Using the Volume Shadow Copy Service

The Windows Server 2003 Volume Shadow Copy service (VSS) is a new feature available for volumes using NTFS. VSS is used to perform a point-in-time backup of an entire volume to the local disk. This backup can be used to quickly restore data that was deleted from the volume locally or through a network mapped drive or network file share. VSS is also used by the Windows Server 2003 Backup program to back up local and shared NTFS volumes. If the volume is not NTFS, Volume Shadow Copy will not work.

VSS can make a point-in-time backup of a volume, including backing up open files. This entire process is completed in a very short period of time but is powerful enough to be used to restore an entire volume, if necessary. VSS can be scheduled to automatically back up a volume once, twice, or several times a day. This service can be enabled on a volume that contains DFS targets and standard Windows Server 2003 file shares.

Using VSS and Windows Server 2003 Backup

When the Windows Server 2003 Backup program runs a backup of a local NTFS volume, VSS is used by default to create a snapshot or shadow copy of the volume's current data. This data is saved to the same or another local volume or disk. The Backup program then uses the shadow copy to back up data, leaving the disk free to support users and the operating system. When the backup is complete, the shadow copy is automatically deleted from the local disk. For more information on VSS and Windows Server 2003 Backup, refer to Chapters 32 and 33.

Configuring Shadow Copies

Enabling shadow copies for a volume can be very simple. Administrators have more options when it comes to recovering lost or deleted data and, in many cases, can entirely avoid restoring data to disk from a backup tape device or tape library. In addition, select users can be given the necessary rights to restore files that they've accidentally deleted.

From a performance standpoint, it is best to configure shadow copies on separate disks or fast, hardware-based RAID volumes (for example, RAID 1+0). This way, each disk performs either a read or write operation for the most part, not both. Volume Shadow Copy is already installed and is automatically available using NTFS-formatted volumes.

To enable and configure shadow copies, follow these steps:

1.	Log on to the desired server using an account with Local Administrator access.
2.	Click Start, All Programs, Administrative Tools, Computer Management.
3.	In the left pane, if it is not already expanded, double-click Computer Management (Local).
4.	Click the plus sign next to Storage.
5.	Select Disk Management.
6.	Right-click Disk Management, select All Tasks, and select Configure Shadow Copies.
7.	On the Shadow Copies page, select a single volume for which you want to enable shadow copies and click Settings.
8.	The Settings page allows you to choose an alternate volume to store the shadow copies. Select the desired volume for the shadow copy, as shown in Figure 30.21. Figure 30.21. Selecting an alternate drive to store the shadow copies.
9.	Configure the maximum amount of disk space that will be allocated to shadow copies.
10.	The default schedule for shadow copies is twice a day at 7 a.m. and 12 p.m. If this does not meet your business requirements, click the Schedule button and configure a custom schedule.
11.	Click OK to enable shadow copies on that volume and to return to the Shadow Copies page.
12.	If necessary, select the next volume and enable shadow copying; otherwise, select the enabled volume and immediately create a shadow copy by clicking the Create Now button.
13.	If necessary, select the next volume and immediately create a shadow copy by clicking the Create Now button.
14.	After the shadow copies are created, click OK to close the Shadow Copies page, close the Computer Management console, and log off the server.

For more detailed information concerning the Volume Shadow Copy service, refer to Chapters 32 and 33.

Recovering Data Using Shadow Copies

The server administrator or a standard user who has been granted permissions can recover data using previously created shadow copies. The files stored in the shadow copy cannot be accessed directly, but they can be accessed by connecting the volume that has had a shadow copy created.

Note

The Shadow Copies for Shared Folders Restore Tool (VolRest), located in the Windows Server 2003 Resource Kit, is a command-line tool that can be used to restore previous file versions. The Shadow Copies for Shared Folders feature must be enabled to use this tool to restore previous versions of files.

To recover data from a file share, follow these steps:

1.	Log on to a Windows Server 2003 system or Windows XP SP1 workstation with either Administrator rights or with a user account that has permissions to restore the files from the shadow copy.
2.	Click Start, Run.
3.	At the Run prompt, type \\servername\sharename, where servername represents the NetBIOS or fully qualified domain name of the server hosting the file share. The share must exist on a volume in which a shadow copy has already been created.
4.	In the File and Folder Tasks window, select View Previous Versions, as shown in Figure 30.22. Figure 30.22. Using shadow copies to view previous file versions.
5.	When the window opens to the Previous Versions property page for the share, select the shadow copy from which you want to restore and click View.
6.	An Explorer window then opens, displaying the contents of the share when the shadow copy was made. If you want to restore only a single file, locate the file, right-click it, and select Copy.
7.	Close the Explorer window.
8.	Close the Share Property pages by clicking OK at the bottom of the window.
9.	Back in the actual file share window, browse to the original location of the file, right-click on a blank spot in the window, and select Paste.
10.	Close the file share window.

Managing Shadow Copies

Volume shadow copies do not require heavy management, but if shadow copies are on a schedule, the old copies need to be manually removed. You can use the Shadow Copies windows available through Disk Manager or automate this task by using a batch script and the utility Vssadmin.exe.

To delete a shadow copy using Disk Manager, follow these steps:

1.	Log on to the desired server using an account with Local Administrator access.
2.	Click Start, All Programs, Administrative Tools, Computer Management.
3.	In the left pane, if it is not already expanded, double-click Computer Management (Local).
4.	Click the plus sign next to Storage.
5.	Select Disk Management.
6.	Right-click Disk Management, select All Tasks, and click Configure Shadow Copies.
7.	Select the desired volume in the Select a Volume section.
8.	In the Shadow Copies of Selected Volume section, select the shadow copy you want to delete and click the Delete Now button.
9.	Click OK to close the Shadow Copies window, close the Computer Management console, and log off the server.

To delete the oldest shadow copy from the D: volume, at a command prompt, type the following command and then press Enter:

Vssadmin.exe Delete Shadows /For=D: /Oldest

Vssadmin.exe can be used to create, delete, and manage shadow copies. For more information on this tool, refer to Chapter 32.

Note

The Windows Server 2003 Resource Kit contains performance counters (Volperf) for VSS and can be used in conjunction with the System Monitor to monitor shadow copies.