87. NTFS Volume Shadow Copy

• Also known as Volume Snapshot Service or Volume Shadow Copy Service or VSS

• The purpose is to provide an instant backup of files. Modified files are copied to the Shadow Copy of the volume on which the originals reside.

• This NTFS feature is for backing up critical servers that can't afford the loss of data between traditional tape backups.

• NTFS Shadow Copy can be accomplished in two different ways:

  • hardware-based, or

  • software-based.

• The Shadow Copy can either operate in two modes:

  • Online backup mode:

    • functions like a RAID, where any transaction on one drive also happens on the other.

    • This is read/write, full copy mirror: both drives will have identical logical structure.

    • The clone drives are exact mirror images of the original.

  • Copy-on-write mode -- before file is modified on the original drive, the

      "Original" + "Difference between new and unmodified copy"
  

  is written to the shadow volume first. Then the modification of the file takes place on the original volume.

• Copy-on-write mode operates like a mirror, but provides that any modification has a "prior version". This allows for the original drive to be rolled back in case if a write transaction goes bad. Thus,

      Shadow Copy = Original + Difference
  

• Copy-on-write can be much faster than the online backup, because only the changes are written instead of everything. (The original must still be available to maintain the shadow copy, but is written just once.)

• NOTE: Unlike a true versioning file system, the users cannot trigger creation of new versions of an individual file -- only the entire volume.

• Reference:
  http://en.wikipedia.org/wiki/Shadow_Copy
  Windows Server (technet.microsoft.com)