Forum Soiware

In the past, I presented various ways to browse these mysterious device objects called "shadow copies". Shadow copies are static images in time (snapshots) of your volume contents, at some point in the past. These shadow copies are volumes on their own, with a file system namespace accessible through the regular Win32 APIs such as FindFirstFile/FindNextFile. For example the existing sample code in MSDN for these APIs that enumerates files on a real volume will work just fine on a shadow copy volume. In fact, that's how all backup applications are accessing shadow copy content today.

So, if these devices are real volumes, how can we view them in Explorer? It turns out that you can't view them by default - this is simply because these are volumes without an associated drive letter or root mount point. However, in XP or Windows Server (and Vista), you can still access these shadow copies by assigning them a drive letter using utilities like DOSDEV, or by doing tricks with the FOR command, etc.

Now, if you have Vista, it is much simpler to access shadow copy devices directly from Explorer. The trick is to use a new feature called Symbolic Links: to access the contents of a shadow copy as a "directory", simply create a symbolic link to the device. Vista also includes a convenient command-line tool called MKLINK.EXE to create symbolic links, which makes this operation very easy.

Here is an example of accessing the contents of a shadow copy device. The first step is to enumerate shadow copies on the machine, using the VSSADMIN LIST SHADOW command. This will give us the devices and also a creation timestamp.

C:\Windows\system32>vssadmin list shadows |more
vssadmin 1.1 - Volume Shadow Copy Service administrative command-line tool
(C) Copyright 2001-2005 Microsoft Corp.

Contents of shadow copy set ID: {c72c8036-d563-43c8-b351-1994dfad580a}
Contained 1 shadow copies at creation time: 2/23/2008 9:59:04 AM
Shadow Copy ID: {f3727808-bea6-4b59-bef7-6849ee721709}
Original Volume: (C:)\\?\Volume{3e83355f-7c0e-11dc-b416-806e6f6e6963} Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy4
Originating Machine: Adi-Game-PC
Service Machine: Adi-Game-PC
Provider: 'Microsoft Software Shadow Copy provider 1.0'
Type: ClientAccessibleWriters
Attributes: Persistent, Client-accessible, No auto release, Differential, Auto recovered

Contents of shadow copy set ID: {0bf23f77-8461-4869-b391-da4d213940a5}
Contained 1 shadow copies at creation time: 2/24/2008 4:00:24 AM
Shadow Copy ID: {87d59b22-9e84-4d0d-81ca-2b565d6f7e55}
Original Volume: (C:)\\?\Volume{3e83355f-7c0e-11dc-b416-806e6f6e6963} Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy5
Originating Machine: Adi-Game-PC
Service Machine: Adi-Game-PC
Provider: 'Microsoft Software Shadow Copy provider 1.0'
Type: ClientAccessibleWriters
Attributes: Persistent, Client-accessible, No auto release, Differential, Auto recovered

C:\Windows\system32>mklink /d c:\shadowcopy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy5symbolic link created for c:\shadowcopy <<===>> \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy5
C:\Windows\system32>dir c:\shadowcopy
Volume in drive C has no label.
Volume Serial Number is 4A02-860C

Directory of c:\shadowcopy

12/14/2007 01:46 AM <DIR> Asi
01/15/2008 12:56 AM <DIR> bin
12/13/2007 11:59 PM <DIR> debuggers
12/13/2007 11:55 PM 17,644,031 dir.log
01/14/2008 11:41 PM <DIR> Downloads
01/01/2008 05:50 PM <DIR> dumps
12/30/2007 11:43 PM <DIR> garbage
01/08/2008 11:13 PM <DIR> Garmin
10/15/2007 09:03 PM <DIR> Intel
12/30/2007 11:59 PM <DIR> Program Files
01/27/2008 01:32 AM <DIR> Program Files (x86)
01/15/2008 12:17 AM <DIR> test
01/30/2008 06:52 AM <DIR> Users
12/14/2007 01:55 AM <DIR> WinDDK
02/13/2008 05:23 AM <DIR> Windows
02/21/2008 10:43 PM <DIR> Work
1 File(s) 17,644,031 bytes
15 Dir(s) 147,657,666,560 bytes free



That's it. Now I have a persistent link called c:\shadowcopy which points to the contents of the shadow copy device - which is the image of my C:\ drive at 4:00 AM (this is when my latest system restore point was created).

A new notes,though:

1) Make sure you use the "/D" option in MKLINK so you create a directory-based, not a file-based symbolic link

2) Make sure you append a backslash to the shadow copy device in the MKLINK command (marked in red above)



If this made you interested about shadow copies - note that you can create, enumerate and delete shadow copies programatically using either VB scripts that use the WMI API for shadow copy administration, or by using the VSS API (documented publicly on MSDN). Sample code is available in the Platform SDK as well.