Implementing Shadow Copies

Shadow copies are a new feature in Windows 2003 that enables users
to retrieve files that may have been altered or deleted. Shadow copies
are implemented to solve one of the following scenarios:
• Accidental file deletions
• Accidental overwrites of a file (clicking Save instead of Save As)
• File corruption
The Volume Shadow Copy Service (VSS) is the driving force behind
shadow copies.
When the VSS is enabled on a volume, it takes snapshots of files at
intervals and stores them for later retrieval. (You can alter the interval
as you see fit.) A user can view previous versions of a file and restore a
previous version if necessary. When a user accesses a file over the
network, they will see a Previous Versions tab on the Properties of the
file, as shown in Users can then restore a previous version of the file all
by themselves.

VSS is the service that makes shadow copies possible. VSS also makes
itself available to applications that are equipped to take advantage of
the service, such as the Backup utility for Windows, which can now
back up open files by using VSS.

Shadow copies are primarily intended for situations in which a user has
accidentally deleted a file or overwritten the file and need to revert
back to a point in time. Shadow copies by themselves are not a backup
solution. A separate backup solution should be part of the overall
management strategy.

How the Volume Shadow Copy Service (VSS) Works

When shadow copies are enabled on a volume, an interval is specified.
If no interval is configured, VSS uses the default interval of twice per
day. At the specified interval, VSS takes a snapshot of the shared
folders and the contents. It does not make a backup of the files at that
time. When a user opens a file, works on the file, and saves the file
back to the original location, VSS uses the snapshot taken earlier to
recognize that a file has changed. The VSS then makes a full copy of
the file as it was at the interval and saves the file in the System
Volume Information folder, a hidden folder on the volume. Now the file
on the server is up to date as the user saved it, and a backup of the
previous file also resides on the server.
If a user accesses the file properties, they can see the previous version
of the file as well.
What VSS does not do is make a backup of the file every time a user
saves the file. If the default interval is used, a snapshot will be taken at
7:00 A.M. and 12:00 P.M. each weekday. If a file is accessed by a user
at 9:37 A.M. and changed and then saved, two copies of the file will be
available: the old file as it was at 7:00 A.M. and the new file as it was
changed at 9:37 A.M. If another user accesses the file at 11:32 A.M.
and changes the file, only the current change and the file version as of
7:00 A.M. will be available. There are three methods you can use to
implement shadow copies: Windows Explorer, the Shared Folders snap-
in, and the command prompt.

Implementing Shadow Copies Using Windows Explorer

Enabling shadow copies on the volume will back up all shared folders
on the volume. To implement shadow copies, right-click any volume in
Windows Explorer and select Properties. Click the Shadow Copies tab
and select the volume to enable, as shown in

Implementing Shadow Copies Using the Shared Folders Snap-in

To implement shadow copies, open the Computer Management MMC.
Right-click the Shared Folders node, select All Tasks | Configure
Shadow Copies, as shown in Figure 3-20. Configure the appropriate
volume and schedule.

Implementing Shadow Copies Using the Command Line

From a command prompt, type
L 3-3 vssadmin create shadow /for=forvolumespec
For additional help and to see a list of commands, from a command
prompt, type
L 3-4 vssadmin
Scheduling Shadow Copies
By default, a snapshot is made of the shared folders at 7:00 A.M. and
12:00 P.M. Monday through Friday. Windows 2003 only maintains 64
shadow copy snapshots. Once 64 snapshots have been made, the VSS
begins overwriting the oldest snapshot to save the new snapshot.
Microsoft does not recommend taking snapshots of the shared folders
more than once an hour. Increasing the frequency of the schedule
decreases the length of time that files are able to be rolled back.
To configure the schedule:
1. In Windows Explorer, right-click the volume that has VSS enabled
and selects Properties. Click the Shadow Copies tab.
2. Select the desired volume and click Settings. Click the Schedule
button on the Settings window. Notice that, by default, there are two
schedules configured, one running every weekday at 7:00 A.M. and the
other running every weekday at 12:00 P.M.
3. To create a new schedule, click New.
4. To modify an existing schedule, select the schedule from the drop-
down list and then modify the schedule. For additional options, click
Advanced.

Storing Shadow Copies

When shadow copies are enabled, the VSS creates a hidden folder on
the volume called System Volume Information and stores previous
versions of that folder. It is recommended that the shadow copies are
stored on a different volume than where the shared folders reside. You
can alter this by clicking the Settings button on the Shadow Copies tab
on the volume. Simply store the hidden folder on a different drive.

Installing the Shadow Copy Client

Windows Server 2003 natively supports shadow copies; however,
Windows XP Professional, Windows 2000 Server and Professional, and
Windows 98 require a client be installed (twcli32.msi). The client is
available on the Windows 2003 server CD, or you can download the
client at http://www.microsoft.com/windowsserver2003/downloads/
shadowcopyclient.mspx. After the client is installed, Windows Explorer
will display the
Previous Versions tab in the Properties of the file.

(If you would like to test this out on your own computer, you will need
to loopback.
From a run command, type //yourservername.)
Recovering a Previous Version
Let’s assume that a user on the network, Kevin, accidentally saves
over a file on a server.
Kevin now wants to revert the file back to what it was previously. There
are a few options, all using the Previous Versions tab. First, Kevin
navigates to the folder where the file is located and selects the file.
Then he right-clicks the file and selects Properties.
From the file’s properties dialog box, he clicks the Previous Versions
tab. The Previous
Versions tab will display all previous versions of the file back to 64
(remember, only 64 snapshots are kept). Kevin finds the file he wants
to revert to. Now he has some choices:
• View the file If Kevin chooses to view the file, the file is opened in
the application it was created in (such as Word). Kevin can then choose
to save the file to a different location using the Save As command in
the application.
• Copy the file If Kevin chooses to copy the file, he is presented with
the dialog box shown in Figure 3-21 and navigates to a new location.
Kevin clicks Copy to complete the operation.

• Restore the file If Kevin chooses to restore the file, the previous
version will be restored to the current location. When Kevin chooses
this option, he sees the dialog box shown in Figure 3-22. Restoring the
file overwrites the current file and any changes to the file are lost.

Restoring a Deleted File

If you delete the file altogether, there isn’t a previous version to go
back to because you can’t access the file. Now what do you do? Not to
worry: shadow copy not only takes
a snapshot of the files, but of the shared folder as well. So if you delete
a file accidentally, you can restore the file by restoring the shared
folder. Be careful when you restore the folder because other files may
have been changed in the folder and those changes will be lost if you
restore the whole folder.