ZIP files.
Beginning with Windows Vista
, VSS is also used by the System Protection component which creates and maintains periodic copies of system and user data on the same local volume (similar to the Shadow Copies for Shared Folders feature in Windows Server) but allows it to be locally accessed by System Restore
. System Restore
allows reverting to an entire previous set of shadow copies called a Restore point. Prior to Windows Vista, System Restore
was based on a file-based filter that watched changes for a certain set of file extensions, and then copied files before they were overwritten.
Additionally, a property sheet shell extension called Previous Versions allows restoring individual files or folders locally from the restore point, as they existed at the time of the snapshot, thus retrieving an earlier version of a file or recovering a file deleted by mistake.
The shadow copy is not created every time a file is changed; backup copies are created automatically once per day, or manually when triggered by the backup utility or installer applications which create a restore point. The "Previous Versions" feature is available in the Business, Enterprise, and Ultimate editions of Windows Vista
and in all Windows 7 editions. The Home Editions of Vista lack the "Previous Versions" feature, even though the Volume Snapshot Service is included and running. Using third party tools it is still possible to restore previous versions of files on the local volume. Some of these tools also allow users to schedule snapshots at user-defined intervals, configure the storage used by volume shadow copies and compare files or directories from different points-in-time using snapshots. Windows 7 also adds native support through a GUI to configure the storage used by volume shadow copies.
versions have a certain degree of both forward
and backward compatibility
, there are certain issues when mounting newer NTFS volumes containing persistent shadow copies in older versions of Windows, prior to Windows Vista. This affects dual-booting, and external portable hard drives. Specifically, the shadow copies on an NTFS volume are deleted when the older operating system mounts that NTFS volume. This happens because the older operating system does not understand the newer format of persistent shadow copies.
vssadmin list providers
The following command creates a new Volume Shadow Copy for volume C: :
vssadmin create shadow /for=c:
Microsoft Windows
Microsoft Windows is a series of operating systems produced by Microsoft.Microsoft introduced an operating environment named Windows on November 20, 1985 as an add-on to MS-DOS in response to the growing interest in graphical user interfaces . Microsoft Windows came to dominate the world's personal...
that allows taking manual or automatic backup copies or snapshots
Snapshot (computer storage)
In computer systems, a snapshot is the state of a system at a particular point in time. The term was coined as an analogy to that in photography. It can refer to an actual copy of the state of a system or to a capability provided by certain systems....
of data, even if it has a lock
File locking
File locking is a mechanism that restricts access to a computer file by allowing only one user or process access at any specific time. Systems implement locking to prevent the classic interceding update scenario ....
, on a specific volume
Volume (computing)
In the context of computer operating systems, volume is the term used to describe a single accessible storage area with a single file system, typically resident on a single partition of a hard disk. Similarly, it refers to the logical interface used by an operating system to access data stored on...
at a specific point in time over regular intervals. It is implemented as a Windows service
Windows Service
On Microsoft Windows operating systems, a Windows service is a long-running executable that performs specific functions and which is designed not to require user intervention. Windows services can be configured to start when the operating system is booted and run in the background as long as...
called the Volume Shadow Copy service. A software VSS provider service is also included as part of Windows to be used by Windows applications. Shadow Copy technology requires the file system to be NTFS
NTFS
NTFS is the standard file system of Windows NT, including its later versions Windows 2000, Windows XP, Windows Server 2003, Windows Server 2008, Windows Vista, and Windows 7....
to be able to create and store shadow copies. Shadow Copies can be created on local and external (removable or network) volumes by any Windows component that uses this technology, such as when creating a scheduled Windows Backup or automatic System Restore
System Restore
System Restore is a component of Microsoft's Windows Me, Windows XP, Windows Vista and Windows 7, but not Windows 2000, operating systems that allows for the rolling back of system files, registry keys, installed programs, etc., to a previous state in the event of system malfunction or failure.The...
point.
Overview
VSS operates at the block levelBlock (data storage)
In computing , a block is a sequence of bytes or bits, having a nominal length . Data thus structured are said to be blocked. The process of putting data into blocks is called blocking. Blocking is used to facilitate the handling of the data-stream by the computer program receiving the data...
of the file system.
Snapshots have two primary purposes: they allow the creation of consistent backups of a volume, ensuring that the contents cannot change while the backup is being made; and they avoid problems with file locking
File locking
File locking is a mechanism that restricts access to a computer file by allowing only one user or process access at any specific time. Systems implement locking to prevent the classic interceding update scenario ....
. By creating a read-only copy of the volume, backup programs are able to access every file without interfering with other programs writing to those same files.
The data copy process can be handled by the file system or by specialized hardware; in the latter case a hardware VSS provider abstracts the functionality to the operating system. Applications can provide specific support for VSS through VSS writers which control how data is set to a consistent state at the beginning of a VSS operation and maintain that consistency throughout the process, among other functions.
Through the integration between the Volume Shadow Copy Service, hardware or software VSS providers, application level writers and backup applications, VSS enables integral backups that are point in time and application level consistent without the backup tool having knowledge about the internals of each application. For example, in a virtualization product such as Virtual Server 2005 R2 SP1 or Hyper-V in Windows Server 2008, a whole backup of an environment including several virtual machines can be created in a single operation, and the backups produced for the different VSS compatible guests in the system are transactionally consistent at the guest application level and point in time consistent among the different VMs, without the need for the guests to have backup agents installed. Windows Server applications and services that support VSS include Windows Server Backup, Hyper-V
Hyper-V
Microsoft Hyper-V, codenamed Viridian and formerly known as Windows Server Virtualization, is a hypervisor-based virtualization system for x86-64 systems. A beta version of Hyper-V was shipped with certain x86-64 editions of Windows Server 2008, and the finalized version was released on June 26,...
, Virtual Server
Microsoft Virtual Server
Microsoft Virtual Server is a virtualization solution that facilitates the creation of virtual machines on the Windows XP, Windows Vista and Windows Server 2003 operating systems. Originally developed by Connectix, it was acquired by Microsoft prior to release...
, Active Directory
Active Directory
Active Directory is a directory service created by Microsoft for Windows domain networks. It is included in most Windows Server operating systems. Server computers on which Active Directory is running are called domain controllers....
, SQL Server
Microsoft SQL Server
Microsoft SQL Server is a relational database server, developed by Microsoft: It is a software product whose primary function is to store and retrieve data as requested by other software applications, be it those on the same computer or those running on another computer across a network...
, Microsoft Exchange
Microsoft Exchange Server
Microsoft Exchange Server is the server side of a client–server, collaborative application product developed by Microsoft. It is part of the Microsoft Servers line of server products and is used by enterprises using Microsoft infrastructure products...
, and other Microsoft and third-party solutions such as Cobian Backup
Cobian Backup
Cobian Backup is free, donation-supported backup software for Microsoft Windows. It is written in Delphi by Luis Cobian of Umea University. -History:Cobian Backup was originally released in 2000. The program was later rewritten and released under version 7....
.
The end result is similar to a versioning file system
Versioning file system
A versioning file system is any computer file system which allows a computer file to exist in several versions at the same time. Thus it is a form of revision control. Most common versioning file systems keep a number of old copies of the file. Some limit the number of changes per minute or per...
, allowing any file to be retrieved as it existed at the time any of the snapshots was made. Unlike a true versioning file system, however, users cannot trigger the creation of new versions of an individual file, only the entire volume. As a side-effect, whereas the owner of a file can create new versions in a versioning file system, only a system administrator
System administrator
A system administrator, IT systems administrator, systems administrator, or sysadmin is a person employed to maintain and operate a computer system and/or network...
or a backup operator can create new snapshots (or control when new snapshots are taken), because this requires control of the entire volume rather than an individual file. Also, many versioning file systems (such as the one in VMS
OpenVMS
OpenVMS , previously known as VAX-11/VMS, VAX/VMS or VMS, is a computer server operating system that runs on VAX, Alpha and Itanium-based families of computers. Contrary to what its name suggests, OpenVMS is not open source software; however, the source listings are available for purchase...
) implicitly save a version of files each time they are changed; systems using a snapshotting approach like Windows only capture the state periodically.
Windows XP and Windows Server 2003
The Volume Snapshot Service was first added to Microsoft Windows in Windows XPWindows XP
Windows XP is an operating system produced by Microsoft for use on personal computers, including home and business desktops, laptops and media centers. First released to computer manufacturers on August 24, 2001, it is the second most popular version of Windows, based on installed user base...
; this version of VSS is used by NTBackup
NTBackup
NTBackup is the built-in backup application introduced in Windows NT around 1997 and part of all subsequent versions up to and including Windows 2000, Windows XP and Windows Server 2003. It uses a proprietary backup format to back up files. Files can be backed up to tape, ZIP drives, floppy...
, however it can only create non-persistent snapshots (a temporary snapshot, usually used for creating a file-based backup or more generally, accessing copies of files that have been locked by applications for editing); therefore NTBackup uses a proprietary BKF file format to store the shadow copies permanently.
The creation of persistent snapshots (multiple snapshots which remain available across reboots until specifically deleted from the system) has been added in Windows Server 2003
Windows Server 2003
Windows Server 2003 is a server operating system produced by Microsoft, introduced on 24 April 2003. An updated version, Windows Server 2003 R2, was released to manufacturing on 6 December 2005...
, allowing up to 512 snapshots to exist simultaneously for the same volume. In Windows Server 2003, VSS is therefore used to create incremental periodic snapshots of data or deltas (differences) of changed files over time. A maximum of 64 snapshots is stored on the server and accessible by clients or on the same server through network shares. This feature is known as Shadow copies for Shared Folders and is designed for a client–server model. The Shadow copies for Shared Folders client is required to be installed on Windows 2000
Windows 2000
Windows 2000 is a line of operating systems produced by Microsoft for use on personal computers, business desktops, laptops, and servers. Windows 2000 was released to manufacturing on 15 December 1999 and launched to retail on 17 February 2000. It is the successor to Windows NT 4.0, and is the...
and Windows XP
Windows XP
Windows XP is an operating system produced by Microsoft for use on personal computers, including home and business desktops, laptops and media centers. First released to computer manufacturers on August 24, 2001, it is the second most popular version of Windows, based on installed user base...
RTM and SP1. A copy of this client for 32-bit Windows platforms is available on the server or downloadable from Microsoft. It is built into the OS beginning with Windows XP SP2.
ShadowConnect, a client for Macintosh
Macintosh
The Macintosh , or Mac, is a series of several lines of personal computers designed, developed, and marketed by Apple Inc. The first Macintosh was introduced by Apple's then-chairman Steve Jobs on January 24, 1984; it was the first commercially successful personal computer to feature a mouse and a...
computers accessing Windows servers, is available from a third-party.
Windows Vista and later
A number of Microsoft Windows components have been updated to make use of Shadow Copy. The Backup and Restore CenterBackup and Restore Center
Backup and Restore is a component of Microsoft Windows introduced in Windows Vista and included in later versions that allows users to create backup. It is a replacement of NTBackup, which was included in previous Windows versions.-Features:There are two different types of backup supported: File...
in Windows Vista and later operating systems performs block-based backups when doing full system backups. The file backup feature also uses shadow copy but stores files inside ZIP files.
Beginning with Windows Vista
Windows Vista
Windows Vista is an operating system released in several variations developed by Microsoft for use on personal computers, including home and business desktops, laptops, tablet PCs, and media center PCs...
, VSS is also used by the System Protection component which creates and maintains periodic copies of system and user data on the same local volume (similar to the Shadow Copies for Shared Folders feature in Windows Server) but allows it to be locally accessed by System Restore
System Restore
System Restore is a component of Microsoft's Windows Me, Windows XP, Windows Vista and Windows 7, but not Windows 2000, operating systems that allows for the rolling back of system files, registry keys, installed programs, etc., to a previous state in the event of system malfunction or failure.The...
. System Restore
System Restore
System Restore is a component of Microsoft's Windows Me, Windows XP, Windows Vista and Windows 7, but not Windows 2000, operating systems that allows for the rolling back of system files, registry keys, installed programs, etc., to a previous state in the event of system malfunction or failure.The...
allows reverting to an entire previous set of shadow copies called a Restore point. Prior to Windows Vista, System Restore
System Restore
System Restore is a component of Microsoft's Windows Me, Windows XP, Windows Vista and Windows 7, but not Windows 2000, operating systems that allows for the rolling back of system files, registry keys, installed programs, etc., to a previous state in the event of system malfunction or failure.The...
was based on a file-based filter that watched changes for a certain set of file extensions, and then copied files before they were overwritten.
Additionally, a property sheet shell extension called Previous Versions allows restoring individual files or folders locally from the restore point, as they existed at the time of the snapshot, thus retrieving an earlier version of a file or recovering a file deleted by mistake.
The shadow copy is not created every time a file is changed; backup copies are created automatically once per day, or manually when triggered by the backup utility or installer applications which create a restore point. The "Previous Versions" feature is available in the Business, Enterprise, and Ultimate editions of Windows Vista
Windows Vista editions
Windows Vista is available in six different marketing editions. With the exception of Windows Vista Starter, all editions support both 32-bit and 64-bit processor architectures....
and in all Windows 7 editions. The Home Editions of Vista lack the "Previous Versions" feature, even though the Volume Snapshot Service is included and running. Using third party tools it is still possible to restore previous versions of files on the local volume. Some of these tools also allow users to schedule snapshots at user-defined intervals, configure the storage used by volume shadow copies and compare files or directories from different points-in-time using snapshots. Windows 7 also adds native support through a GUI to configure the storage used by volume shadow copies.
NTFS forward compatibility
While the different NTFSNTFS
NTFS is the standard file system of Windows NT, including its later versions Windows 2000, Windows XP, Windows Server 2003, Windows Server 2008, Windows Vista, and Windows 7....
versions have a certain degree of both forward
Forward compatibility
Forward compatibility or upward compatibility is a compatibility concept for systems design, as e.g. backward compatibility. Forward compatibility aims at the ability of a design to gracefully accept input intended for later versions of itself...
and backward compatibility
Backward compatibility
In the context of telecommunications and computing, a device or technology is said to be backward or downward compatible if it can work with input generated by an older device...
, there are certain issues when mounting newer NTFS volumes containing persistent shadow copies in older versions of Windows, prior to Windows Vista. This affects dual-booting, and external portable hard drives. Specifically, the shadow copies on an NTFS volume are deleted when the older operating system mounts that NTFS volume. This happens because the older operating system does not understand the newer format of persistent shadow copies.
Command line interface
Windows XP and later also include a command line utility calledvssadmin that can manipulate current volume shadow copy backups and all installed shadow copy writers and providers. Additionally, Windows Server 2008 introduces the diskshadow utility which makes it possible to script VSS operations Example
The following command displays all installed volume shadow copy providers:vssadmin list providers
The following command creates a new Volume Shadow Copy for volume C: :
vssadmin create shadow /for=c:
See also
- List of Microsoft Windows components
- Snapshot (computer storage)Snapshot (computer storage)In computer systems, a snapshot is the state of a system at a particular point in time. The term was coined as an analogy to that in photography. It can refer to an actual copy of the state of a system or to a capability provided by certain systems....
- Copy-on-writeCopy-on-writeCopy-on-write is an optimization strategy used in computer programming. The fundamental idea is that if multiple callers ask for resources which are initially indistinguishable, they can all be given pointers to the same resource...