Shadow Copies

Implementing Shadow Copies Shadow copies are a new feature in Windows 2003 that enables users to retrieve files that may have been altered or deleted. Shadow copies are implemented to solve one of the following scenarios: • Accidental file deletions • Accidental overwrites of a file (clicking Save instead of Save As) • File corruption The Volume Shadow Copy Service (VSS) is the driving force behind shadow copies. When the VSS is enabled on a volume, it takes snapshots of files at intervals and stores them for later retrieval. (You can alter the interval as you see fit.) A user can view previous versions of a file and restore a previous version if necessary. When a user accesses a file over the network, they will see a Previous Versions tab on the Properties of the file, as shown in Users can then restore a previous version of the file all by themselves. VSS is the service that makes shadow copies possible. VSS also makes itself available to applications that are equipped to take advantage of the service, such as the Backup utility for Windows, which can now back up open files by using VSS. Shadow copies are primarily intended for situations in which a user has accidentally deleted a file or overwritten the file and need to revert back to a point in time. Shadow copies by themselves are not a backup solution. A separate backup solution should be part of the overall management strategy. How the Volume Shadow Copy Service (VSS) Works When shadow copies are enabled on a volume, an interval is specified. If no interval is configured, VSS uses the default interval of twice per day. At the specified interval, VSS takes a snapshot of the shared folders and the contents. It does not make a backup of the files at that time. When a user opens a file, works on the file, and saves the file back to the original location, VSS uses the snapshot taken earlier to recognize that a file has changed. The VSS then makes a full copy of the file as it was at the interval and saves the file in the System Volume Information folder, a hidden folder on the volume. Now the file on the server is up to date as the user saved it, and a backup of the previous file also resides on the server.

If a user accesses the file properties, they can see the previous version of the file as well. What VSS does not do is make a backup of the file every time a user saves the file. If the default interval is used, a snapshot will be taken at 7:00 A.M. and 12:00 P.M. each weekday. If a file is accessed by a user at 9:37 A.M. and changed and then saved, two copies of the file will be available: the old file as it was at 7:00 A.M. and the new file as it was changed at 9:37 A.M. If another user accesses the file at 11:32 A.M. and changes the file, only the current change and the file version as of 7:00 A.M. will be available. There are three methods you can use to implement shadow copies: Windows Explorer, the Shared Folders snapin, and the command prompt. Implementing Shadow Copies Using Windows Explorer Enabling shadow copies on the volume will back up all shared folders on the volume. To implement shadow copies, right-click any volume in Windows Explorer and select Properties. Click the Shadow Copies tab and select the volume to enable, as shown in Implementing Shadow Copies Using the Shared Folders Snap-in To implement shadow copies, open the Computer Management MMC. Right-click the Shared Folders node, select All Tasks | Configure Shadow Copies, as shown in Figure 3-20. Configure the appropriate volume and schedule. Implementing Shadow Copies Using the Command Line From a command prompt, type L 3-3 vssadmin create shadow /for=forvolumespec For additional help and to see a list of commands, from a command prompt, type L 3-4 vssadmin Scheduling Shadow Copies By default, a snapshot is made of the shared folders at 7:00 A.M. and 12:00 P.M. Monday through Friday. Windows 2003 only maintains 64 shadow copy snapshots. Once 64 snapshots have been made, the VSS begins overwriting the oldest snapshot to save the new snapshot. Microsoft does not recommend taking snapshots of the shared folders more than once an hour. Increasing the frequency of the schedule decreases the length of time that files are able to be rolled back.

To configure the schedule: 1. In Windows Explorer, right-click the volume that has VSS enabled and selects Properties. Click the Shadow Copies tab. 2. Select the desired volume and click Settings. Click the Schedule button on the Settings window. Notice that, by default, there are two schedules configured, one running every weekday at 7:00 A.M. and the other running every weekday at 12:00 P.M. 3. To create a new schedule, click New. 4. To modify an existing schedule, select the schedule from the dropdown list and then modify the schedule. For additional options, click Advanced. Storing Shadow Copies When shadow copies are enabled, the VSS creates a hidden folder on the volume called System Volume Information and stores previous versions of that folder. It is recommended that the shadow copies are stored on a different volume than where the shared folders reside. You can alter this by clicking the Settings button on the Shadow Copies tab on the volume. Simply store the hidden folder on a different drive. Installing the Shadow Copy Client Windows Server 2003 natively supports shadow copies; however, Windows XP Professional, Windows 2000 Server and Professional, and Windows 98 require a client be installed (twcli32.msi). The client is available on the Windows 2003 server CD, or you can download the client at http://www.microsoft.com/windowsserver2003/downloads/ shadowcopyclient.mspx. After the client is installed, Windows Explorer will display the Previous Versions tab in the Properties of the file. (If you would like to test this out on your own computer, you will need to loopback. From a run command, type //yourservername.)

Recovering a Previous Version Let’s assume that a user on the network, Kevin, accidentally saves over a file on a server. Kevin now wants to revert the file back to what it was previously. There are a few options, all using the Previous Versions tab. First, Kevin navigates to the folder where the file is located and selects the file. Then he right-clicks the file and selects Properties. From the file’s properties dialog box, he clicks the Previous Versions tab. The Previous Versions tab will display all previous versions of the file back to 64 (remember, only 64 snapshots are kept). Kevin finds the file he wants to revert to. Now he has some choices: • View the file If Kevin chooses to view the file, the file is opened in the application it was created in (such as Word). Kevin can then choose to save the file to a different location using the Save As command in the application. • Copy the file If Kevin chooses to copy the file, he is presented with the dialog box shown in Figure 3-21 and navigates to a new location. Kevin clicks Copy to complete the operation. • Restore the file If Kevin chooses to restore the file, the previous version will be restored to the current location. When Kevin chooses this option, he sees the dialog box shown in Figure 3-22. Restoring the file overwrites the current file and any changes to the file are lost. Restoring a Deleted File If you delete the file altogether, there isn’t a previous version to go back to because you can’t access the file. Now what do you do? Not to worry: shadow copy not only takes

a snapshot of the files, but of the shared folder as well. So if you delete a file accidentally, you can restore the file by restoring the shared folder. Be careful when you restore the folder because other files may have been changed in the folder and those changes will be lost if you restore the whole folder.