SHADOW COPY VOLUMES
Windows 2003 introduced a new feature named Shadow Copy Volumes,
which is a great addition to a typical backup strategy. Windows
2003 has plenty of new, and perhaps more mentionable features,
Shadow Copy Volumes is definitely one of the 'coolest'. The
main advantage compared to regular backups, is that users
can restore files without the help of a system administrator.
Shadow Copy Volumes provides an efficient method of creating
backups of files and folders in shares, by creating
a "point-in-time" copy of changed files on a periodic
basis. When possible only the changes of the file are copied,
some applications rewrite the entire file when it is modified
and saved, forcing the entire file to be included in the Shadow
Copy Volume. Shadow Copy Volumes is
not an alternative to regular backup solutions such as tape
backups. It is an additional method to be prepared to recover
from the following, usually smaller disasters:
- When a user accidentally deletes a file
from a share. In this case the Shadow Copies act like a
'Recycle Bin for shared folders'.
- When a user incorrectly modified a file.
A common situation is that a user uses an existing document
as a template but does not use the Save As option and overwrites
- When a file is corrupted beyond repair.
Although it is not meant to be used to archive
data, users can use shadow copies to compare documents with
older version to see what has changed.
A regular restore from tape media can literally take days.
In a larger organizations, a user would have to contact the
support department to request the restore, and when the system
administrator has time he or she will have to look up the
tape and restore the file. Shadow Copy Volumes can actually
save a lot of precious time of both users and IT personnel.
Configuring Shadow Copies
Shadow copies can be enabled though the Shadow Copies tab
of the Local Disk Properties of an NTFS volume. Although
it creates copies of data in shared folders only, it has to
be enabled for the entire volume and the same settings apply
to all shared folders on that volume. As you can see in the
following picture, you can change the Shadow Copies settings
for any disk on the Shadow Copies tab.
You can enable Shadow Copies for a particular volume by selecting
it and pressing the Enable button. This will enable Shadow
Copies with the following default settings:
- The storage area for the shadow copies
is located on the same volume as for which Shadow Copies
- The minimum assigned disk space is always
100MB, the maximum limit is set to 10% of the disk size
- The default schedule is set to create
a shadow copy twice a day, on Monday through Friday, at
7 AM in the morning and 12 PM in the afternoon.
As shown in the picture below, as soon as
you enable Shadow Copies, the first copy is created.
The default settings are not suitable for most servers, because
the storage area for the shadow copies is located on the same
volume as for which Shadow Copies is enabled. If you're running
Windows 2003 on a server with a hardware based RAID set, you
usually don't have to worry about the location of the storage
area. But on a server with several separate hard disks you
should set the location of the storage area for the shadow
copies to be another physical disk. On servers with high I/O
load this can make a huge difference in performance. Because
you cannot change the location when shadow copies are created
already, it is most efficient to configure the settings before
you click the Enable button. If you do want to change the
location of the storage area, you will have to delete all
shadow copies for that volume.
The minimum required free disk space to enable shadow copies
is 100MB. The maximum size for the storage area needs to be
carefully considered, especially when you set a limit. When
the limit is reached the oldest shadow copy will be deleted.
If you set the limit to low, users might not have the amount
of shadow copies available they expect. You can change the
limit for the storage area size at anytime. The Details button
allows you to view the current used disk space.
The maximum number of shadow copies is 64 per volume. If 64
shadow copies are created before the maximum size limit is
reached or before the disk is full, the oldest shadow copy
will be deleted before a new one is created. This is important
to keep in mind especially when you configure the schedule.
For example, if you would schedule a shadow copy to be created
each hour of the day, a user would be able to restore files
from 64 hours ago maximum. The following dialog box will open
when you click the Schedule button:
There are many options available to configure the schedule.
The task of creating the Shadow copies can be scheduled at
certain times, dates and events. Examples of these events
are a user logon or system startup. The default schedule settings
contain two schedules, one for 7 AM in the morning and one
for 12 PM in the afternoon. Instead of creating multiple schedules,
you can also repeat the task from one schedule multiple times
through the Advanced button. The advanced options also allow
you to specify start and end dates for a particular schedule.
To determine the best suitable schedule settings for a particular
volume, it is necessary to find out how frequently files are
Restoring Shadow Copies
To be able to restore shadow copies, users need special client
software. Windows 2003 includes the client natively, but on
clients running Windows 98, Windows 2000, and XP you need
to install the client software, which can be downloaded here.
If you run Windows 2000 you need to have at least Service
Pack 3 installed. The client for Windows XP is also available
in the X:\WINDOWS\system32\clients\twclient folder on a Windows
A user can access shadow copies through the Previous Versions
tab of the Properties of files and folders inside the share.
The Previous Versions tab shows the shadow copies including
the date and time they are created.
Users are able to view the contents of files and folders before
they restore it, but the files cannot be edited. To restore
a shadow copy of a file or folder, select it and click the
Restore button. When you restore a file the shadow copy will
be deleted, if you do not want to have the shadow copy deleted
and the original file not overwritten, use the Copy button
to restore the file instead.
If you are working locally on a Windows 2003 server and want
to access shadow copies on the same server, you can access
the Previous Version tab of files and folders by typing \\localhost\X$
(where X is the volume where the shared folders are located)
in the address bar of My Computer or Explorer. This is required
because the Previous Versions tab is on the shared folder's
Properties, not on the local folder's Properties.
Windows XP and Windows 2003 include the command-line utility
Vssadmin, which can be used to administer
Shadow Copies. The Windows XP version supports only a couple
of parameters mainly to display information about current
shadow copies. The version of vssadmin included in Windows
2003 provides many additional options allowing you to perform
the same tasks as on the Shadow Copies tab of the Local Disk
Properties. Vssadmin is particulary useful when you want to
script the configuration of several servers.