Volume Shadow Copy: It is essentially a snapshot of a disk volume taken at a specific moment in time. It captures the state of files exactly as they were, even if they were open or actively in use. This is important because Windows cannot normally copy files that are in use. Volume Shadow Copy Service (VSS) is a Windows component that makes those snapshots possible. VSS is the background Windows service that coordinates everything required to create one. In this article, let’s explore Volume Shadow Copy and its service in detail. Let’s get started. Volume Shadow Copy snapshot Volume Shadow Copy Service (VSS) Windows component VSS background Windows service Characteristic Behavior of Volume Shadow Copy on Windows 11 It is a point in time, and it represents the exact state of a volume at the moment it was created. A Volume Shadow Copy is a read-only file. We cannot modify files inside it. The operating system treats it as a frozen reference. This prevents accidental changes and ensures the snapshot stays consistent. Volume Shadow Copy Service coordinates safely in the background without needing the applications to be closed or the system to be shut down. It only works with files that are in use. For storage efficiency, VSS uses copy on write behavior, and hence, when a shadow copy is created, Windows does not duplicate the entire volume. It only saves original data blocks when they are about to change. Additionally, Volume Shadow Copies are volume based, and not file based. Shadow Copies are not permanent archives and are temporary by design It is a point in time, and it represents the exact state of a volume at the moment it was created. point in time, A Volume Shadow Copy is a read-only file. We cannot modify files inside it. The operating system treats it as a frozen reference. This prevents accidental changes and ensures the snapshot stays consistent. Volume Shadow Copy Service coordinates safely in the background without needing the applications to be closed or the system to be shut down. It only works with files that are in use. For storage efficiency, VSS uses copy on write behavior, and hence, when a shadow copy is created, Windows does not duplicate the entire volume. It only saves original data blocks when they are about to change. Additionally, Volume Shadow Copies are volume based, and not file based. Shadow Copies are not permanent archives and are temporary by design All the above characteristics make Volume Shadow Copy fast, safe, and practical for system recovery. Information on the Go! A Volume Shadow Copy is the saved snapshot you can restore from. VSS is the system behind the scenes that creates and manages those snapshots. Information on the Go! How does the Copy on Write Mechanism work? When a shadow copy is created, Windows does not duplicate the entire volume. Instead, it marks the current state of the disk as the reference point. From that moment on, everything looks normal to the system and applications. When a block of data is about to be changed on the live volume, Windows first copies the original version of that block into shadow storage. Only after the original data is safely preserved does Windows allow the new data to be written to the disk. This preserved block becomes part of the shadow copy. not copies the original version of that block Because of this, unchanged data is never copied. Only blocks that are modified after the snapshot are saved. This keeps shadow copies fast to create and relatively small in size. Though this mechanism is efficient, the downside is that heavy disk activity can cause shadow storage to grow quickly. Windows Services that use Volume Shadow Copy on Windows 11 Several built-in Windows services and components rely on Volume Shadow Copy to work correctly. Some use it directly, while others act as requesters who ask VSS to create snapshots when needed. System Restore depends heavily on Volume Shadow Copy. Every restore point you see is backed by one or more shadow copies. When Windows rolls the system back after a bad update or driver install, it restores files and settings from those snapshots.Microsoft Software Shadow Copy Provider acts as the default provider that actually performs the snapshot operation on NTFS Volumes. Windows Backup and Restore uses VSS to back up files and create system images while Windows is running. System Restore depends heavily on Volume Shadow Copy. Every restore point you see is backed by one or more shadow copies. When Windows rolls the system back after a bad update or driver install, it restores files and settings from those snapshots. System Restore Microsoft Software Shadow Copy Provider acts as the default provider that actually performs the snapshot operation on NTFS Volumes. Microsoft Software Shadow Copy Provider Windows Backup and Restore uses VSS to back up files and create system images while Windows is running. Windows Backup and Restore uses VSS Other services like File History, Windows Update Servicing Components, some Windows Server Roles and Features, and more use Volume Shadow Copy Service. VSS is not shared just by one service. It is the sharedfoundation that many Windows Services depend on for safe backup, restore, and recovery operations. File History Windows Update Servicing Components Windows Server Roles Windows Server Roles Shadow Storage Management on Windows 11 Shadow Storage Management is about how the system stores, limits, and cleans up Volume Shadow Copies. We may not notice until disk space disappears or restore points start vanishing, and hence, it is crucial to understand how Volume Shadow Storage works on Windows 11. When Windows creates a shadow copy, the data isn’t stored in a separate backup location by default. Instead, it’s saved in an area of the same volume called shadow storage. This space holds the original disk blocks preserved by the copy on write mechanism. As more files change after a snapshot, shadow storage grows. shadow storage Windows automatically enforces a maximum size for shadow storage. This limit is either a percentage of the volume or a fixed size, depending on how System Protection is configured. Here are some of the essential Volume Shadow Copy Service Commands. VSS requires elevated privileges and hence, make sure to run Command Prompt as Administrator. maximum size Important: Volume Shadow Copy Service (VSS) is a core Windows component, and improper use of the commands discussed may result in loss of restore points or recovery data. Test changes in a non-production environment and maintain current backups before applying them to a live system. Important CommandDescriptionvssadmin list shadowsThis Command displays all existing volume shadow copies along with their creation time and associated volumes.vssadmin list shadowstorageIt shows where shadow copies are stored and how much disk space they are using versus their maximum limitvssadmin list writersLists all VSS writers and shows whether they are in a stable or failed state.vssadmin list providersIt displays all registered shadow copy providers on the system.sc query vssIt checks the current status of the Volume Shadow Copy service.net stop vssThis command stops the Volume Shadow Copy Service. Make sure to use this command with caution.net start vssIt starts the VSS Service.vssadmin delete shadows /allIt deletes all shadow copies and restore points. This is a High Risk Command and has to be used with high caution. CommandDescriptionvssadmin list shadowsThis Command displays all existing volume shadow copies along with their creation time and associated volumes.vssadmin list shadowstorageIt shows where shadow copies are stored and how much disk space they are using versus their maximum limitvssadmin list writersLists all VSS writers and shows whether they are in a stable or failed state.vssadmin list providersIt displays all registered shadow copy providers on the system.sc query vssIt checks the current status of the Volume Shadow Copy service.net stop vssThis command stops the Volume Shadow Copy Service. Make sure to use this command with caution.net start vssIt starts the VSS Service.vssadmin delete shadows /allIt deletes all shadow copies and restore points. This is a High Risk Command and has to be used with high caution. CommandDescriptionvssadmin list shadowsThis Command displays all existing volume shadow copies along with their creation time and associated volumes.vssadmin list shadowstorageIt shows where shadow copies are stored and how much disk space they are using versus their maximum limitvssadmin list writersLists all VSS writers and shows whether they are in a stable or failed state.vssadmin list providersIt displays all registered shadow copy providers on the system.sc query vssIt checks the current status of the Volume Shadow Copy service.net stop vssThis command stops the Volume Shadow Copy Service. Make sure to use this command with caution.net start vssIt starts the VSS Service.vssadmin delete shadows /allIt deletes all shadow copies and restore points. This is a High Risk Command and has to be used with high caution. CommandDescription Command Description vssadmin list shadowsThis Command displays all existing volume shadow copies along with their creation time and associated volumes. vssadmin list shadows This Command displays all existing volume shadow copies along with their creation time and associated volumes. vssadmin list shadowstorageIt shows where shadow copies are stored and how much disk space they are using versus their maximum limit vssadmin list shadowstorage It shows where shadow copies are stored and how much disk space they are using versus their maximum limit vssadmin list writersLists all VSS writers and shows whether they are in a stable or failed state. vssadmin list writers Lists all VSS writers and shows whether they are in a stable or failed state. vssadmin list providersIt displays all registered shadow copy providers on the system. vssadmin list providers It displays all registered shadow copy providers on the system. sc query vssIt checks the current status of the Volume Shadow Copy service. sc query vss It checks the current status of the Volume Shadow Copy service. net stop vssThis command stops the Volume Shadow Copy Service. Make sure to use this command with caution. net stop vss This command stops the Volume Shadow Copy Service. Make sure to use this command with caution. net start vssIt starts the VSS Service. net start vss It starts the VSS Service. vssadmin delete shadows /allIt deletes all shadow copies and restore points. This is a High Risk Command and has to be used with high caution. vssadmin delete shadows /all It deletes all shadow copies and restore points. This is a High Risk Command and has to be used with high caution. List all Shadows Volume Shadow Copy Service Administrative Command-line tool, upon using vss list shadows. The command provides the following information. Shadow Copy Set ID, Shadow Copy ID, Original Volume, Shadow Copy Volume, Originating Machine, Service Machine, Provider, Attributes, and more. List Shadow Storage Details The Shadow Copy Storage Association provides essential information related to Shadow Copy Storage Volume, Used Space, Allocated Space, and Maximum Shadow Copy Storage Space. Command to list VSS Writers The above command lists various information related to Writers, such as Writer ID, Writer Instance ID, State, and Last Error information. How to view VSS Providers on Windows 11? This command lists Volume Shadow Copy provider information, including the Provider Name, Provider Type, ID, and Version. Check Current Status of the VSS Service The command sc query vss lists information such as the Service Name, Type, State, WIN32_EXIT_CODE, SERVICE_EXIT_CODE, Checkpoint, and WAIT_HINT. sc query vss sc query vss Service Name WIN32_EXIT_CODE SERVICE_EXIT_CODE WAIT_HINT Take Away The above article discusses various information related to Volume Shadow Copy and Volume Shadow Copy Service on Windows 11. If you have any queries, kindly let us know in the comments. For more interesting articles, stay tuned to Winsides.com. Happy Computing! Peace out! Winsides.com

Walkthroughs, tutorials, guides, and tips. This story will teach you how to do something new or how to do something better.

Microsoft

What Is Volume Shadow Copy and Why Does Windows 11 Depend on It?

About Author

Comments

TOPICS

THIS ARTICLE WAS FEATURED IN

Related Stories

A Step-By-Step Guide to Activating IIS Client Certificate Mapping in Windows 11

How to Debug the Notorious “Windows 11 Login Problem” Bug

Windows 11's New Focus Mode Is Pretty Useful

Using OhMyPosh and CascadiaCode: Elevating PowerShell and Integrating with Git in Windows

How to Install ChatGPT as an App on Windows 11 and 10

Setting Different Backgrounds for Each Desktop on Windows 11 and 10

A Step-By-Step Guide to Activating IIS Client Certificate Mapping in Windows 11

How to Debug the Notorious “Windows 11 Login Problem” Bug

Windows 11's New Focus Mode Is Pretty Useful

Using OhMyPosh and CascadiaCode: Elevating PowerShell and Integrating with Git in Windows

How to Install ChatGPT as an App on Windows 11 and 10

Setting Different Backgrounds for Each Desktop on Windows 11 and 10

Light-Mode

Classic

Newspaper

Minty

Dark-Mode

Neon Noir

Minty

HN StartUps