Volume Shadow Copy : It is essentially a snapshot of a disk volume taken at a specific moment in time. It captures the state of files exactly as they were, even if they were open or actively in use. This is important because Windows cannot normally copy files that are in use. Volume Shadow Copy Service (VSS) is a Windows component that makes those snapshots possible. VSS is the background Windows service that coordinates everything required to create one. In this article, let’s explore Volume Shadow Copy and its service in detail. Let’s get started.
Characteristic Behavior of Volume Shadow Copy on Windows 11
Volume Shadow Copy Service
- It is a point in time, and it represents the exact state of a volume at the moment it was created.
- A Volume Shadow Copy is a read-only file. We cannot modify files inside it. The operating system treats it as a frozen reference. This prevents accidental changes and ensures the snapshot stays consistent.
- Volume Shadow Copy Service coordinates safely in the background without needing the applications to be closed or the system to be shut down. It only works with files that are in use.
- For storage efficiency, VSS uses copy on write behavior, and hence, when a shadow copy is created, Windows does not duplicate the entire volume. It only saves original data blocks when they are about to change. Additionally, Volume Shadow Copies are volume based, and not file based.
- Shadow Copies are not permanent archives and are temporary by design
All the above characteristics make Volume Shadow Copy fast, safe, and practical for system recovery.
Information on the Go! A Volume Shadow Copy is the saved snapshot you can restore from. VSS is the system behind the scenes that creates and manages those snapshots.
How does the Copy on Write Mechanism work?
When a shadow copy is created, Windows does not duplicate the entire volume. Instead, it marks the current state of the disk as the reference point. From that moment on, everything looks normal to the system and applications. When a block of data is about to be changed on the live volume, Windows first copies the original version of that block into shadow storage. Only after the original data is safely preserved does Windows allow the new data to be written to the disk. This preserved block becomes part of the shadow copy.
Because of this, unchanged data is never copied. Only blocks that are modified after the snapshot are saved. This keeps shadow copies fast to create and relatively small in size. Though this mechanism is efficient, the downside is that heavy disk activity can cause shadow storage to grow quickly.
Windows Services that use Volume Shadow Copy on Windows 11
Several built-in Windows services and components rely on Volume Shadow Copy to work correctly. Some use it directly, while others act as requesters who ask VSS to create snapshots when needed.
- System Restore depends heavily on Volume Shadow Copy. Every restore point you see is backed by one or more shadow copies. When Windows rolls the system back after a bad update or driver install, it restores files and settings from those snapshots.
- Microsoft Software Shadow Copy Provider acts as the default provider that actually performs the snapshot operation on NTFS Volumes.
- Windows Backup and Restore uses VSS to back up files and create system images while Windows is running.
Other services like File History , Windows Update Servicing Components , some Windows Server Roles and Features, and more use Volume Shadow Copy Service. VSS is not shared just by one service. It is the sharedfoundation that many Windows Services depend on for safe backup, restore, and recovery operations.
Shadow Storage Management on Windows 11
Shadow Storage Management is about how the system stores, limits, and cleans up Volume Shadow Copies. We may not notice until disk space disappears or restore points start vanishing, and hence, it is crucial to understand how Volume Shadow Storage works on Windows 11. When Windows creates a shadow copy, the data isn’t stored in a separate backup location by default. Instead, it’s saved in an area of the same volume called shadow storage. This space holds the original disk blocks preserved by the copy on write mechanism. As more files change after a snapshot, shadow storage grows.
Windows automatically enforces a maximum size for shadow storage. This limit is either a percentage of the volume or a fixed size, depending on how System Protection is configured. Here are some of the essential Volume Shadow Copy Service Commands. VSS requires elevated privileges and hence, make sure to run Command Prompt as Administrator.
Important : Volume Shadow Copy Service (VSS) is a core Windows component, and improper use of the commands discussed may result in loss of restore points or recovery data. Test changes in a non-production environment and maintain current backups before applying them to a live system.
| Command | Description |
| vssadmin list shadows | This Command displays all existing volume shadow copies along with their creation time and associated volumes. |
| vssadmin list shadowstorage | It shows where shadow copies are stored and how much disk space they are using versus their maximum limit |
| vssadmin list writers | Lists all VSS writers and shows whether they are in a stable or failed state. |
| vssadmin list providers | It displays all registered shadow copy providers on the system. |
| sc query vss | It checks the current status of the Volume Shadow Copy service. |
| net stop vss | This command stops the Volume Shadow Copy Service. Make sure to use this command with caution. |
| net start vss | It starts the VSS Service. |
| vssadmin delete shadows /all | It deletes all shadow copies and restore points. This is a High Risk Command and has to be used with high caution. |
List all Shadows
List All Shadow Copies
Volume Shadow Copy Service Administrative Command-line tool, upon using vss list shadows. The command provides the following information. Shadow Copy Set ID, Shadow Copy ID, Original Volume, Shadow Copy Volume, Originating Machine, Service Machine, Provider, Attributes, and more.
List Shadow Storage Details
List Shadow Copy Storage Information
The Shadow Copy Storage Association provides essential information related to Shadow Copy Storage Volume, Used Space, Allocated Space, and Maximum Shadow Copy Storage Space.
Command to list VSS Writers
List VSS Writers
The above command lists various information related to Writers, such as Writer ID, Writer Instance ID, State, and Last Error information.
How to view VSS Providers on Windows 11?
Command to List VSS Providers
This command lists Volume Shadow Copy provider information, including the Provider Name, Provider Type, ID, and Version.
Check Current Status of the VSS Service
VSS Service Status
The command sc query vss lists information such as the Service Name , Type, State, WIN32_EXIT_CODE , SERVICE_EXIT_CODE , Checkpoint, and WAIT_HINT.
Take Away
The above article discusses various information related to Volume Shadow Copy and Volume Shadow Copy Service on Windows 11. If you have any queries, kindly let us know in the comments. For more interesting articles, stay tuned to Winsides.com. Happy Computing! Peace out!
Top comments (0)