Volume Shadow Copy Service (VSS) was introduced in Windows 2003. It is used in co-ordination with applications to provide point-in-time copies of single or multiple volumes. VSS is equivalent to hardware 'snapshot' functions like Flashcopy or Timefinder, but it is an operating system component that works at software level.
VSS works by making a block-level copy of any changes that have occurred to files since the last shadow copy. Only the changes are copied, not the entire file. VSS backups will not require the same size disk space as the original data, unless all the files are completely overwritten. However the amount of disk space used for changes can vary, depending on whether the application rewrites the entire file when a change is made, or just changes parts of the existing file

VSS can be used to improve backup and recovery processes.
Traditionally, we backup data to tape in an overnight window, which can take several hours. This means that the backup might not be consistent, as some files will be backed up several hours apart, and if the backup fails, it is usually left for fixing the next day. Another problem is that backup software usually cannot cope with open files, so either all the applications must be stopped to get a good backup, or open files are skipped.

VSS fixes most of these problems by taking a snapshot of the data to disk at a consistent point. It can work with backup applications to get consistent backups of open files, so good backups can be scheduled to run several times per day, with the applications available 7*24. The backup process usually takes a few seconds, so if it fails, it can be fixed immediately, so ensuring a consistent backup every night.

The VSS freeze function can be used to take instant, and consistent backups, but for it to work effectively it needs to work with VSS aware applications and backup utilities. If an application is VSS aware, then the backup utilities will be able to process open files. A working VSS system has four basic components, some of which can be provided by third party vendors.

The VSS Coordination Service provides control and communication services between the other three components and is part of the Windows operating system
The VSS Requestor is typically a third party backup tool and it issues the VSS commands that create and manage the VSS snapshots. diskshadow.exe was introduced in Windows 2008 as an in-the=box VSS Requestor.
The VSS Writer is the tool that manages the snapshot capability of VSS and it will make sure that all the files in a snapshot are consistent. The Windows system contains a VSS writer for basic filesystems, while third party database management systems will typically provide a specialised VSS writer for their databases.
The VSS Provider maintains the shadow copies after they are initiated. The Windows VSS Provider is a copy-on-write software solution but it is possible to replace this with a SAN based hardware solution.

The process basically works like this

The backup utility triggers a VSS snapshot and any writes in memory are flushed to disk
The VSS writer freezes all IO to the snap disk at a consistent point, by interfacing with all applications and the Windows operating system
It then creates a snapcopy, using SAN hardware capability if that is available
Once the snapshot is complete, I/O is resumed. If the original data is updated, the VSS provider copies that data to the snap before any updates are applied to the source

This process works fine, providing all the applications are VSS aware. If some applications are not VSS aware, then their IO will not be frozen, and you will not be able to guarantee data integrity at the snapshot time, and open files may be skipped. You will need to take a view on how important this is. 'Thick' Client-Server applications will always be a problem, as the data is stored on the server, but processed on the client. Database applications that are not VSS aware will be a problem too, as you could backup corrupt data from partially completed transactions.

If the administrator enables Shadow Copies for Shared Folders (SCSF), then users can recover their own files of folder from a VSS backup, without any need to find and mount a tape.

In a NAS/SAN environment, once a shadow copy is taken of a disk on ServerA, that disk can be quickly made available to ServerB with appropriate LUN masking. This can all happen under VDS control.

Shadow Copies for Shared Folders

There are three major reasons why data would need to be recovered -

Loss of all or a major part of a building
Loss of a hardware subsystem or disk - this could include a major virus attack
Loss of a file or folder due to deletion, accidental overwrite or corruption.

Shadow Copy can be used for the third type of recovery, but not the other two, so it will not completely replace backup or remote mirroring solutions, nor is it intended to be used for long term archives.

Setting up Shadow Copy at the Server

VSS works at volume level, not file or directory, and works on NTFS volumes, not FAT volumes. Microsoft recommend that its used for general purpose volumes that hold user files, documents, spreadsheets or databases. Home directories would be ideal.
Users must use shared folders to access shadow copies and administrators on the local server must also specify the \\servername\sharename path to access shadow copies.

A proportion of the disk is set aside to be used for VSS, and when that space fills up, VSS deletes older copies to make room. The default space is 10% of the size of the volume being backed up. If the rate of data change is high, then this proportion will be too low, and older backups will be deleted too quickly. If VSS cannot fit an amount of changed data into a backup space, even after all old backups have been cleared out, then it will not create any shadow copy. This means it is important to get the size of the backup volume correct.

You need to consider two factors -

How many backups do your users expect to find? (You can only have a maximum of 64 shadow copies)
How much data is changing between shadow copies?

You need to discuss and agree the first factor with your users, then publicise the agreement.

The second factor is a bit difficult, as it is not the number and size of files which are changing, but the number of changed blocks within the files. Microsoft provides tools to assist you with this. This number will also be affected by the timing between Shadow Copies. If you take a Shadow copy every hour, say, then you would expect to see a lot less changed data than if you took a shadow copy every day. However, remember the 64 copy limit. If you do take a copy every hour, you will only be able to recover data back less than three days. Shadow Copy is volume based, not policy based. You are not keeping 64 copies of a file, but 64 copies of changed data on a disk. If you are using Windows Server 2003, then by default, it creates shadow copies at 0700 and 1200, Monday through Friday. You may wish to change these settings.

You can store the Shadow Copy data on the same disk as the source, or to store it on a different disk. Microsoft recommends that you use a separate volume on separate disks if the file server is very busy. If you use a separate volume, then you should set the maximum size for Shadow Copies to no limit, to prevent copies from being expired too early.

Shadow Copy at the Clients

Shadow Copies for Shared Folders comes ready installed on Windows 2003 clients, and can be installed on Windows 2000, XP Professional, and Windows 98. Once installed, if you right click on any file or folder and select Properties, you will see an extra tab called Previous Versions. If you click on the Previous Versions tab, you will see a list of shadow copies of that file, with the date and time the copy happened. If you click on one of those versions, you get three options, View, Copy, or Restore.

Recovery of Files or Folders

The recovery process is slightly different, depending on whether you want to recover a deleted file, and existing file or a folder. The three scenarios are described below.

Recovering a Deleted File

Go to the folder where the deleted file used to be, with Windows Explorer.
Right click your mouse on a blank space in the folder (not over a file).
Select Properties from the menu then select the Previous Versions tab.
Select the version of the folder that contains the file before it was deleted, and then click View.
View the folder and select the file that will be recovered.
Drag and drop, or cut and paste, the shadow copy to the desktop or folder on the end user's local machine.

Recovering an Overwritten or Corrupted File

Right-click the overwritten or corrupted file and click Properties.
Select Previous Versions.
If you want to view the old version, click View.
To copy the old version to another location, click Copy
To replace the current version with the older version, click Restore.

Recovering a Folder

Position the cursor so that it is over a blank space in the folder that will be recovered. If the cursor hovers over a file, that file will be selected.
Right-click the mouse, select Properties from the bottom of the menu, and then, click the Previous Versions tab.
Choose either Copy or Restore.
Choosing Restore enables the user to recover everything in that folder as well as all sub folders. Selecting Restore will not delete any files.

VENDOR Showcase