You are on page 1of 13

NTFS file system and everything about shadow copies

Hi students, Wanted to write about filesystem and shadow copies. Came across huge number writeups already available in the internet. So i have compiled them here for you. Thanks for all the gentlemen who wrote these articles on the internet. NTFS stands for new technology file system or network technology file system.
   

In NTFS partition size can be of 2 TB or more. Supports file size of 16 TB. File/folder encryption is supported. It supports file name character upto 255.

FAT32 stands for File allocation table.
   

In FAT32 partition size can be up to 2 TB. Supports file size can be 4 GB. File/Folder encryption is not possible in FAT32. Supports file name character upto 8.

Shadow copies (A feature in NTFS)
Let’s face it — sometimes things go wrong, especially when you are dealing with computers, networks, electronic gadgetry, and the people who use them. When it comes to saved files on a hard drive, users have been known to delete, modify, and otherwise render useless important documents and then want them restored to their previous condition. The shadow copy feature in Microsoft Windows Vista goes a long way toward making that restoration just a few mouse clicks from reality. That is, if you have turned shadow copy on and have it configured properly. Configuring and using Vista shadow copy is not complicated, but it does require some specific knowledge about where these features are located.

Shadow copy configuration
Before you can use the shadow copy feature, you must make sure it is enabled. Shadow copy does require additional system resources, so you should weigh the benefits of file restoration with the availability of system resources. For most, the benefits will outweigh the additional system requirements, but your situation may dictate a different approach. Configuration settings for shadow copy can be found in Vista System Properties. Navigate to the Control Panel and click the System Properties icon, as shown in Figure A. You can also type system into the Desktop Search box on the Start Menu. Figure A

click the System Protection link on the lefthand side of the screen.In the System Properties window (Figure B). The intermediate step to System Properties seems to be required. but I could find no keyword that would lead me directly to the System Protection screen from the Desktop Search. Figure B . It is odd.

Under normal conditions. Click OK when your configuration is complete. Figure C . You can also restore to a previous point from this screen if you want to and if a restore point exists. If you want. a new restore point is created as part of the shutdown/boot process. click the System Protection tab to reach the configuration screen for shadow copy (Figure C). Make sure to check the drives for which you would like shadow copy to be available.Once you get to the System Properties dialog window. you can create a restore point immediately by clicking the Create button.

In the example in Figure D. you can rest assured that no matter what bonehead thing you do to your documents. Figure D .Using shadow copy Now that you have configured Windows Vista to create shadow copies of your files. you have a copy to restore from when needed.docx and saved it in my folder. I have created a simple Word 2007 document called ShadowTest.

Figure E Figure F .

I forced the creation of a restore point to create a shadow copy of our test file Figure G .For our example.

Restoration will replace whatever is in the current document with the version shown here in the shadow copy. or use it as a restoration file. Copy it. Figure H . Windows Vista will warn you of this fact (Figure H).From this screen (Figure G) you can Open the document.

documents. and a few other things (details). the registry. It specifically excludes all files in the user profile and the My Documents folder (regardless of file extension). Instead.g. after a failed driver or software installation). System Restore does not affect your documents – it only protects files with certain extensions (such as DLL or EXE). Does volume shadow copy protect only my system files? No. The first thing to understand here is that the System Restore task on Vista and 7 will only execute if your computer is idle for at least 10 minutes and is running on AC . By default. In Windows XP. user settings. In addition. it uses a much simpler mechanism: the moment a program attempts to overwrite a system file. Volume Shadow Copy maintains snapshots of entire volumes. system components (e.Frequently Asked Questions What is volume shadow copy? Volume Shadow Copy is a service that creates and maintains snapshots (―shadow copies‖) of disk volumes in Windows 7 and Vista. How is this different from what’s in Windows XP? In Windows XP. System Restore does not use the Volume Shadow Copy service. It is the back-end of the System Restore feature. including all the system files. program files. which enables you to restore your system files to a previous state in case of a system failure (e. Windows automatically creates restore points at hard-to-predict intervals. Windows XP makes a copy of it and saves it in a separate folder. etc. When are the shadow copies created? Volume shadow copies (restore points) are created before the installation of device drivers. and some applications. Windows updates. DirectX). it is turned on for your system volume (C:) and protects all the data on that volume.g.

just the system files. on Windows 7 it is 7 days. the System Restore task is scheduled to run every time you start your computer and every day at midnight. especially if you have a lot of programs running in the background. A versioning system lets you access all versions of a document. Here’s a more precise description: By default. Since the definition of ―idle‖ is ―0% CPU usage and 0% disk input for 90% of the last 15 minutes. plus no keyboard/mouse activity‖ (source). As far as I know. All the files and folders that you deleted will be there! Is Volume Shadow Copy a replacement for versioning? No. Of course. and open the folder as it appeared at the time a shadow copy was made (see screenshot below).power. choose Restore previous versions. you can launch System Restore and roll back to a working system state from before the installation. choose Restore previous versions. the frequency with which automatic restore points are created is hard to estimate. as long as your computer is idle and on AC power. What cool things can I do with Volume Shadow Copy? If your system malfunctions after installing a new video card driver or firewall software. . you can expect automatic restore points to be created every 1-2 days on Windows Vista and every 7-8 days on Windows 7. but only if enough time has passed since the last restore point (automatic or not) was created. (Note: System Restore will not roll back your documents and settings. you can also do this from the Windows Setup DVD. which could be several days ago. every time you save a document. but if you use your machine every day on AC power and nothing prevents it from entering an idle state.e. If you accidentally delete a file or folder. and access a previous version of it. this interval cannot be changed. you can right-click the containing folder. If you can’t get your system to boot. If the task is executed successfully. So if you do screw up your dissertation. Volume Shadow Copy only allows you to go back to the moment when a restore point was made. your current state will be automatically saved as a restore point. you might have to roll back to a very old version. the actual frequency will be higher if you count in the restore points created manually by you and those created before software installations. You can open it (in read-only mode) or copy it to a new location. i. On Windows Vista the minimum interval is 24 hours. The task will wait for the right conditions for up to 23 hours.)   If you accidentally delete 10 pages of your dissertation. These rules are specified in Scheduled Tasks and can be changed by the user. to which you can later go back. This process is reversible. it could take days for your machine to be idle. Windows will create a restore point. a new version is created. you can right-click the document. As you see.

you lose everything.Is Volume Shadow Copy a replacement for backups? No. you will wind up with no shadow copies at all. so it could take days before the conditions are right. You can change the maximum amount of space available for shadow copies in Control Panel | System | System protection | Configure. There is no guarantee that a suitable shadow copy will be there when you need it. but remember that the System Restore task will only run if your computer is on AC power and idle for at least 10 minutes. With a lot of disk activity. In that case. Unchanged data will not be backed up. With the default settings. there is no guarantee that shadow copies will be created regularly. When you create a restore point. How much disk space do Volume Shadow Copies take up? By default. for the following reasons:     Shadow copies are not true snapshots. Windows 7 will only create an automatic restore point if the most recent restore point is more than 7 days old. it may even run out of space for a single shadow copy. . How efficient is Volume Shadow Copy? It’s quite efficient. If the data on your drive gets changed (corrupted) for some low-level reason like a hardware error. If it did. especially if you run a lot of background processes or do not use your computer frequently. On Windows Vista. Volume Shadow Copy does not create a full image of the volume. the maximum amount of storage available for shadow copies is 5% (on Windows 7) or 15% (on Vista). The 5% of disk space that it gets by default is usually enough to store several snapshots of the disk in question. back up the original version so I can go back to it. you’re not making a new copy of the drive in question — you’re just telling Windows: start tracking the changes to this drive. and again. though only some of this space may be actually allocated at a given moment. VSC will not know that these changes happened and will not back up your data. When a restore point is created. if something changes. (see below for a more detailed description of how VSC works) The shadow copies are stored on the same volume as the original data. In particular. it would be impossible to store several shadow copies of a volume using only 5% of that volume’s capacity. Windows deletes old shadow copies without a warning as soon as it runs out of shadow storage. there will be no message to warn you about it. the minimum interval is 24 hours. so when that volume dies. How is this possible? The first thing to understand is that volume shadow copies are not true snapshots.

VSC makes a copy of that block and saves it on a hidden volume. If you then start copying other files to the same disk. First. as you can tell it to exclude certain files and folders. Then. created on Monday and Tuesday. which consists of overwriting it several times and deleting it. Because it operates on the block level. that is below the file system level. a backup copy of the block is saved in the Tuesday shadow copy. but they are not actually deleted. So all the data that was in the file is still there in the same blocks. Volume Shadow Copy does not have to back up 700 MB of data. It sees the disk as a long series of blocks. if we were to roll back an entire volume to Monday. When I delete a 700 MB file. When you delete a file. More recent changes are only tracked in the Tuesday copy. as the blocks occupied by the file are unchanged! The only thing it has to back up is the blocks occupied by the Master File Table. So the oldest shadow copy is dependent on all the more recent shadow copies. VSC will make backups of these blocks as they get overwritten. path. Now. some of the blocks formerly occupied by the 700 MB file will get overwritten. ―undo‖ the changes made since Tuesday (using the blocks saved in the Tuesday shadow copy). So blocks are “backed up” only when they are about to get overwritten. The Monday copy only contains the differences between Monday and Tuesday. but not in the Monday shadow copy. (Still. The blocks (units of disk space) that contained the file’s contents are marked as unused. until the blocks get overwritten (e.Here’s what really happens when a restore point is created: VSC starts tracking the changes made to all the blocks on the volume. Whenever anyone writes data to a block. you ―wipe‖ (or ―secure-delete‖) the original document. we would take the volume as it is now.g. because if you just deleted the document without overwriting it. (This is necessary. if you delete a 700 MB movie file. In other words. you create an encrypted copy using an encryption application. The benefit of this approach is that no backup space is wasted on blocks that haven’t changed at all since the last restore point was created. all that Windows does is remove the corresponding entry (file name. when you copy another file to the same volume). Suppose it’s Wednesday and your system has two shadow copies. all the . properties) from the Master File Table. it has some awareness of files. Therefore. which has changed. and finally ―undo‖ the changes made between Monday and Tuesday. when you overwrite a block. Notice that VSC operates on the block level.) The second important fact is that shadow copies are incremental. it does not have to back up anything. does VSC add 700 MB of data to the shadow copy? No. What are the security implications of Volume Shadow Copy? Suppose you decide to protect one of your documents from prying eyes.

However. Since deleting the shadow copies does not wipe the disk space that was occupied by them. because it had recently been modified). (After disabling VSC. However. Windows offers no option to enable VSC only for system files. it is quite possible that one of the shadow copies you just deleted already contained a copy of the file (for example. safely stored on a hidden volume. the original file will be retrievable using Previous versions. you’ll see the original file that you tried so hard to delete! The reason wiping the file doesn’t help. this would render the original. Curiously. Some other solutions to consider:    You could make sure you never save any sensitive data on a volume that’s protected by VSC. All you need to do is right-click the containing folder. It doesn’t matter how many times you overwrite the file. So. See question above for an explanation of how file deletion works. and.) Ordinarily. if the original file was stored on a volume protected by the Volume Shadow Copy service and it was there when a restore point was created. lo and behold. A partial solution is to delete all the shadow copies (by choosing Control Panel | System | System protection | Configure | Delete) before you wipe the file. The most secure approach is to use an encrypted system volume. no matter what temporary files. That way. which could contain shadow copies of your sensitive data. This would be very hard to do. open a snapshot. of course. unencrypted document irretrievable. Windows creates. if you disable VSC. as there is no direct access to that area of the that was in the file would physically remain on the disk until it got overwritten by other data. etc. Shadow copies are read-only. the shadow copy will still be there. shadow copies. so there is no way to delete a file from all the shadow copies. If you want to protect your system. is that before the file’s blocks get overwritten. . you may want to wipe the free space on your drive to overwrite the blocks previously occupied by VSC. This prevents VSC from making a copy of the file right before you overwrite it. Of course. you also lose System Restore functionality. VSC will save them to the shadow copy. Is there a way to securely delete a file on a volume protected by VSC? No. you would also have to wipe the blocks that used to contain the shadow copies. the contents of the shadowed file will still be there on the disk. if you really wanted to be secure. click Restore previous versions. You could disable VSC altogether. you would need a separate VSC-free volume for such data.) However. it will all be encrypted. you also have to enable Previous versions (see screenshot to the right).

most of the data on your disk stays unchanged. suppose you uninstall a 5 GB game and then install another 5 GB game in its place. for example. So if the sequence of events is as follows: create file → create restore point → make encrypted copy → overwrite original file the original file will be recoverable. What happens when VSC runs out of space? Most of the time. However. What happens then? VSC deletes as many previous shadow copies as necessary. This means that 5 GB worth of blocks got overwritten and had to be backed up by VSC. so that no restore point gets created after they are saved on disk in unencrypted form. there will be no way to recover them with VSC. In such ―high-churn‖ scenarios. Can I prevent VSC from keeping snapshots of certain files and folders? Yes. until it has enough space for the latest copy. starting from the oldest. but you have to edit the registry to do that. There are no partial copies.Notice that VSC only VSC only lets you recover files that existed when a restore point was created. just because your computer happens to be idle. all the shadow copies will be deleted. Here are detailed instructions from MSDN. But if the sequence is: create restore point → create file → make encrypted copy → overwrite original file you are safe. it is not easy to control when Windows creates a restore point. However. . In the rare event that there isn’t enough space even for the one most recent copy. it can do it at any time. If you make sure to encrypt and wipe files as soon as you create them. VSC can run out of space pretty quickly.