What's the Windows Server 2003 Volume Shadow Copy Service (VSS)?

A. Windows 2003 includes several new file system features, such as enhanced DFS closest-site selection, the Virtual Disk Service, and Automated System Recovery (ASR). The most useful new feature is VSS.

Local Windows file systems include the Recycle Bin on the desktop, from which you can recover a deleted file. However, you can't recover deleted files on network shares unless you install third-party software. One thing VSS does is replcate the Recycle Bin for the network.

At configurable intervals, VSS takes a snapshot (aka Shadow Copy) of the state of content stored on selected volume shares. VSS stores only the changes for the shares, not the entire share content. For example, if you make a small change to a 5GB file, VSS stores only information about the change. The service stores as many as 64 versions of a share, depending on disk space. When the service creates the 65th Shadow Copy (or if you've used all the disk space allotted for Shadow Copies), the service deletes the oldest snapshot to make space for the newest snapshot. You can enable Shadow Copies only on NTFS volumes; you can't enable them for FAT volumes.

To enable Shadow Copies, clients install a software component that adds a Previous Versions tab to the Properties dialog box for the shares you want to Shadow Copy. Uses can select this tab to obtain a point-in-time view of the share and access its content. This functionality is great for users and administrators. If a user deletes a file or a file becomes corrupted, the user can simply view a version of the share that precedes the deletion or corruption and recover the file without troubling the administrator.

VSS doesn't replace backups, because the service stores only file changes--if you lose your file systems, the Shadow Copy information would be of no use. Microsoft has also stated that during times of exceptionally high I/O, Shadow Copies might be lost, so you shouldn't rely on VSS during critical-use times.

The amount of disk space required for Shadow Copies is based on the size and frequency of the file changes, which are driven by the applications used. For example, if an application writes only changes to a file when the file is modified, that application's changes will require far less Shadow Copy space than will an application that rewrites the entire file.

When you access a Shadow Copy, the file and folder ACLs still apply. Therefore, if you didn't have access to a particular file before, you won't have access to the file when you view the Shadow Copy. Windows 2003 stores information about the actual Shadow Copy file or folder in the System Volume Information of the volume that holds the Shadow Copy information, and this information isn't accessible.

Finally, although VSS protects the entire contents of a particular volume, you must use the share properties to view previous states of each volume share. Therefore, if you need to recover a file that isn't listed under a share, you must create a new share that contains the file, then connect to that share. (If you create a new share, you'll see a full history of the entire drive because VSS logs the entire file system, not just existing shares.)