Comments on: What you should know about Volume Shadow Copy/System Restore in Windows 7 & Vista (FAQ)

By: Clay

Clay — Wed, 14 Jul 2010 21:17:16 +0000

Hello, I have a problem, i have windows 7 64 bit on a new pc..
I did a reinstall( because of a boot problem),now, i have a unletter named volume of 100 mb, and my shadow copy service doesnt work, sustem restore is on, but when i try to access a restore point, it say saccess denied, also, its not using that 100 mb volume( on the same disk) for restores anymore. Its putting them on volume C.
I read some, listed my providers, for vss and all i have vss microsoft 1.0. I checked services and vss is on, set to manual, as the instructions said to do. But, this 100 mb volume isnt being used anymore, and i cant get a usable restore point. How do i ( word for word, reactivate vss, and set it up. Why isnt windows 7 doing it automatically. Its every aggravating. I cant delete this 100 mb volume, wont let me. Cant reformat it, so. please help me, and if u can, be very specific in instructions. click for click.Thanks.

By: Brandon

Brandon — Thu, 24 Jun 2010 00:15:34 +0000

Great post! I have one lingering question about how shadow copy accesses/tracks blocks on the disk. Does it, or can it, ever reference a block that is marked free in the filesystem?

In other words, let’s say you have a security program that writes zero to all “unused” blocks according to the filesystem.

Will that break shadow copies that reference those blocks, or are shadow copies completely self-contained?

By: shelly

shelly — Mon, 08 Mar 2010 02:13:58 +0000

thanks for the post, but it raises more questions than it answers. I’m here becasue I have XP that badly needs defragmenting but the “shadow volume copy service” s blocking it–I keep turning off the restore but it automatically goes back on. You say it does even work in XP–but unfortunately it is. I keep reading that other people have the same problem and can’t defrag after 3%–Is there no answer but to toss this junk and buy and new computer?

By: Tomasz

Tomasz — Fri, 08 Jan 2010 15:20:09 +0000

As far as I’ve been able to tell, the defrag utility does not change anything in the shadow copies. It just moves things around while VSS tracks the changes and updates the shadow copies. Remember that VSS uses 16k blocks while defrag uses 4k blocks (usually). So it would only be possible to update the mapping of shadow blocks to logical blocks if defrag happened to move a whole 16k block — but not if it moved 4k, 8k or 12k.

BTW, if shadow blocks mapped to locations within files, wouldn’t there be a bit of a problem if you had two or more files in the same block?

By: Andrew

Andrew — Mon, 04 Jan 2010 23:56:01 +0000

The angle about defragmentation causing excessive VSS copy-on-write is interesting and merits its own investigation. I find it curious that VSS chooses a fixed (not configurable) block size of 16K, while NTFS defaults to only 4K for most consumer hard drives.

I was actually more interested in how a block from a shadow copy can be restored to its proper original location, when that location has been changed during the defrag operation. In other words, if there is some map of shadow copy blocks to logical cluster numbers on disk, wouldn’t the defrag utility have to update this map when it moved some clusters around?

On the other hand, if virtual block numbers were used in the map, then defragmentation wouldn’t have an impact.

By: Tomasz

Tomasz — Mon, 04 Jan 2010 23:10:09 +0000

Hi Andrew, Always nice to hear from a fellow Pole. Your written English is pretty good, BTW. Let me try to answer your questions in order: "How exactly does each Shadow Copy store information about the original location of each copied block?" I don't know the details, but blocks are numbered, so I imagine it should be pretty simple to store some sort of table to map the shadow blocks to actual block numbers on the original disk. "Are blocks stored on a virtual (i.e. location within file) or logical (i.e. location on the volume) basis?" Logical. Though the block size used by VSS is always 16 KB, which does not always match the block size used by NTFS. "What happens if the original volume gets defragmented?" Good question. Defragmentation moves blocks around, which could cause the Volume Shadow Copy service to detect a lot of block changes, quickly filling the shadow space with previous versions of blocks. Supposedly, the defrag utility in Vista/7 has been optimized to minimize this. How exactly? No details have been published. One possibility that I can think of would be to write data into blocks which are considered free not only now, but also in all the shadow copies. That way, a backup copy of the free block will not have to be made before the write, as no shadow copies will need the data in that free block. But I'm basically pulling this out of thin air. It is also worth noting that defrag in Vista/7 moves files around less than in XP. A 640 MB file that consists of ten 64 MB chunks in different places on the drive is considered defragmented in Vista. (The rationale is that it's not worth it to defrag it into a single contiguous 640 MB chunk, as the only difference when reading the file is 9 additional seek operations, each taking a few milliseconds.)

By: Andrew

Andrew — Sat, 02 Jan 2010 07:09:05 +0000

First, thanks for the nice expose on VSS. Second, I’m a fellow Pole and – strangely enough – share your curiuosity and perfectionistic tendencies (national trait, perhaps). Now to the point, I also have been reading and experimenting with VSS lately, but I still find a couple of questions unanswered. How exactly does each Shadow Copy store information about the original location of each copied block? Are blocks stored on a virtual (i.e. location within file) or logical (i.e. location on the volume) basis? What happens if the original volume gets defragmented? If you happen to have figured these things out, I’d love to hear.

Cheers!
Andrew

By: Tomasz

Tomasz — Tue, 29 Dec 2009 19:40:24 +0000

There is no functional difference between automatic and manual restore points.

To answer your second question, it may be advisable to create a manual restore point occasionally. You might want to do it before installing new software if you’re worried it might screw up your system drive.

By: josefbetancourt

josefbetancourt — Wed, 23 Dec 2009 20:26:01 +0000

sorry if I missed this above. Is what you are describing also what happens when you manually create a System Restore Point when you are about to install a new program? And, if you have System Restore Protection enabled, is creating a manual restore point still necessary? I would think it is, since an automatic restore point creation is not guaranteed.

Excellent post, btw.

By: Frank

Frank — Tue, 15 Dec 2009 11:04:24 +0000

Great information and great tip advising people to use full disk encryption. Thanks for the post.