I’m sure we can all think of occasions when we have inadvertently amended, or deleted, a crucial file containing that important report or spreadsheet. The pain experienced at losing important documents is only compounded when we discover the file is not on a backup – or that it may be a file created since the last backup was taken. Volume Shadow copy Services (VSS) is a new feature aimed at reducing the “D’oh” factor out of accidental file deletions or modifications. VSS allows the administrator to make a point-in-time copy (or snapshot) of a disk volume (I will use the term snapshot and shadow copy interchangeably). Currently, these shadow copies are read-only images of the disk at the time the copy was taken and can be accessed as a normal folder. The shadow copies are available for the user to copy files back to a writeable folder. Enabling VSS
VSS operates at the volume level. You can enable Volume Shadow copy in a number of ways. We will use the GUI here, although you can use the vssadmin command line (more on that later). Open up Computer Management and right-click the volume you want to enable in the right-hand pane and select Properties. Then select the Shadow Copies tab. Alternatively, right click Shared Folders in the right-hand pane and select All Tasks, Configure Shadow Copies. Either method will display the dialog box shown in figure 1. Select the volume on which to enable VSS and click the Enable button. An initial snapshot will be created and a minimum of 100MB is set-aside on the volume for VSS. By default Windows creates two schedules, one at 07:00 each weekday and one at 12:00 each weekday for automatic snapshot creation. Click on the Settings button to change the options for VSS on the volume. You can configure both the maximum space to set-aside for VSS copies (which does not have to be on the volume itself) and the schedule on which the VSS copies will be taken. A default 10%, or minimum 100MB, will automatically be reserved for VSS. Scheduling can be made as complex as you choose simply by adding additional schedules. You do need to be aware that snapshot creation takes up physical space on your volume. So, for example, taking snapshots too frequently on an active volume could mean you have more snapshots than actual data! Also, you are currently limited to 64 snapshots per volume, so taking copies too frequently could negate the benefit of having the snapshot function and mean you can’t go back to a useful copy of a file. Before we can use VSS, we need to perform one other task and that is to install the client software required to access our snapshot copies. By default, the VSS client is available on the Windows 2003 Server at \\%systemroot%\system32\clients\twclient However, this client works with only Windows 2003 Server and XP. To get a client version for previous Operating Systems, go to http://www.microsoft.com/downloads/details.aspx?familyid=E382358F-33C3-4DE7-ACD8-A33AC92D295E&displaylang=en and download the client for your operating system. To restore from a shadow copy, right-click the network share of the volume and select Properties and the Previous Versions tab. Note that if you are on the server you must access the volume via the network share. See figure 2 for an example of the screen. You can now select the snapshot for the date you wish to restore. The restore options allow you to view the snapshot contents and select individual files for restore, copy the whole snapshot to a new location or restore the snapshot over the original directory. View opens another window to browse the snapshot contents. Copy requests a target destination for the snapshot. I recommend you think very carefully before performing a complete restore of a drive, as this may destroy the data of any users currently accessing the volume. As a simple test, I created a new disk volume of 6110MB. An initial shadow copy was created, taking 100MB. A maximum of 611MB (or 10%) of the disk size was established for shadow copies. I created a 10.5MB test file and took another shadow copy. This increased the VSC space by 2MB to 102MB. Next I edited the test file and changed 1 character of the 10.5MB then took another Shadow copy. This increased the VSS space to 113MB. It is clear that the shadow copy records a copy of the whole file in this instance even if a single character of a file is changed. VSS does operate at the block level, however it depends on how the application has written the file back to disk. It Gets Better
VSS seems like a great solution for recovering lost or amended files and is perfect for end-user data. But what about server applications that may also be accessing a volume? Most applications such as SQL Server or Exchange Server will buffer data and write this out periodically for performance reasons. This causes issues with snapshot technologies, as there is no guarantee of consistency of application data. To overcome this problem, Microsoft has introduced two new features with VSS - writers and providers. A writer is an application such as Exchange Server, capable of accepting requests to clear buffers and quiesce I/O activity without stopping the application. When a shadow copy is created, Windows can request a writer to freeze I/O activity for the duration of the shadow copy process. Once the shadow copy is taken, Windows unfreezes the writer and I/O proceeds as normal. This method ensures that the shadow copy is consistent from the application perspective. There are a number of standard writers available with Windows 2003, including the event log and registry writers. A great way of viewing the writers is with the command line utility vssadmin, the command line interface for VSS. Use the command vssadmin list writers to obtain a list of the available writers for your server. An extract from the output of this command is shown below.
C:\Documents and Settings\Administrator>vssadmin list writers
vssadmin 1.1 - Volume Shadow Copy Service administrative command-line tool
(C) Copyright 2001 Microsoft Corp.

Writer name: 'System Writer' Writer Id: {e8132975-6f93-4464-a53e-1050253ae220} Writer Instance Id: {dfb34c17-8967-4fa1-86a8-53f0e82504f6} State: [1] Stable Last error: No error
A provider is a system resource capable of making a shadow copy. Microsoft provides a standard provider with Windows Server 2003. Use the vssadmin list providers command to display available providers;
C:\Documents and Settings\Administrator>vssadmin list providers
vssadmin 1.1 - Volume Shadow Copy Service administrative command-line tool
(C) Copyright 2001 Microsoft Corp.


Provider name: 'Microsoft Software Shadow Copy provider 1.0'
   Provider type: System
   Provider Id: {b5946137-7b9f-4925-af80-51abd60b20d5}
Microsoft expects hardware vendors to write provider software for use with their disk subsystems. For example, EMC have the Timefinder product and HDS have Shadow Image, both of which could act as VSS providers. Going further with VSSADMIN
We’ve seen how vssadmin can be used to display information on providers and writers. It is also possible to use the command to display other information about VSS configuration. The vssadmin commands are:
vssadmin add shadowstorage Enables VSS for a volume
vssadmin create shadow Creates a shadow copy for a volume
vssadmin delete shadows Deletes shadow copies for a volume
vssadmin delete shadowstorage Disables VSS for a volume
vssadmin list providers List VSS providers
vssadmin list shadows List Shadow copies
vssadmin list shadowstorage List storage enabled for VSS
vssadmin list volumes List volumes enabled for VSS
vssadmin list writers List VSS writers
vssadmin resize shadowstorage Resize the space set aside for VSS
The command line options provide the same functionality as the GUI and in some instances additional information not provided by the GUI, such as details on providers and writers. Summary
Consider the following points when configuring VSS.
  • Enable shadow copies to write to a separate volume. This helps to improve performance and makes management easier.
  • Do not run shadow copy too frequently. Microsoft recommends not more than once per hour. Consider an hourly snapshot with daily snapshots combined.
VSS provides an excellent way to retrieve accidentally deleted or modified files without resorting to backups. It also provides application-integrated functionality that ensures point-in-time copies are taken consistently. VSS can be provided to the end user to reduce the burden of management on the Administrator. The use of providers and writers enables consistency in application backups and integration with disk vendor hardware.