Menu
homeBios

Windows 8 volume shadow copying. Solving VSS problems

This article is designed to clarify service processes and also serve as a guide to Windows settings to resolve problems.

We receive a large number of requests from users having problems with the Volume Shadow Copy Service when using Paragon products. Most products are equipped with Paragon Hot Core technology, which is in no way inferior to Microsoft VSS. Paragon Hot Core has proven itself to be reliable and safe to use. We highly recommend using it instead of VSS.

Enabling Paragon HotCore (HDM15 or earlier only)

This service is not enabled by default during installation, so you must add it manually. Open Control Panel – Programs and Features. Find the product in the list. Select “Edit” in the installation wizard.

Then you need to change the archiving settings as shown in the figure.

The instructions below will help you quickly back up or create a backup copy of locked partitions and drives, even when they are in use.

Volume Shadow Copy Service

The first sign that services have not started is a “reboot required” notification, which means that the program cannot access files that are currently in use. The operation can be carried out after restarting Windows, it will be performed before Windows starts. This scenario is caused by the following two reasons:


Sometimes errors like

This error occurs due to file system or disk errors. This is usually the result of small errors in the file system data. Windows successfully ignores them, but some programs cannot do this. These errors must be corrected using a Windows utility.

1. Check the VSS infrastructure

1.1 Checking VSS providers

Some applications integrate their own VSS providers, causing Microsoft VSS to be disabled entirely. To check providers for activity, enter the following at the command line:

vssadmin list providers

This command displays the name, type, ID, and version of each installed shadow copy service provider.

If more than one provider is installed, you must perform a registry check.


1.2 Checking VSS writers (writers):

There are various VSS writers that create a shadow copy. Incompatibility between them can lead to various problems. To check the writers for problems/errors, enter the following command at the command prompt:

vssadmin list writers

This command displays installed VSS writers and many of the errors reported by them.

1.3 Checking the distribution of shadow copy storage

The partition (selected for shadow copy operations) requires approximately 300 MB of free space and must also be formatted in NTFS. To get information about the shadow copy partition and the used/allocated/maximum available space, enter the following command at the command prompt:

vssadmin list shadowstorage


This command lists all shadow copy storage locations

You can see that partition C: is designated as a shadow copy partition.

1.4 Other VSS commands

delete shadows – deletes shadow copies of a volume;
list shadows – displays existing shadow copies of a volume;
list volumes – displays volumes suitable for creating shadow copies;
resize shadowstorage – allows you to change the size of the shadow copy.

2. Simultaneous archiving:

The MS VSS provider cannot work with multiple shadow copies at the same time. Check if another program is accessing VSS at the same time as it.

3. VSS is supposedly used:

It looks like VSS is in use and is not available. Try checking:
Open the Registry Editor ( regedit.exe) and go to the following path:
HKEY_LOCAL_MACHINE – SYSTEM – Setup

Check if the following items have the value “ 0 “:

SystemSetupInProgress
UpgradeInProgress

4. Some VSS dynamic libraries are corrupted

Make sure all VSS dynamic libraries are installed and registered properly.

Windows XP only

  1. Open a command prompt
  2. Enter cd %windir%system32 and press Enter

  3. net stop vss
    net stop swprv
    regsvr32 ole32.dll
    regsvr32 vss_ps.dll
    vssvc/Register
    regsvr32 /i swprv.dll
    regsvr32 /i eventcls.dll
    regsvr32 es.dll
    regsvr32 stdprov.dll
    regsvr32 vssui.dll
    regsvr32 msxml.dll
    regsvr32 msxml3.dll
    regsvr32 msxml4.dll
  4. Restart your computer

Only for Windows 7, Windows 8, Server 2008/R2, Server 2012

  1. Open a command prompt
  2. Enter cd %windir%/system32 and press Enter
  3. Run the following commands in the order listed:
    net stop “System Event Notification Service”
    net stop “Background Intelligent Transfer Service”
    net stop “COM+ Event System”
    net stop “Microsoft Software Shadow Copy Provider”
    net stop “Volume Shadow Copy”
    cd /d %windir%/system32
    net stop vss
    net stop swprv
    regsvr32 /s ATL.DLL
    regsvr32 /s comsvcs.DLL
    regsvr32 /s credui.DLL
    regsvr32 /s CRYPTNET.DLL
    regsvr32 /s CRYPTUI.DLL
    regsvr32 /s dhcpqec.DLL
    regsvr32 /s dssenh.DLL
    regsvr32 /s eapqec.DLL
    regsvr32 /s esscli.DLL
    regsvr32 /s FastProx.DLL
    regsvr32 /s FirewallAPI.DLL
    regsvr32 /s kmsvc.DLL
    regsvr32 /s lsmproxy.DLL
    regsvr32 /s MSCTF.DLL
    regsvr32 /s msi.DLL
    regsvr32 /s msxml3.DLL
    regsvr32 /s ncprov.DLL
    regsvr32 /s ole32.DLL
    regsvr32 /s OLEACC.DLL
    regsvr32 /s OLEAUT32.DLL
    regsvr32 /s PROPSYS.DLL
    regsvr32 /s QAgent.DLL
    regsvr32 /s qagentrt.DLL
    regsvr32 /s QUtil.DLL
    regsvr32 /s raschap.DLL
    regsvr32 /s RASQEC.DLL
    regsvr32 /s rastls.DLL
    regsvr32 /s repdrvfs.DLL
    regsvr32 /s RPCRT4.DLL
    regsvr32 /s rsaenh.DLL
    regsvr32 /s SHELL32.DLL
    regsvr32 /s shsvcs.DLL
    regsvr32 /s /i swprv.DLL
    regsvr32 /s tschannel.DLL
    regsvr32 /s USERENV.DLL
    regsvr32 /s vss_ps.DLL
    regsvr32 /s wbemcons.DLL
    regsvr32 /s wbemcore.DLL
    regsvr32 /s wbemess.DLL
    regsvr32 /s wbemsvc.DLL
    regsvr32 /s WINHTTP.DLL
    regsvr32 /s WINTRUST.DLL
    regsvr32 /s wmiprvsd.DLL
    regsvr32 /s wmisvc.DLL
    regsvr32 /s wmiutils.DLL
    regsvr32 /s wuaueng.DLL
    sfc /SCANFILE=%windir%/system32/catsrv.DLL
    sfc /SCANFILE=%windir%/system32/catsrvut.DLL
    sfc /SCANFILE=%windir%/system32/CLBCatQ.DLL

    net start “COM+ Event System”
  4. Restart your computer

5. It also makes sense to check the status of VSS services.

  • Open Start, enter Services, press Enter.
  • Make sure the following services are installed accordingly:
  • Click Services right click, select Properties.
    Volume Shadow Copy – “ Manually“;
    Microsoft Shadow Copy Software Provider – “ Manually“;
    Remote Procedure Call – “ Automatically“;
    COM+ Event System – “ Manually" And " Automatically“;
    System Event Notification Service – “ Automatically“;
    Windows Backup – “ Manually“.
  • Restart your computer and check if the problem persists.

6. Check if you can create a VSS snapshot directly from Windows

Server OS:

  • Open My computer– Right click on any internal partition – Set up shadow copies
  • Select the partitions you want to archive and click Create a shadow copy to confirm that there is enough free space on each partition. Otherwise, set the allocation size for the volume.
  • You can also use the vssadmin utility to run this check and create, increase, and reallocate space for the shadow copy.

Windows Vista and later workstation operating systems:

  • Go to Control Panel –System –System protection
  • Select the sections you would like to archive and click the button Create. If necessary, configure volume protection, volume protection, and increase the storage space size.

7. Check Windows Events

Open Start – Execute... – eventvwr.msc. Go to Windows logs – Application and check for error messages related to the VSS service.

Search the articles for solutions Microsoft support, For example, .

8. Virtual machine

If the PC or server you are using is a virtual machine hosting platform, you need to install the latest version VMware Tools(for VMware), Virtual Machine Additions(Virtual Server) on each virtual machine.

9. Windows Updates

Install the latest version Update Packs by using Windows Update.

Check Microsoft support site for patches and other updates to VSS.

10. Archiving exceptions

VSS has pre-selected exceptions that can be modified in the registry to add or remove exceptions and customize the contents of the final archive. Cm. .

Volume Shadow Copy Service (VSS) provides two features that can save administrators time and hassle. The first is a snapshot (a short-term backup of all files on an NTFS volume). With a snapshot or shadow copy, users can independently recover an accidentally deleted file or correct the consequences of choosing Save instead of Save As. VSS is not intended to replace your current archiving strategy, as will be discussed below. The second important feature of VSS is archiving files that are open or locked by an application such as Microsoft SQL Server or Microsoft Exchange.

VSS creates shadow copies on a schedule or on demand. Using VSS in Windows 2003 and Vista system recovery is easy. This article shows how to set up backups using VSS in Windows 2003 and convert basic disks to dynamic disks without damaging shadow copies. As an administrator implements VSS, you may find the recommendations in the sidebar “Five VSS Tips” helpful.

How VSS works

VSS creates a snapshot of all files on the NTFS volume or source volume. Shadow copies are stored in an area called the shadow copy cache. The volume on which the shadow copy cache resides is called the shadow copy storage volume. The shadow copy cache is usually invisible to users, as it is located in the hidden System Volume Information folder.

By default, the shadow copy cache is created on the source volume, but you can create it on a separate physical disk to improve performance and fault tolerance. Before you enable VSS, you must select a location to store the shadow copy cache because the cache cannot subsequently be moved without losing the snapshots it contains. Additionally, be aware that disabling shadow copies on a volume deletes all existing shadow copies.

VSS can only be enabled on NTFS volumes. You cannot enter or exclude specific files or folders - only all or nothing. Data on mounted volumes is not included in the shadow copy on the parent volume. However, you can enable shadow copies on the mounted volumes themselves. Shadow copies retain both encryption and NTFS permissions, which can cause problems when restoring the file.

Activating VSS

To enable VSS, select My Computer, then right-click the volume on which you want to enable VSS and select Properties. On the Properties page, you need to click on the Shadow Copies tab. If this has already been done, you need to decide whether you want to store the shadow copy cache on another volume on a different disk.

Then highlight the source volume and click the Settings button. In the Settings dialog box, you can select a different volume to store the shadow copy, as Figure 1 shows. You can change the storage area size and schedule (by clicking the Schedule button) if the preset schedule is not suitable. By default, snapshots are generated from Monday to Friday at 7 a.m. and noon. Snapshots should be created as needed, not every hour.

When you have finished configuring your settings, click OK. On the Properties page, you need to click the Enable button to enable shadow copies on this volume. You will be prompted to use the default schedule and settings; You must accept this proposal and click on the Yes button, and then again on the OK button.
Command line utility enthusiasts will benefit from learning how to configure VSS using Vssadmin and Schtasks instead of the GUI. With Vssadmin you can create, delete, and resize shadow copies, among other operations. Schtasks is used to create, edit and delete assigned tasks.

Disk space requirements. When VSS is enabled, 100 MB of disk space is immediately allocated, and VSS can occupy up to 10% of the hard drive size. Snapshots only reflect changes from the previous snapshot, so they require less storage space than you might think. However, the shadow copy cache can only store 64 copies. If there is not enough disk space or a 65th snapshot is created, the oldest snapshot is deleted to make room for the new one. Due to redundancy when creating snapshots, it is recommended to enable VSS only on volumes that store user data or have the ability to archive open files.

Using Windows 2003 Shadow Copies

To provide client computers with access to previous versions of files, you need the Previous Versions Client application that comes with Vista and Windows 2003. Previous Versions Client can also be installed on Windows XP Professional SP1 (the twcli32.msi file is located in the %Windir%System32ClientsTwclientX86 folder on the CD-ROM Windows 2003 disk), and on Windows 2000 (you need to download the appropriate version from the Microsoft Web site). To install the client program on users' computers, double-click the file to run the installation, or deploy it through Group Policy or Microsoft Systems Management Server (SMS).

Shadow copies are designed for use with the Common Internet File System (CIFS), an extension of the Server Message Block protocol, so you must connect through the file share to access previous versions of a file or folder on the server. Even after registering with the server, you must use the Universal Naming Convention (UNC) path. For example, to access older versions of a file on a server named UptownDC in the Sales shared folder, you need to click the Start button, select Run, and enter the command

Click OK, then right-click on the desired file and select Properties. The Previous Versions tab lists the snapshots and shows the date and time they were created (see Figure 2). There are three options for action: View, Copy and Restore. In View mode, a copy of the file is opened read-only; this is convenient for selecting the desired copy. Restore mode restores the document, its NTFS permissions, and encryption settings to its original location, and overwrites the current version. A safer option is Copy, which copies the file to a new location.

If you need to recover a deleted file, then obviously you can't right-click on a file in a shared folder and select its properties. In this case, you need to go to the folder level. Instead of the UptowndcSales UNC path, the connection is made to the administrative resource of drive C (where the Sales folder is located): UptowndcC$. Right-click the Sales folder, select Properties, and click the appropriate button to view, copy, or restore the entire contents of the folder. If you only need one file, you should copy the folder to a new location, then right-click on the file and work with previous versions of that file.

Vista and Shadow Copies

Vista is the first desktop operating system with built-in shadow copy functionality. Vista shadow copies are part of the system recovery mechanism; these are called restore points. By default, recovery points are enabled on volume C and shadow copies of files are created daily if the volume has at least 300 MB of free space.

The pre-scheduled SR task creates restore points and only activates when the computer has been idle for at least 10 minutes and is running on AC power. If for some reason the SR task does not run at the scheduled time, it will be executed as soon as possible. You can assign recovery points for other volumes. Vista allocates up to 15% of your hard drive space to store restore points.

To set up and manage restore points, click Start, then right-click Computer and select Properties. In the Tasks menu, go to the System protection item. Administrative privileges are required to access System protection, so when prompted by User Account Control, click Continue.

On the System Protection tab of the System Properties page (Figure 3), you can manually create a one-time recovery point by selecting the volume and clicking Create, giving the recovery point a name, and clicking Create again. The process may take several minutes, depending on the size of the volume, but once completed you will receive a success confirmation. If the creation of recovery points for a volume is automated, Vista creates a new recovery point for the volume every day and at system startup.

Accessing previous versions of files and folders in Vista is the same as accessing through a Windows 2003 file share from a client with the Previous Versions Client installed. But Vista users can access past versions of files and folders locally. Just open Windows Explorer, right-click on the file or folder, select Properties, and then click on the Previous Versions tab (Figure 4). The options are the same as previous versions of the Previous Versions Client and function in the same way.

VSS and storage area networks

Another important benefit of VSS in Windows Server 2003 Enterprise Edition and Datacenter Edition is the ability to quickly and easily copy and move data across a SAN. VSS can create a shadow copy of a multi-terabyte volume that can be exported from the SAN and imported onto the server in just a few minutes, moving large amounts of data very quickly. Each storage system manufacturer implements this feature differently, so please contact your vendor for details.

Setting up VSS configuration

For volumes with VSS, the recommended cluster size is at least 16 KB. VSS records are converted to 16KB files in blocks. On volumes between 2 and 4 TB, the default cluster size is 4 KB. But for clusters smaller than 16 KB, the VSS provider cannot determine whether the file has been defragmented or modified. Therefore, VSS treats a defragmented file in the same way as a modified one - it generates a new shadow copy of the file. After defragmenting a disk with small clusters, the shadow copy cache can grow very quickly and overwrite existing shadow copies. For more information on this, see the Microsoft article “Shadow copies may be lost when you defragment a volume” at http://support.microsoft.com/kb/312067.

You can find out the size of a volume's clusters by using the Fsutil command. For example, to find the cluster size of volume C, enter the command

fsutil fsinfo ntfsinfo C:

If the cluster size is less than 16 KB and you want to increase it, you must back up the data, reformat the volume to a larger cluster size, and then restore the data. It should be noted that the file compression mechanism in NTFS only works for 4 KB clusters, so you have to choose between compression and VSS.

Interaction between NTBackup and VSS

In the past, a file that was opened or locked by a service or application during backup was not backed up, causing problems if administrators needed to restore it. Data consistency is extremely important when working with applications that open many files at once, such as databases. If you have many files open during backup, there is a good chance that changes have occurred in the last file in the time between the first and last file being copied. In this case, the data in the restored database appears inconsistent.

The Windows 2003 backup utility, NTBackup, uses VSS to ensure that backup copies are complete and consistent. VSS communicates with the recording component of the application associated with the file. The recording component protects application data and provides information, such as data location and archiving and recovery methods. Applications without a recording component cannot interact with VSS. In the worst case, an administrator might try to restore an important file and discover that it is not there at all: it was never archived because the application cannot communicate with VSS. Windows 2003 has writing components for AD and NTFS. To find all available recording components on the server, you need to enter the command

vssadmin list writers

When you run NTBackup on Windows 2003, the utility prompts you to enter a list of all recording components known to VSS. VSS not only lists the recording components, but also provides all known metadata about them, including the backup and recovery methods used in the recording component. VSS uses metadata to determine which applications support shadow copies. When NTBackup requests VSS to create a shadow copy, VSS sends a message to known write components to freeze all data writes, create a shadow copy, and store it in a delta file. The differential file tracks changes since the last shadow copy was created. The backup is performed using data from the differential file.

Monitoring VSS performance

Monitoring shadow copies using Performance Monitor in Windows 2003 can help prevent potential problems before they affect users. For example, Performance Monitor warns you that the disk space used for shadow copies is approaching the maximum allowed amount. By default, Performance Monitor does not contain objects or counters that track shadow copy characteristics, but administrators can enter them themselves. Instructions for creating counters are given in the Microsoft article "Add counters to System Monitor", published at http://technet2.microsoft.com/windowsserve...3.mspx?mfr=true.

Using the Volperf utility (with the /install switch) from the Microsoft Windows Server 2003 Resource Kit, you can supplement the system monitor with shadow copy objects and the following counters:

% Disk Used by Diff Area File: The percentage of disk space used by all difference files on the volume;
Allocated Space (MB): Memory space (MB) allocated to a specific volume;
Maximum Space (MB): The maximum space (MB) allocated for the shadow copy storage volume;
Nb of Diff Area Files: number of difference files;
Nb of Shadow Copies: number of shadow copies in the shadow copy cache;
Size of Diff Area Files: total size of difference files for the selected volume;
Used Space (MB): Amount of space (MB) used in the shadow copy storage volume

Converting a basic disk to dynamic and VSS

Sometimes it is useful to add an extra layer of hardware fault tolerance by creating a mirror set. Mirror sets can only be built on dynamic disks, so the basic disk must be converted to dynamic. The documentation states that converting disks from basic to dynamic does not result in data loss. However, the documentation does not say that if the conversion is incorrect, existing shadow copies may be deleted. If the source volume and the shadow copy cache are located on different volumes, then conversion may be difficult. For more information about the differences between basic and dynamic disks, see the article "Windows Server Disks - Basic or Dynamic," published in Windows IT Pro/RE No. 1, 2003.

The procedure you use to convert a VSS-compatible basic disk to a dynamic disk depends on the location of the shadow copy cache on the boot volume.

Scenario 1- The shadow copy cache is not located on the boot volume. If the shadow copy cache is not on the boot volume, you must first unmount the source volume (the volume on which the snapshot was taken) using the Mountvol command-line utility with the /P option (/P unmounts the volume). Next, you should convert the volume containing the shadow copy cache to a dynamic volume. From this moment the countdown begins: the administrator has only 20 minutes to mount the source volume using the Mountvol utility or the Disk Management snap-in of the MMC management console. If the source volume is not mounted within 20 minutes, all shadow copies will be lost. Finally, bring the source volume back online and convert it to a dynamic volume.

Scenario 2- The shadow copy cache is located on the boot volume. If the shadow copy cache is on a boot volume, you can simply convert the volume containing the shadow copy cache to dynamic. It is not necessary to dismantle it first. Then reboot the server twice and convert the source volume to a dynamic volume.

Beneficial to the end user - beneficial to the administrator

It's nice that Microsoft is releasing new tools to restore the functionality of the desktop operating system for both IT professionals and end users. The fewer backup tapes an administrator has to load, the easier his job is, and Vista's recovery points are a step in the right direction. In addition, thanks to VSS, users have the ability to control the file recovery process. But careful planning and management is essential to fully realize the benefits of VSS.

Five VSS Tips

When implementing VSS or preparing Vista restore points, we recommend that you do the following:

1...Before you enable VSS recovery points, select a storage location for your shadow copies. Remember that you cannot move them later.
2...Placing VSS on a system or boot volume is a bad decision. Operating system files change frequently, so the number of shadow copies on a boot volume is usually large.
3...The optimal cluster size for VSS is 16 KB.
4...Storing the shadow copy cache on a physical disk other than the source disk improves performance and fault tolerance.
5...Neither VSS nor recovery points can replace a complete backup solution.

The usefulness of shadow copies, and in particular the Previous Versions feature, largely depends on how often the system backs up data. Shadow copies are created on a schedule: every day at midnight (but only if the computer is turned on and not in use) and 30 minutes after Windows starts.

However, certain conditions must be met. Firstly, the process starts only after 10 minutes of computer inactivity; Archiving is not performed while you are working. Secondly, to save battery power on laptops, archiving occurs only when connected to an AC source (that is, files will not be archived while you are sitting in a cafe). Finally, if a failure occurs, the system does not retry the backup until the next scheduled time. If you're serious about using the Previous Versions feature, you'll probably want to set up a more robust schedule.

Start by launching Task Scheduler (taskschd.msc). Expand the Task Scheduler Library\Microsoft\Windows\SystemRestore branch in the left pane. Right-click SR in the middle pane, select Properties from the context menu, and click the History tab to check how often Windows creates shadow copies of data.

To change the schedule, go to the Triggers tab. If you haven't changed anything yet, there are two entries in the list: Daily and At startup. Select a trigger and click Edit.

You can create a maximum of 64 shadow copies per volume (each volume has its own drive letter), so if you suddenly think it makes sense to create backups every hour, don't rush to change the settings. With this schedule, copies older than two days and sixteen hours will be instantly deleted, regardless of the disk space restrictions set in the Toolbar, which were mentioned just above.

Once you've finished setting up the schedule in the Edit Trigger window, make sure the Enabled checkbox is checked and click OK.

Now go to the Conditions tab. If your computer rarely sits idle, clear the Start the task only if the computer is idle for checkbox. Otherwise, the creation of shadow copies may be delayed indefinitely. However, if computer performance is more important to you, then it is better to leave this option enabled. Likewise, if you often disconnect your laptop from the network, then clear the Start the task only if the computer is on AC power checkbox. On the other hand, when this option is enabled, battery power is saved.

Finally, go to the Settings tab and make sure that the Run task as soon as possible after a scheduled start is missed checkbox is checked. Click OK to save your changes.

A more reliable, but less automated way to archive previous versions of files is described in the sidebar "Instant Archiving", and in the next section we will talk about full system archiving and protection against accidental errors.

INSTANT ARCHIVING

The archiving process takes a long time. What's more, even if you back up every day, data loss is still possible—think of a missed key, a power outage, or an app crash. Since archiving is almost the same as simply copying, when working with particularly important data, why not resort to quick and simple backups several times a day? You don't need any special software or hardware, and even better, the process only takes a few seconds.

Solution 1: Simple Copy

If you've spent several hours editing a document and don't want to lose your changes, make a duplicate of the file: open the document folder, right-click on the document and drag it to another part of the same window. In the context menu that opens, select the Copy command (Soru Nege). The newest backup copy of the document is now in the same folder! Of course, a copy can be placed on a USB drive, on an archiving server, or on another computer on the local network.

Solution 2: Simple Zip File

To quickly back up an entire folder, right-click on it and select Send To, then Compressed (zipped) Folder from the context menu. In a few seconds, you will receive a new .zip file containing compressed versions of all the data in your folder. Recovering files is very simple: double-click the zip file and drag the desired files back to the original folder. Read more about this ubiquitous format in the Archiving section.

Solution 3: Previous Versions

Right-click on the document, select Properties and go to the Previous Versions tab in the window that opens to check the automatically created backup copies of this file. Click Copy (Copy) so that when you restore a backup, the newest version of the file is not lost. In Windows, automatic archiving runs on a schedule, if it is turned on at all, so there is no guarantee that the restored copy will be fresh. But the fact that archiving is automatic already means a lot. More information about previous versions is described in the section “Back to the past - using restore points and shadow copies.”

Solution 4: Add-ons

If you don't hate add-ons, then you should like Microsoft's SyncToy. Version 2.1 or later can be downloaded from http://www.microsoft. com/downloads/. In a nutshell, SyncToy is designed to sync two or more folders; she makes sure that the contents remain identical. However, this add-in can also be used to perform an online backup of the contents of a folder. (Tip: For added security, create a second folder on a network or USB drive.) Think of SyncToy as a RAID 1 array of individual folders; Read more about this in the section “Protecting data using a RAID array.” A similar utility, Second Copy (a free version of which can be downloaded from http://www.secondcopy.com/) has an even wider range of capabilities.

If you accidentally deleted a file or folder past the Recycle Bin, don't panic. Data recovery programs are here to stay, so try the system tools first. In Windows, you can restore previous versions of files and folders, even if the GUI does not have this option.

In Windows 8, there is one less tab in the properties of drives, folders and files. Please note that previous versions have disappeared.

This is only observed in the client operating system, i.e. in Windows Server 2012 the tab remains. In Windows 10, the tab is back, but... you need to read the article :)

This article has been updated in the context of Windows 10.

Today on the program

Previous versions on Windows 10

The article was written during the days of Windows 8, and in Windows 10 the “Previous Versions” tab returned to the folder properties. However, the material is relevant for Windows 10 because it demonstrates how to recover files directly from shadow copies.

In Windows 10, the tab says that previous versions are formed from file history and shadow copies. First, you need to consider that in Windows 10 system protection disabled by default, so with standard settings, previous versions are only available from file history, if it is enabled, of course.

Moreover, my experiment on Windows 10 version 1511 (and later 1709) showed that the tab only shows versions from the file history, even if system protection is enabled!

On this picture:

  1. Properties of the screenshots folder in the OS. Latest version dated February 27. This is probably the date of the last copy to the file history, which is not working for me now (the disk is physically disconnected)
  2. The latest shadow copy dated May 11 (appeared when creating a restore point before installing WU updates), I create a symbolic link to step 3
  3. Contents of the shadow copy. It can be seen that it contains files created shortly before the appearance of the shadow copy of May 11th. However, they are absent in paragraph 1

Thus, you have the best chance of restoring previous versions if file history is enabled. Then the versions are available on a tab in the folder properties or in the file history interface. Otherwise, system protection must be enabled, and if necessary, you will have to get to shadow copies using the methods described later in the article.

How previous versions work, and why the tab was removed in Windows 8

This picture in the properties of files and folders is only a consequence of the fact that there is no longer a file recovery option in the Windows 8 system protection settings.

I’ll say right away that the absence of an entry point in the graphical interface does not mean the absence of technology in the system. Previous versions of files are still available! Therefore, everything said below is fully applicable to Windows 8, and the description of the technology also applies to Windows 7.

Why was the file protection option and the previous versions tab removed? I don't have a definitive answer, but I have some educated guesses that I'll share with you while also explaining how previous versions work.

On many systems this tab was always empty

This has left thousands of people perplexing community forums and Microsoft support with a burning question. But you already guessed what their problem was, didn’t you? These people had their system protection completely disabled!

People did not understand the principle of storing and displaying previous versions

Indeed, why are there several versions for some folders, and none for others? The fact is that different editions of the files in these folders could only be created no earlier than the oldest recovery point.

Agree, when looking at the tab it is not entirely obvious that saving versions of personal documents and media files is linked to create restore points(although this is described in Windows help, albeit not without flaws).

It is common to think of points as a means of rolling back system parameters, especially since personal files are not restored (with the exception of these types of files).

Meanwhile, recovery points and previous versions of files (not related to file history) are stored in one place - volume shadow copies.

System Restore simply takes a snapshot of the volume at the right time and stores it in a shadow copy. It is the space allocated for shadow copies that you control in the system protection settings.

Now it becomes clear why the number of versions of files and folders can vary. The state of the file is recorded at the time the recovery point was created. If it changed between points, its version is saved in the shadow copy. If the file remained unchanged during the period covered by the restore points, it will not have previous versions at all.

Windows 8 introduces file history

Once the technology is used, the benefits can be derived from it. In Windows 7, this was not clear to most people, so in Windows 8 they introduced a more intuitive data backup system - file history.

It doesn't rely on shadow copies, and you can control the number of file versions by specifying the backup frequency. It all depends on your needs and the space on the target disk.

The access tab to “obscure” previous versions in Windows 8 was simply removed, along with the accompanying option in the system protection settings. As for IT specialists, they should be well acquainted with the concept of shadow copies - after all, server operating systems have a tab of the same name in the volume properties to manage them. Therefore, in Windows Server 2012, the “Previous Versions” tab is in its usual place.

In Windows 8+, restore points are created using a special algorithm, and along with them, previous versions of your files and folders are saved. Next I will tell you how to open them.

How to open previous versions of files and folders from shadow copies

Below are two methods that will work if you have system protection enabled. The first one is suitable for all supported Windows and will be useful if you don't have file history enabled. The second method makes sense only in Windows 8/8.1, taking into account the note about Windows 10 at the beginning of the article.

Method 1 - Symbolic link to shadow copies (Windows 7 and later)

Regular blog readers have already seen this trick in the article about the function PC updates without deleting files(Refresh Your PC). It also uses shadow copies to intermediately save the disk when you create your rollback image.

Then I needed this focus to understand the technology, but now you may need it to solve a very specific problem. On the command line running on behalf of administrator, do:

Vssadmin list shadows

You will see a list of shadow copies on all volumes. Each of them is indicated by a drive letter, so it will be easy for you to navigate. In addition, each shadow copy corresponds by date to one of the recovery points (to list them, run in the console rstrui).

Select the desired date and copy the shadow copy volume ID. Now use it in the second command (don't forget to add a backslash at the end):

Mklink /d %SystemDrive%\shadow \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\

You already have a symbolic link in the root of the system drive shadow, leading to the shadow copy! By following the link, you will see a familiar structure of files and folders - these are their previous versions.

Method 2 - Login to a shared drive over the network (Windows 8 and 8.1)

Added 01/15/2013. In the comments, reader Alexey shared a simpler way to access shadow copies compared to what was originally described in the article. At first the method worked, but later Microsoft closed the loophole with some update. However, Nick's reader ultimately suggested workaround.

First you need to make the disk shared, and then access it “over the network”. In the This PC window, open Network and log into your PC, or as an administrator, paste the network path into the address bar of Explorer or into the Run window:

\\%computername%\C$

where C is the letter of the desired drive. In network folders, the “Previous Versions” tab is present:

Since I've resorted to retrieving data from shadow copies several times, I'm a little sorry for the loss in the GUI. After all, the “Previous Versions” tab was convenient because it immediately allowed you to get to the necessary files.

However, I didn’t use this opportunity so often that entering two commands into the console gave me terrible inconvenience. After all, the main thing is the presence of previous versions of the files, and I can get to them! Now you can too ;)

Have you ever had the opportunity to restore previous versions of files from shadow copies? Tell us in the comments why the need arose and whether you managed to restore everything.

I still think that most readers have never used this feature on home systems, and therefore its disappearance from the GUI will not upset them too much. In the next post, we'll talk about why various Windows features are disappearing or undergoing changes, and what you can do to help change the situation.