Members-only Printer-friendly version

SHADOW COPY VOLUMES

Overview

Windows 2003 introduced a new feature named Shadow Copy Volumes, which is a great addition to a typical backup strategy. Windows 2003 has plenty of new, and perhaps more mentionable features, Shadow Copy Volumes is definitely one of the 'coolest'. The main advantage compared to regular backups, is that users can restore files without the help of a system administrator.

Shadow Copy Volumes provides an efficient method of creating backups of files and folders in shares, by creating a "point-in-time" copy of changed files on a periodic basis. When possible only the changes of the file are copied, some applications rewrite the entire file when it is modified and saved, forcing the entire file to be included in the Shadow Copy Volume. Shadow Copy Volumes is not an alternative to regular backup solutions such as tape backups. It is an additional method to be prepared to recover from the following, usually smaller disasters:

• When a user accidentally deletes a file from a share. In this case the Shadow Copies act like a 'Recycle Bin for shared folders'.
• When a user incorrectly modified a file. A common situation is that a user uses an existing document as a template but does not use the Save As option and overwrites the original.
• When a file is corrupted beyond repair.

Although it is not meant to be used to archive data, users can use shadow copies to compare documents with older version to see what has changed.

A regular restore from tape media can literally take days. In a larger organizations, a user would have to contact the support department to request the restore, and when the system administrator has time he or she will have to look up the tape and restore the file. Shadow Copy Volumes can actually save a lot of precious time of both users and IT personnel.


Configuring Shadow Copies

Shadow copies can be enabled though the Shadow Copies tab of the Local Disk Properties of an NTFS volume. Although it creates copies of data in shared folders only, it has to be enabled for the entire volume and the same settings apply to all shared folders on that volume. As you can see in the following picture, you can change the Shadow Copies settings for any disk on the Shadow Copies tab.



You can enable Shadow Copies for a particular volume by selecting it and pressing the Enable button. This will enable Shadow Copies with the following default settings:

• The storage area for the shadow copies is located on the same volume as for which Shadow Copies is enabled.
• The minimum assigned disk space is always 100MB, the maximum limit is set to 10% of the disk size by default.
• The default schedule is set to create a shadow copy twice a day, on Monday through Friday, at 7 AM in the morning and 12 PM in the afternoon.

As shown in the picture below, as soon as you enable Shadow Copies, the first copy is created.




The default settings are not suitable for most servers, because the storage area for the shadow copies is located on the same volume as for which Shadow Copies is enabled. If you're running Windows 2003 on a server with a hardware based RAID set, you usually don't have to worry about the location of the storage area. But on a server with several separate hard disks you should set the location of the storage area for the shadow copies to be another physical disk. On servers with high I/O load this can make a huge difference in performance. Because you cannot change the location when shadow copies are created already, it is most efficient to configure the settings before you click the Enable button. If you do want to change the location of the storage area, you will have to delete all shadow copies for that volume.



The minimum required free disk space to enable shadow copies is 100MB. The maximum size for the storage area needs to be carefully considered, especially when you set a limit. When the limit is reached the oldest shadow copy will be deleted. If you set the limit to low, users might not have the amount of shadow copies available they expect. You can change the limit for the storage area size at anytime. The Details button allows you to view the current used disk space.

The maximum number of shadow copies is 64 per volume. If 64 shadow copies are created before the maximum size limit is reached or before the disk is full, the oldest shadow copy will be deleted before a new one is created. This is important to keep in mind especially when you configure the schedule. For example, if you would schedule a shadow copy to be created each hour of the day, a user would be able to restore files from 64 hours ago maximum. The following dialog box will open when you click the Schedule button:



There are many options available to configure the schedule. The task of creating the Shadow copies can be scheduled at certain times, dates and events. Examples of these events are a user logon or system startup. The default schedule settings contain two schedules, one for 7 AM in the morning and one for 12 PM in the afternoon. Instead of creating multiple schedules, you can also repeat the task from one schedule multiple times through the Advanced button. The advanced options also allow you to specify start and end dates for a particular schedule. To determine the best suitable schedule settings for a particular volume, it is necessary to find out how frequently files are changed.


Restoring Shadow Copies

To be able to restore shadow copies, users need special client software. Windows 2003 includes the client natively, but on clients running Windows 98, Windows 2000, and XP you need to install the client software, which can be downloaded here. If you run Windows 2000 you need to have at least Service Pack 3 installed. The client for Windows XP is also available in the X:\WINDOWS\system32\clients\twclient folder on a Windows 2003 server.

A user can access shadow copies through the Previous Versions tab of the Properties of files and folders inside the share. The Previous Versions tab shows the shadow copies including the date and time they are created.



Users are able to view the contents of files and folders before they restore it, but the files cannot be edited. To restore a shadow copy of a file or folder, select it and click the Restore button. When you restore a file the shadow copy will be deleted, if you do not want to have the shadow copy deleted and the original file not overwritten, use the Copy button to restore the file instead.

If you are working locally on a Windows 2003 server and want to access shadow copies on the same server, you can access the Previous Version tab of files and folders by typing \\localhost\X$ (where X is the volume where the shared folders are located) in the address bar of My Computer or Explorer. This is required because the Previous Versions tab is on the shared folder's Properties, not on the local folder's Properties.


VSSADMIN

Windows XP and Windows 2003 include the command-line utility Vssadmin, which can be used to administer Shadow Copies. The Windows XP version supports only a couple of parameters mainly to display information about current shadow copies. The version of vssadmin included in Windows 2003 provides many additional options allowing you to perform the same tasks as on the Shadow Copies tab of the Local Disk Properties. Vssadmin is particulary useful when you want to script the configuration of several servers.