Simplify File Recovery with Volume Shadow Copy Service

As an administrator, how often have you had to restore a single file for a user who has deleted a file by mistake? How often have you had to restore a single file because a user has saved a new version of a file over the old one before realizing that they didn't want to save changes? If the environments you work in are similar to mine, the answer to these questions is "too often."

VSS works by making periodic copies of files from shared folders, and then storing those copies for later retrieval.

While we all realize the importance of making reliable backups, the reality is that restoring one or a small number of files from a backup tape can be a time consuming and potentially awkward task. Users sometimes ask for the wrong file to be restored, or even decide after restoration that in fact they don't want the restored file. It is enough to make even the most seasoned administrator reach for the (insert chosen 'tonic' here).

The answer to this problem of restoring files is addressed, to some degree, by a tool in Windows Server 2003 called the Volume Shadow Copy Service (VSS). VSS works by making periodic copies of files from shared folders, and then storing those copies for later retrieval. Files are stamped with the date and time when they were copied, so it's easy to figure out what file you should recover if the need arises. 'Shadow' copies of the files are stored until the amount of space taken up by the files reaches a certain threshold (which you can configure). At that point, the files are deleted on an age basis from oldest to newest. Prudent use of VSS can reduce the amount of time it takes to restore files, as well as providing another line of defense against potentially damaging loss of data.

Enabling Volume Shadow Copy

The process of enabling VSS is straightforward. First, while logged on as Administrator, click Start, My Computer and then locate the drive on which you want to enable VSS. Right-click the icon for the drive, and select properties. Then, click the Shadow Copies tab. You will the see the screen shown in Figure 1. Note that VSS only works on drives formatted with NTFS.

Figure 1. (Click for a larger image)

As you can see from the screenshot, shadow copies are disabled, which is the default. This screen also details the number of shares on the drive, which is important, as only shadow copies of the files in those shares are created automatically. Let's say that again: Only shadow copies of the files in those shares are created automatically. The need to reinforce this point comes from the fact that for files outside of shares, you are still completely reliant on your backup procedures. Sometimes administrators enable VSS and then adjust their backup schedules because they figure VSS will take care of backups in the meantime. A few have found out the hard way that this is not a good strategy.

Anyway, back to the process. Before enabling VSS, it is worth first looking at and understanding the configuration options associated with the feature. You can see the settings for VSS by clicking on the Settings button, found on the Shadow Copies tab. The Settings screen is shown in Figure 2.

Figure x. (Click for a larger image)

The first, and perhaps most important parameter you can configure is the drive on which the shadow file copies will be stored. The default is to store them on the same drive that the share is on, which may or may not be practical. The creation of shadow copies can create significant disk activity, so creating shadow copies on an already heavily used drive is not ideal. You can select a different drive by using the drop down box on this page.

You can also configure how much space can be used by the VSS process. The minimum requirement is 100MB, but the amount of space you need to allocate depends on the size and amount of files you want to provide shadow copy service to, and how far back you want to go in terms of copies. VSS supports a maximum of 64 versions. There are really no guidelines to determine the appropriate amount of required disk space, but figure that keeping a large number of large files for a considerable length of time will take a significant amount of space. Of course the converse applies too.

Another thing that will dictate the amount of space required for shadow copies is the frequency at which copies are taken. In the default configuration, a copy is taken at 7:00 a.m. and 12:00 p.m. on all weekdays, but no copies are created on weekends. This schedule is completely configurable and can be accessed by clicking the Schedule button. Again, before doing something drastic like enabling copies to be taken on every hour of every day, consider just how much disk space you will need to accommodate the files. Also consider how much processing burden will be placed on the server each time it creates a shadow copy. If the files are big and many, there may be a noticeable impact on performance.

Figure 3. (Click for a larger image)

Once you have configured your schedule and are happy with your other settings, click OK to return to the Properties page for the drive. Now, to turn VSS on, simply click the Enable button. If you did not alter the default schedule settings, an information message appears cautioning you about the high I/O load that can be created by VSS. After reading the message and clicking Yes, the system goes about the task of creating shadow copies of the files in the shares on your selected drive. Depending on the size and quantity of files, this step may take some time to complete. When the initial shadow copy is complete, an entry is added to the Shadow copies of selected volume area of the Shadow Copies tab. You can see an example of this in Figure 3.

That's all there is to it. You have now enabled Volume Shadow Copy. Next, you'll need to access the files created by the process. We will look at the process of doing this in Part Two of this article. Until then!