SHADOW COPY VOLUMES
Windows 2003 introduced a new feature named Shadow Copy Volumes,
which is a great addition to a typical backup strategy. Windows
2003 has plenty of new, and perhaps more mentionable features, Shadow
Copy Volumes is definitely one of the 'coolest'. The main advantage
compared to regular backups, is that users can restore files without
the help of a system administrator.
Shadow Copy Volumes provides an efficient method of creating backups
of files and folders in shares, by creating a "point-in-time"
copy of changed files on a periodic basis. When possible only the
changes of the file are copied, some applications rewrite the entire
file when it is modified and saved, forcing the entire file to be
included in the Shadow Copy Volume. Shadow
Copy Volumes is not an alternative to regular backup solutions such
as tape backups. It is an additional method to be prepared to recover
from the following, usually smaller disasters:
- When a user accidentally deletes a file from
a share. In this case the Shadow Copies act like a 'Recycle Bin
for shared folders'.
- When a user incorrectly modified a file. A
common situation is that a user uses an existing document as a
template but does not use the Save As option and overwrites the
- When a file is corrupted beyond repair.
Although it is not meant to be used to archive
data, users can use shadow copies to compare documents with older
version to see what has changed.
A regular restore from tape media can literally take days. In a
larger organizations, a user would have to contact the support department
to request the restore, and when the system administrator has time
he or she will have to look up the tape and restore the file. Shadow
Copy Volumes can actually save a lot of precious time of both users
and IT personnel.
Configuring Shadow Copies
Shadow copies can be enabled though the Shadow Copies tab of the
Local Disk Properties of an NTFS volume. Although it creates
copies of data in shared folders only, it has to be enabled for
the entire volume and the same settings apply to all shared folders
on that volume. As you can see in the following picture, you can
change the Shadow Copies settings for any disk on the Shadow Copies
You can enable Shadow Copies for a particular volume by selecting
it and pressing the Enable button. This will enable Shadow Copies
with the following default settings:
- The storage area for the shadow copies is located
on the same volume as for which Shadow Copies is enabled.
- The minimum assigned disk space is always 100MB,
the maximum limit is set to 10% of the disk size by default.
- The default schedule is set to create a shadow
copy twice a day, on Monday through Friday, at 7 AM in the morning
and 12 PM in the afternoon.
As shown in the picture below, as soon as you
enable Shadow Copies, the first copy is created.
The default settings are not suitable for most servers, because
the storage area for the shadow copies is located on the same volume
as for which Shadow Copies is enabled. If you're running Windows
2003 on a server with a hardware based RAID set, you usually don't
have to worry about the location of the storage area. But on a server
with several separate hard disks you should set the location of
the storage area for the shadow copies to be another physical disk.
On servers with high I/O load this can make a huge difference in
performance. Because you cannot change the location when shadow
copies are created already, it is most efficient to configure the
settings before you click the Enable button. If you do want to change
the location of the storage area, you will have to delete all shadow
copies for that volume.
The minimum required free disk space to enable shadow copies is
100MB. The maximum size for the storage area needs to be carefully
considered, especially when you set a limit. When the limit is reached
the oldest shadow copy will be deleted. If you set the limit to
low, users might not have the amount of shadow copies available
they expect. You can change the limit for the storage area size
at anytime. The Details button allows you to view the current used
The maximum number of shadow copies is 64 per volume. If 64 shadow
copies are created before the maximum size limit is reached or before
the disk is full, the oldest shadow copy will be deleted before
a new one is created. This is important to keep in mind especially
when you configure the schedule. For example, if you would schedule
a shadow copy to be created each hour of the day, a user would be
able to restore files from 64 hours ago maximum. The following dialog
box will open when you click the Schedule button:
There are many options available to configure the schedule. The
task of creating the Shadow copies can be scheduled at certain times,
dates and events. Examples of these events are a user logon or system
startup. The default schedule settings contain two schedules, one
for 7 AM in the morning and one for 12 PM in the afternoon. Instead
of creating multiple schedules, you can also repeat the task from
one schedule multiple times through the Advanced button. The advanced
options also allow you to specify start and end dates for a particular
schedule. To determine the best suitable schedule settings for a
particular volume, it is necessary to find out how frequently files
Restoring Shadow Copies
To be able to restore shadow copies, users need special client software.
Windows 2003 includes the client natively, but on clients running
Windows 98, Windows 2000, and XP you need to install the client
software, which can be downloaded here.
If you run Windows 2000 you need to have at least Service Pack 3
installed. The client for Windows XP is also available in the X:\WINDOWS\system32\clients\twclient
folder on a Windows 2003 server.
A user can access shadow copies through the Previous Versions tab
of the Properties of files and folders inside the share. The Previous
Versions tab shows the shadow copies including the date and time
they are created.
Users are able to view the contents of files and folders before
they restore it, but the files cannot be edited. To restore a shadow
copy of a file or folder, select it and click the Restore button.
When you restore a file the shadow copy will be deleted, if you
do not want to have the shadow copy deleted and the original file
not overwritten, use the Copy button to restore the file instead.
If you are working locally on a Windows 2003 server and want to
access shadow copies on the same server, you can access the Previous
Version tab of files and folders by typing \\localhost\X$ (where
X is the volume where the shared folders are located) in the address
bar of My Computer or Explorer. This is required because the Previous
Versions tab is on the shared folder's Properties, not on the local
Windows XP and Windows 2003 include the command-line utility Vssadmin,
which can be used to administer Shadow Copies. The Windows XP version
supports only a couple of parameters mainly to display information
about current shadow copies. The version of vssadmin included in
Windows 2003 provides many additional options allowing you to perform
the same tasks as on the Shadow Copies tab of the Local Disk Properties.
Vssadmin is particulary useful when you want to script the configuration
of several servers.