Creating a shadow copy. Windows operating system restore point

Volume Shadow Copy Service (VSS) provides two features that can save administrators time and hassle. The first is a snapshot (a short-term backup of all files on an NTFS volume). Thanks to snapshot or shadow copy Users can independently recover an accidentally deleted file or correct the consequences of choosing the Save command instead of Save As. VSS is not intended to replace your current archiving strategy, as will be discussed below. The second important feature of VSS is archiving files that are open or locked by an application such as Microsoft SQL Server or Microsoft Exchange.

VSS creates shadow copies on a schedule or on demand. Use VSS in Windows 2003 and for system recovery Vista is simple. This article shows how to set up backups using VSS in Windows 2003 and convert basic disks to dynamic disks without damaging shadow copies. As an administrator implements VSS, you may find the recommendations in the sidebar “Five VSS Tips” helpful.

How VSS works

VSS creates a snapshot of all files on the NTFS volume or source volume. Shadow copies are stored in an area called the shadow copy cache. The volume on which the shadow copy cache resides is called the shadow copy storage volume. The shadow copy cache is usually invisible to users because it is hidden system folder System Volume Information.

By default, the shadow copy cache is created on the source volume, but you can create it on a separate physical disk to improve performance and fault tolerance. Before you enable VSS, you must select a location to store the shadow copy cache because the cache cannot subsequently be moved without losing the snapshots it contains. Additionally, be aware that disabling shadow copies on a volume deletes all existing shadow copies.

VSS can only be enabled on NTFS volumes. You cannot enter or exclude specific files or folders - only all or nothing. Data on mounted volumes is not included in the shadow copy on the parent volume. However, you can enable shadow copies on the mounted volumes themselves. Shadow copies retain both encryption and NTFS permissions, which can cause problems when restoring the file.

Activating VSS

To enable VSS, select My Computer, then right-click the volume on which you want to enable VSS and select Properties. On the Properties page, you need to click on the Shadow Copies tab. If this has already been done, you need to decide whether you want to store the shadow copy cache on another volume on a different disk.

Then highlight the source volume and click the Settings button. In the Settings dialog box, you can select a different volume to store the shadow copy, as Figure 1 shows. You can change the storage area size and schedule (by clicking the Schedule button) if the preset schedule is not suitable. By default, snapshots are generated from Monday to Friday at 7 a.m. and noon. Snapshots should be created as needed, not every hour.

When you have finished configuring your settings, click OK. On the Properties page, you need to click the Enable button to enable shadow copies on this volume. You will be prompted to use the default schedule and settings; You must accept this proposal and click on the Yes button, and then again on the OK button.
Command line utility enthusiasts will benefit from learning how to configure VSS using Vssadmin and Schtasks instead GUI. With Vssadmin you can create, delete, and resize shadow copies, among other operations. Schtasks is used to create, edit and delete assigned tasks.

Disk space requirements. When VSS is enabled, 100 MB of disk space is immediately allocated, and VSS can occupy up to 10% of the size hard drive. Snapshots only reflect changes from the previous snapshot, so they require less storage space than you might think. However, the shadow copy cache can only store 64 copies. If there is not enough disk space or a 65th snapshot is created, the oldest snapshot is deleted to make room for the new one. Due to redundancy when creating snapshots, it is recommended to enable VSS only on volumes that store user data or have the ability to archive open files.

Using Windows 2003 Shadow Copies

To provide client computers with access to previous versions of files, you need the Previous Versions Client application that comes with Vista and Windows 2003. Previous Versions Client can also be installed on Windows XP Professional SP1 (the twcli32.msi file is located in the %Windir%System32ClientsTwclientX86 folder on the CD-ROM Windows 2003 disk), and on Windows 2000 (you need to download the appropriate version from the Microsoft Web site). To install the client program on users' computers, double-click the file to run the installation, or deploy it through Group Policy or Microsoft Systems Management Server (SMS).

Shadow copies are designed for use with the Common Internet File System (CIFS), an extension of the Server Message Block protocol, so to access previous versions of a file or folder on the server you must connect through shared folder. Even after registering with the server, you must use the Universal Naming Convention (UNC) path. For example, to access older versions of a file on a server named UptownDC in the Sales share, click the Start button, select Run, and enter the command

Click OK and then right-click on the required file and select Properties. The Previous Versions tab lists the snapshots and shows the date and time they were created (see Figure 2). There are three options for action: View, Copy and Restore. In View mode, a copy of the file is opened read-only; this is convenient for selecting the desired copy. Restore mode restores the document, its NTFS permissions, and encryption settings to its original location, and overwrites the current version. A safer option is Copy, which copies the file to a new location.

If you need to recover a deleted file, then obviously you can't right-click on a file in a shared folder and select its properties. In this case, you need to go to the folder level. Instead of the UptowndcSales UNC path, the connection is made to the administrative resource of drive C (where the Sales folder is located): UptowndcC$. Right-click the Sales folder, select Properties, and click the appropriate button to view, copy, or restore the entire contents of the folder. If you only need one file, you should copy the folder to a new location, then right-click on the file and work with previous versions of that file.

Vista and Shadow Copies

Vista is the first desktop operating system with built-in shadow copy functionality. Vista shadow copies are part of the system recovery mechanism; these are called restore points. By default, recovery points are enabled on volume C and shadow copies of files are created daily if the volume has at least 300 MB of free space.

The pre-scheduled SR task creates restore points and only activates when the computer has been idle for at least 10 minutes and is running on AC power. If for some reason the SR task does not run at the scheduled time, it will be executed as soon as possible. You can assign recovery points for other volumes. Vista allocates up to 15% of your hard drive space to store restore points.

To set up and manage restore points, click Start, then right-click Computer and select Properties. In the Tasks menu, go to the System protection item. To access System protection you need administrative powers, so when prompted by User Account Control, click on the Continue button.

On the System Protection tab of the System Properties page (Figure 3), you can manually create a one-time recovery point by selecting the volume and clicking Create, giving the recovery point a name, and clicking Create again. The process may take several minutes, depending on the size of the volume, but once completed, you will receive a success confirmation. If the creation of recovery points for a volume is automated, Vista creates a new recovery point for the volume every day and at system startup.

Accessing previous versions of files and folders in Vista is the same as when accessing through a shared Windows folder 2003 from client installed application Previous Versions Client. But Vista users can access past versions of files and folders locally. Just open it Windows Explorer, right-click the file or folder, select Properties, and then click the Previous Versions tab (Figure 4). The options are the same as previous versions of the Previous Versions Client and function in the same way.

VSS and storage area networks

Another important advantage of VSS is Windows Server 2003 Enterprise Edition and Datacenter Edition - the ability to quickly and easily copy and move data across a SAN. VSS can create a shadow copy of a multi-terabyte volume that can be exported from the SAN and imported onto the server in just a few minutes, moving large amounts of data very quickly. Each storage system manufacturer implements this feature differently, so please contact your vendor for details.

Setting up VSS configuration

For volumes with VSS, the recommended cluster size is at least 16 KB. VSS records are converted to 16KB files in blocks. On volumes between 2 and 4 TB, the default cluster size is 4 KB. But for clusters smaller than 16 KB, the VSS provider cannot determine whether the file has been defragmented or modified. Therefore, VSS treats a defragmented file in the same way as a modified one - it generates a new shadow copy of the file. After defragmenting a disk with small clusters, the shadow copy cache can grow very quickly and overwrite existing shadow copies. Additional information this can be found in the Microsoft article “Shadow copies may be lost when you defragment a volume” at http://support.microsoft.com/kb/312067.

You can find out the size of a volume's clusters by using the Fsutil command. For example, to find the cluster size of volume C, enter the command

fsutil fsinfo ntfsinfo C:

If the cluster size is less than 16 KB and you want to increase it, you must back up the data, reformat the volume to a larger cluster size, and then restore the data. It should be noted that the file compression mechanism in NTFS only works for 4 KB clusters, so you have to choose between compression and VSS.

Interaction between NTBackup and VSS

In the past, a file that was opened or locked by a service or application during backup was not backed up, causing problems if administrators needed to restore it. Data consistency is extremely important when working with applications that open many files at once, such as databases. If you have many files open during archiving, there is a high chance that during the time between copying the first and last file to last file changes have occurred. In this case, the data in the restored database appears inconsistent.

The Windows 2003 backup utility, NTBackup, uses VSS to ensure that backup copies are complete and consistent. VSS communicates with the recording component of the application associated with the file. The recording component protects application data and provides information, such as data location and archiving and recovery methods. Applications without a recording component cannot interact with VSS. In the worst case, an administrator might try to restore an important file and discover that it is not there at all: it was never archived because the application cannot communicate with VSS. Windows 2003 has writing components for AD and NTFS. To find all available recording components on the server, you need to enter the command

vssadmin list writers

When you run NTBackup on Windows 2003, the utility prompts you to enter a list of all recording components known to VSS. VSS not only lists the recording components, but also provides all known metadata about them, including the backup and recovery methods used in the recording component. VSS uses metadata to determine which applications support shadow copies. When NTBackup requests VSS to create a shadow copy, VSS sends a message to known write components to freeze all data writes, create a shadow copy, and store it in a delta file. The differential file tracks changes since the last shadow copy was created. The backup is performed using data from the differential file.

Monitoring VSS performance

Monitoring shadow copies using Performance Monitor in Windows 2003 can help prevent potential problems before they affect users. For example, system monitor warns that the disk space used for shadow copies is approaching the maximum allowed amount. By default, Performance Monitor does not contain objects or counters that track shadow copy characteristics, but administrators can enter them themselves. Instructions for creating counters are given in the Microsoft article "Add counters to System Monitor", published at http://technet2.microsoft.com/windowsserve...3.mspx?mfr=true.

Using the Volperf utility (with the /install switch) from the resource set Microsoft Windows The Server 2003 Resource Kit can be extended to Performance Monitor with shadow copy objects and the following counters:

% Disk Used by Diff Area File: The percentage of disk space used by all difference files on the volume;
Allocated Space (MB): Memory space (MB) allocated to a specific volume;
Maximum Space (MB): The maximum space (MB) allocated for the shadow copy storage volume;
Nb of Diff Area Files: number of difference files;
Nb of Shadow Copies: number of shadow copies in the shadow copy cache;
Size of Diff Area Files: total size of difference files for the selected volume;
Used Space (MB): Amount of space (MB) used in the shadow copy storage volume

Converting a basic disk to dynamic and VSS

Sometimes it is useful to add an extra layer of hardware fault tolerance by creating a mirror set. Mirror sets can only be built on dynamic disks, so the basic disk must be converted to dynamic. The documentation states that converting disks from basic to dynamic does not result in data loss. However, the documentation does not say that if the conversion is incorrect, existing shadow copies may be deleted. If the source volume and the shadow copy cache are located on different volumes, then conversion may be difficult. For more information about the differences between basic and dynamic disks, see Disks for Windows servers- basic or dynamic type", published in Windows IT Pro/RE No. 1 for 2003.

The procedure you use to convert a VSS-compatible basic disk to a dynamic disk depends on the location of the shadow copy cache on the boot volume.

Scenario 1- The shadow copy cache is not located on the boot volume. If the shadow copy cache is not on the boot volume, you must first unmount the source volume (the volume on which the snapshot was taken) using the Mountvol command-line utility with the /P option (/P unmounts the volume). Next, you should convert the volume containing the shadow copy cache to a dynamic volume. From this moment the countdown begins: the administrator has only 20 minutes to mount the source volume using the Mountvol utility or the Disk Management snap-in of the MMC management console. If the source volume is not mounted within 20 minutes, all shadow copies will be lost. Finally, bring the source volume back online and convert it to a dynamic volume.

Scenario 2- The shadow copy cache is located on the boot volume. If the shadow copy cache is on a boot volume, you can simply convert the volume containing the shadow copy cache to dynamic. It is not necessary to dismantle it first. Then reboot the server twice and convert the source volume to a dynamic volume.

Beneficial to the end user - beneficial to the administrator

It's nice that Microsoft is releasing new tools to restore desktop performance. operating system both for IT specialists and for end users. The fewer backup tapes an administrator has to load, the easier his job is, and Vista's recovery points are a step in the right direction. In addition, thanks to VSS, users have the ability to control the file recovery process. But careful planning and management is a must to fully realize the benefits of VSS.

Five VSS Tips

When implementing VSS or preparing Vista restore points, we recommend that you do the following:

1...Before you enable VSS recovery points, select a storage location for your shadow copies. Remember that you cannot move them later.
2...Placing VSS on a system or boot volume is a bad decision. Operating system files change frequently, so the number of shadow copies on a boot volume is usually large.
3...The optimal cluster size for VSS is 16 KB.
4...Storing the shadow copy cache on a physical disk other than the source disk improves performance and fault tolerance.
5...Neither VSS nor recovery points can replace a complete backup solution.

Volume Shadow Copy Service (VSS) stores recovery points and supports file backup and recovery using a snapshot mechanism called shadow copies. VSS creates static copies open files and applications that are otherwise too volatile to be backed up.

Sounds convincing, but VSS takes away a large number of disk space. To get started, use the "vssadmin" command to see how much space the current volume shadow copies are using with the "vssadmin list shadowstorage" command. (For more detailed information Click the "Start" button, type cmd in the search bar, and then type vssadmin /? for help).

In the screenshot below, recovery points for drives C: and D are activated; There are also shadow copies on these same disks. Let's see how much disk space is wasted on shadow copies of these drives: 22.079 GB on drive D: (total volume: 149 GB; volume occupied by shadow copies = 15.5%) and 64.448 GB on drive C: (total volume: 465 GB; volume occupied by shadow copies = 14.9%).

At one point, we found only 230 GB of free space on the 465 GB C: drive, even though we knew for sure that it contained only 120 GB of files. The search for the missing 115 GB led us to the Volume Shadow Copy Service. We again used the "vssadmin list shadows" command (we did not show the result here because it is very long: it lists all the shadow copies on the disk) and found out that one of the shadow copies takes up 85 GB! Since we were recently copying a large collection of music files from an old 200GB USB drive to our new, faster SATA drive, VSS apparently created a shadow copy of those files at the same time it copied them to a user-accessible folder.

How to get rid of this unnecessary shadow copy? By default, Vista allocates 15% of disk space to shadow copies, but the operating system does not strictly limit the total size of shadow copies. If the shadow copy needs more space, Vista will be happy to provide it. Using the vssadmin command line utility, you can set a clear disk space limit for shadow copies. Here's how to do it:

Vssadmin resize shadowstorage /For=T: /On=T: /MaxSize=Num

Instead of the letter "T", substitute the name of your disk and replace "Num" with a number equal to 15% of the capacity of this disk. In the case of our C: drive, this command will look like this:

Vssadmin resize shadowstorage /For=C: /On=C: /Maxsize=69GB

Before using this trick, take a backup of your system and create a restore point immediately after rebooting your system. After running the above command, Vista automatically deletes the oldest restore points first until it reaches the limit you set.

This article will discuss the built-in ability to restore the operating system. Windows family. It is not uncommon that after installing a program or game, the system stops starting or does not work correctly. In this case, Windows provides recovery by returning to the previous state.

System restore - operating system component Windows systems, designed to restore the operating system by rolling back system files, registry keys, installed programs.

Windows optimization myth

Most users believe that if you refuse to perform a system restore, you can save money system resources, such as RAM and hard drive space. Alas, this belief was true until progress reached its current scale, for example, the Windows 7 operating system will no longer notice much of a difference “before and after” disabling the services responsible for recovery. It's all about the amount of RAM and hard drives used.

• A system restore checkpoint is data that stores information about the state and all settings of the operating system, as well as the programs installed on it. A point-in-time recovery checkpoint is created.

In Windows 7, restore points are created automatically: - according to a schedule; - during installation compatible applications and drivers; - during installation Windows updates Update; - when restoring the system to one of the previous points. You can also create a restore point manually at any time.

Note ! The amount of disk space allocated for Volume Shadow Copy Service and recovery point storage depends on the capacity of the hard drive partition.

• Volume Shadow Copy is a Windows operating system service that allows you to copy system and locked files that are in this moment time the work is underway. This service monitors changes across the entire hard drive partition.

Volume Shadow Copy Service keeps 3 percent of the hard drive partition's capacity if it is less than 64 GB and 5 percent or 10 GB if it is larger than 64 GB. When the disk space allocated for the Volume Shadow Copy service runs out, the old points are deleted and replaced with new ones.

You can go to system protection settings by right-clicking on the “Computer” icon on the desktop and selecting “Properties” and “System Protection” in sequence.

In the window that opens, you can configure the protection of previous versions of files together with system settings or separately, the disk space allocated for storing recovery points, or delete recovery points.

Note ! Even if you deleted a file in the Recycle Bin and then emptied it, you have a good chance of restoring it by returning the computer to a previous state. And all this thanks to the volume shadow copy service.

Note! Windows 7 has the ability to control the space allocated for system protection, that is, you can set the maximum amount of disk space for shadow copy storage. Which significantly increases your chances of system recovery.

System Restore can be started in several ways:

1. In the Start menu, expand the All Programs list. After that, you need to open the “Standard” folder, and then opening the “System” folder, execute the “System Restore” command
2. In the “Backup and Restore” section of the control panel, click “Restore system settings”;
3. Open Control Panel - System - System Protection and click the "System Restore" button.
   In the “System Restore” window, you can return to the last created restore point or select any other one from the available ones. Here you can find out which programs will be affected by the changes during recovery. To do this, select a restore point and click the “Search for affected programs” button.
4. In addition, system recovery can be launched from the Windows RE (Recovery Environment), which is created automatically during Windows installations 7 and provides the following features: - Startup recovery in automatic mode corrects problems that prevent booting Windows 7. This remedy can be used if boot files damaged or overwritten by the bootloader of another operating system; - System Restore allows you to return to the point created before the problem occurred. Sometimes this tool also allows you to restore the system startup; System Image Recovery is a wizard that walks you through the steps of restoring a system from an image previously created by Windows archiving; - Diagnostics Windows memory checks RAM for errors. As a rule, the visible manifestation of errors in random access memory is blue screen(BSOD).
   • To start the environment Windows recovery After turning on the computer, use the F8 key to enter the menu of additional operating system boot options. By selecting the “Troubleshoot your computer” menu item, we launch the recovery environment, where the first thing we will be asked to do is select a keyboard layout. Select the language in which the administrator password is set. After entering the password, we are taken to a window with recovery options, where we are interested in the second item “System Restore”.
   • You can also boot into the recovery environment from the installation Windows disk 7 or a system recovery disk, which you will need to create first.
5. In addition to the above options for accessing recovery functions, there are a number of other options. One of which is CCleaner program from the Piriform developer company. After installing this universal system optimization and configuration tool, go to the “Service” section in which you will find the “System Restore” item. The latest restore points will be displayed in this area. The table will indicate the name of the point, as well as the date and time. Depending on the version of the program, the event during which the point was created is also possible.

Instead of an afterword

As you can see, standard operating system recovery tools are a good option for constantly monitoring the safety of data. Also this service is the key to stable work Windows, you shouldn't give up this feature.

Apparently, there is no need to say that many (if not absolutely all) users have heard that Windows systems have a so-called volume shadow copy service. Of course, not all ordinary users clearly understand what kind of tool this is, what it is used for, how to manage it and how to configure it. Meanwhile, there is nothing particularly complicated here. Let's try to look at the Windows Volume Shadow Copy service, giving the simplest and most understandable explanation. In principle, despite such a seemingly abstruse name, this tool is familiar to everyone without exception, and many encounter it quite often when unexpected failures or critical errors when automatic or manual start its restoration. But first things first.

What is Volume Shadow Copy in Windows?

Let's start by understanding the essence of this tool, which is available in all the latest Windows systems. To understand what a volume copy service is, let's try to do some analysis of this phrase, finding out what exactly it can correspond to in the simplest interpretation. A volume refers to a disk or logical partition. Apparently everyone knows this. As for shadow copying, roughly speaking, it can be interpreted as creating a copy in a mode invisible to the user, often called background.

Thus, it is not difficult to guess that this component is the most common means of creating a backup copy of a disk or partition and saving it in a special reserved area. That is, this is a kind of recovery point from a copy, and this applies not only to the operating system with working parameters, but also to saved user files. Many people have noticed that when a rollback is launched, not only Windows with the programs installed at that time is restored, but also the user’s files.

How it works?

Now a few words about how it all works. The fact is that when the shadow copy service is activated (either in automatic mode, set by default, or manually), data is saved exactly in the partition for which it is active. In the case of a system partition, saving will be done exactly there.

There is an invisible area on the disk intended for placing copies made into it (if you like, some snapshots of the state at a certain moment), for which the operating system itself reserves about three percent of its total volume in the selected partition, which, by the way, in most cases taken into account when one of the conditions for correct operation of the system is the presence of at least five to ten percent of free space on system disk.

That is why it is not recommended to clutter up the “C” drive, and as a preventative tool, regularly use standard disk cleanup, in which, when accessing actions with system files, free up additional free space This is possible just by deleting all backups (restore points). As you can already guess, if they are completely cleaned, rolling back the system to some previous state will become impossible.

Along the way, it is worth paying attention to the fact that if you disable the shadow copy service, you can bring the system into a working state when starting from removable media, if there is damage to system files or problems with the bootloader. But there is no way to restore user files and previously installed programs.

How practical is it to keep the service active?

Based on the above, it becomes obvious that for quick recovery of the system, programs, and files, you should not disable this component. At least for the system partition - that's true. Indeed, in most cases, the main software components of applications installed by the user are stored on the “C” drive in folders like Program Files and ProgramData. In some cases, even when installing a program into a logical partition, the main libraries necessary for its operation in Windows environment, are registered in the system partition (of course, only if the application is not portable).

For logical drives, by and large, volume shadow copying can be disabled completely painlessly, since they have nothing to do with the operation of the operating system (except for the cases described above). Actually, the whole setup consists only of enabling or disabling this component, as well as specifying for which partitions backups will be saved, and how much space will be reserved on the disk or in the partition for saving them (it all depends here, if you want , from your generosity or greed). However, even when volume shadow copying is activated, it is not recommended to be overly involved in allocating space for the created snapshots of the disk state, since subsequently, if the partition is excessively full, the system will simply have nowhere to save other important data (for example, the same system cache files or cached data of running programs).

How to enable and configure a service in Windows 7 and higher in the simplest way?

Now let's see where the custom options for this toolkit are. The easiest way to access shadow copy settings in Windows 7 or any other system is by selecting the system protection item, after which you will be automatically redirected to the appropriate tab.

Here, in a special window, all currently active disks and partitions will be shown, for which you can view the shadow copy status a little to the right.

As mentioned earlier, there are not many settings here. After clicking on the corresponding button, you can enable or disable the service for the selected partition, and also use a special slider to increase or decrease the reserved space. You can also delete all previously created images (backups).

How to create a restore point using Windows?

In the main parameters of the protection state, there are also buttons for starting an immediate system recovery and creating a checkpoint in manual mode. Please note that, firstly, after deleting all the points for the system partition, rollback will be impossible, and secondly, you can manually create a rollback point only for the disk or partition for which shadow copying is enabled.

As a rule, the entire process takes literally a couple of minutes, and restarting the computer or laptop after completing all operations is not required.

How to view all shadow copies and rollback via command line?

Now we should dwell a little on issues related to viewing all available rollback points, because usually you can select one of them only at the recovery stage, expanding the entire list. This can also be done in the system itself, but few ordinary users know about such methods. At the initial stage, if volume shadow copying is enabled in Windows 7 or any other OS of this family, you should go to the command line and run it as an administrator (such rights are not needed to view points, but may be required to restore the system).

To view VSS snapshots (and these are exactly the same backups), you need to enter the vssadmin.exe list shadows command, after which all control points will be displayed on the screen, for each of which the time and date of creation will be indicated, as well as a special identifier in curly brackets.

With the desired copy, not everything is so simple. The point here is that you first need to mount a separate virtual drive (disk). To do this, use the basic command vshadows -el=(identifier),Z. In this case, the ID value specified above is entered as an identifier, and Z corresponds to the letter of the virtual partition being created. If you need to mount the created disk, use the mountvol Z:\ /D command.

Using other Windows tools and optimization programs

It is clear that with command line Many users do not like or do not want to work due to the complexity of the tools used. Therefore, to configure shadow copying in Windows, you can use other means of the system itself, which turn out to be no less effective. Not to mention several options for launching a rollback with or without restoring system files, the simplest way to enable or disable this tool can be done in the services section (services.msc).

In the editor you need to find the corresponding service, go to its settings using a double click or the RMB menu, after which, say, to deactivate shadow copying you need to perform several actions, but always in the following order:

• stop the service by pressing the appropriate button;
• From the list of launch modes, select a disabled launch type.

After this, you should, again, be sure to save changes to the installed parameters, and then perform a complete reboot of the system.

If shadow copying is activated, the steps are performed in the reverse order. But to restore system parameters standard remedy It’s better not to use it, but to give preference to the archiving and recovery section, where there is a corresponding item.

As for creating shadow (backup) copies or deleting them and starting recovery, for such purposes you can use various kinds of optimizers, in which such functions and modules are provided initially.

Additional control methods

It goes without saying that you can start or disable this service using the settings group policies or even by changing the corresponding system registry keys. However, for the average user, such a technique may turn out to be somewhat more complex than actions with a single service, and you will have to dig around in the same registry to find the necessary parameters, and the matter may not be limited to just the main key for activating or disabling the service (for example, Deleting copies can only be done by completely erasing the corresponding records, but finding them can be extremely problematic). But even after deactivating the main service, you will have to search for the corresponding files on the disk or in a logical partition in order to get rid of them yourself. This is why using such a manual mode looks extremely cumbersome.

Digressing a little from the topic, it is worth mentioning separately that group policies and the registry basically have the same settings, which are duplicated in both editors with different visualization of the presented parameters. And if in policies at the stage of saving installed options you can still refuse to apply the set parameters, then in the registry this option is not provided, since when you exit the editor, the options are saved automatically. In addition, interfering specifically with the system registry without the necessary knowledge can lead to irreversible and catastrophic consequences for the entire system as a whole. Its priority is higher than that of group policies, so changes made in the registry are returned to the policies in the initial state will not work (such actions will simply be blocked). So this also needs to be kept in mind.

What should I do if the shadow copy service does not work or gives errors?

Finally, let's look at some possible problems, which may arise in the operation of this tool. Let's start with the simplest thing. The most common Volume Shadow Copy error is due to the fact that the component itself is in an inactive state (either it is disabled in the standard settings, or in the services section, or in policies, or in the registry). As a rule, even if in system registry may contain a key whose value corresponds to the deactivated state of the service; the most common way to enable this component in the settings described above helps. In addition, if the backups were not deleted, system restore may work.

But what to do if the volume shadow copy service does not work or works, but with obvious failures? It may well be that this problem is caused only by the fact that there is not enough space on the disk or logical partition to save copies. In this case, we are talking about the fact that the reserved area is full. In this situation, it is advisable to delete those copies that are not needed or are outdated, and leave only one selected one that contains the necessary operating parameters of the system or links to user programs and files. As is already clear, getting rid of all pictures is extremely undesirable. It is advisable to use such actions only if recovery only involves bringing Windows back to life if it is impossible to boot from removable media, but user applications and files are not taken into account (cannot be restored). Just in case, in order not to delete any important system components, you can use standard disk cleanup, but in this case, if the option to delete backups is checked, they will be erased every single one. So, be careful.

Very often, a shadow copy error, oddly enough, can manifest itself in server Windows versions if they use SharePoint Foundation components. In this case, the problem may be the so-called parallelism of copy creation, when there is a conflict between the real and the created, for example, using the Hyper-V module toolkit. As one of the simplest solutions, many users cite executing the vssadmin list writers line in the command console and then rebooting the system two or three times.

If volume shadow copy does not work due to problems with SharePoint Foundation (or rather, with a special service pack) when creating snapshots in SBS 2011, it is recommended to run the special “SharePoint Configuration Wizard” from the Start menu, twice press the continue buttons without changing anything in the parameters, and at the end - the “Finish” button. After this, you will need to reload the backup and run it again.

Sometimes, although not often, problems with the performance of shadow copy tools can occur when using SQL server databases. In this situation, as evidenced by reviews from some users, partial deletion of unnecessary or unused databases helps, after which copying starts again in normal mode.

Brief conclusions

So, it's time to summarize all of the above. Apparently, many have already realized that there is nothing particularly difficult in understanding what shadow copying tools are. Another thing is that questions immediately arise about a clear decision in favor of enabling or disabling this service. Here - at will. But based on practical considerations, for the system partition, even using standard settings, it is better to leave this operating system function enabled. But for logical partitions in which only some files can be stored, it can be disabled (as a last resort, you can always copy the necessary data to some kind of removable media).

As for errors in the operation of the corresponding service, they are extremely rare in user desktop systems and are mostly associated with an unforeseen accidental shutdown of the service responsible for creating backup copies, which is not difficult to activate even using the simplest methods described above.

And one last note. If you still have problems with recovery even with System State Backup enabled, be aware that the backup snapshots themselves may be damaged. But most often, this situation with notifications that an unexpected failure has occurred occurs due to violations of the integrity of important system files. To restore them when starting from removable media such as a LiveCD or the original installation media with the system distribution, use the command line and run the sfc /scannow command in it. If this does not work, restore or rewrite the bootloader using the Bootrec.exe tool, adding each time, separated by a space after the main command, the following attributes in the specified sequence:

• /FixMBR.
• /FixBoot.
• /RebuildBSD.

As a rule, this technique allows you to completely restore the loading of the operating system even if critical failures occur, after which you can set a rollback from the existing copy(s) in manual mode. If the system still cannot boot, try using safe start with the call boot menu by pressing the F8 key (in Windows 8 and 10 this method does not work, so you will need to use additional menus or switch the boot mode to legacy in the command line).

Important: This article is intended for the case when the computer is configured with standard backup in Windows 7.

Recovering files from Windows shadow copies

Have you ever discovered that a file you needed has been deleted? That some time has passed and the file has disappeared somewhere? Of course, there can be many reasons for this. But, usually at such moments, the first thing that worries us is another question than the reason - “How to restore it now?” If you are a regular reader of the site, then you probably have backup programs installed and configured that will allow you to restore the missing file.

But what to do if you don’t have such programs, or it’s too late to restore, since the program synchronized the copy with the original and erased this file. What then? Of course, you still have the opportunity to use programs to recover deleted files, but usually this is a rather lengthy procedure that should only be used when there are no other options left. So where should you start?

If you have set up a standard Windows backup via the Backup and Restore interface (see link), or you have created restore points, then you still have the opportunity to relatively quickly restore a deleted file. The fact is that Windows 7 creates so-called “shadow copies” of files that are accessible from the “previous versions” interface. These shadow copies store not just one copy of a file, but several previous versions of it. It is this fact that allows you to use the following two methods.

Recovering a deleted file from a shadow copy of the parent directory in Windows

1. Follow the procedure described in the previous article (at this link) to open a list of previous versions for the folder that contained the deleted file
2. Select previous version directory so that you can be sure that the file is currently in the directory. Otherwise you will have to iterate through versions until the first successful one
3. You can click the "Copy" button to save an entire copy of the folder and restore the deleted file from it. If you click the button, a dialog box will appear in which you need to specify a location to save. But, you must understand, such an operation may take time if the directory takes up a lot of space
4. You can also click the "Restore" button so that all files in the folder are rolled back to the selected version. But keep in mind that this may change other files
5. If you are not satisfied with both of the previous options, then you can click on the “Open” button, and the entire list of files of the selected backup will open to you. You can drag or copy the remote file wherever you need it
6. After you restore the file using one of the methods, close the dialog box

Recovering a deleted file from a shadow copy by its name in Windows

1. Create empty file with the same name and extension as it was remote file, and place it in the source directory. File contents don't matter
2. Right click on an empty file
3. IN context menu, select "Properties"
4. Go to the "Previous Versions" tab
5. If you're lucky, the entire list of backup copies of the deleted file will appear in front of you. In this case, it all depends on the circumstances
6. Select the backup you want (probably the most recent one) and click the "Restore" button
7. Close the dialog box

Both of these methods can be used. The only thing you must understand is that the recovered file will not necessarily be the same latest version, since backups do not occur constantly, but at certain points in time.

• Windows updates (hotfixes) are not installed? The .Net framework cleanup and repair utility can help

Technical Tips