Volume Shadow Copies: What They Are & How to Use Them

Volume Shadow Copies (also called Volume Snapshot Service or VSS) are a Windows technology that creates point-in-time snapshots of files and volumes, letting you restore older versions of a file or recover deleted data without a full backup. You can access them through the Previous Versions tab in File Explorer, or with the vssadmin command-line tool. This article explains how they work, how to enable and use them, and the common problems you might run into.

How Volume Shadow Copies Work

At its core, VSS coordinates between three components: the VSS service (which manages snapshots), the volume (the drive being snapshotted), and the requesting application (like Windows Backup or System Restore). When a snapshot is requested, VSS tells the volume to freeze writes for a few seconds, creates a copy-on-write bitmap, then unfreezes. From that point on, the original data is left untouched, and any new writes go to a separate area. This means the snapshot is a consistent view of the volume at that exact moment.

Snapshots are stored in the hidden System Volume Information folder on the same drive. They are not full copies of every file; they only record the differences between the current state and the snapshot. That is why they are fast to create and take relatively little space. However, they are not a substitute for a real backup—if the drive fails, the snapshots fail with it.

How to Enable and Configure Shadow Copies

On Windows 10 and 11, shadow copies are not enabled by default for your system drive. You have to turn them on manually, either through the System Protection settings or via the command line.

• System Protection: Go to Control Panel > System > System Protection, select your drive, and click Configure. Turn on “Enable system protectionâ€� and set a maximum usage size. This creates snapshots automatically before significant system events (like installing a driver or Windows Update).
• vssadmin: Open an elevated Command Prompt and run vssadmin create shadow /for=C: to create a manual snapshot. To see existing snapshots, use vssadmin list shadows.
• Scheduled tasks: For regular snapshots, you can create a scheduled task that runs vssadmin create shadow daily or weekly. This is common on file servers.

Note that the maximum storage size is a cap, not a reservation. VSS will use up to that amount, then delete the oldest snapshots to make room for new ones.

How to Restore a File from a Shadow Copy

The most common way to restore a file is through the Previous Versions tab. Right-click a file or folder in File Explorer, select Properties, and go to the Previous Versions tab. You will see a list of available snapshots with their dates and times. Select one and click Restore to overwrite the current version, or Copy to save it to another location.

If you deleted a file, you can open the Previous Versions of the parent folder, browse into it, and copy the file out. This works because the snapshot contains the folder structure as it existed at that time.

Common Problems and Limitations

Shadow copies are not without issues. Here are the ones users run into most often:

• No Previous Versions tab: This usually means System Protection is off, or the drive is not NTFS (FAT32 and exFAT do not support VSS).
• Snapshots missing after a reboot: On Windows 10/11, manual snapshots are sometimes deleted after a reboot if the system drive has low free space or if the VSS storage limit is too small.
• “The shadow copy provider is not registeredâ€� error: This happens when the Microsoft Software Shadow Copy Provider service is disabled or corrupted. Restart the service or run vssadmin list providers to check.
• Performance impact: Creating a snapshot causes a brief pause in disk I/O. On busy servers, this can be noticeable, so schedule snapshots during off-peak hours.
• Not a backup: A ransomware attack that encrypts your files will also encrypt the shadow copies if it has write access to the system. Many ransomware strains explicitly delete VSS snapshots. Keep a separate offline backup.

Shadow Copies vs. File History vs. Backup and Restore

Windows offers several backup technologies, and it is easy to confuse them. Here is a quick comparison:

• Volume Shadow Copies: Point-in-time snapshots of an entire volume. Good for recovering an accidental overwrite or deletion. No granularity—you get the whole volume state, not individual file versions over time.
• File History: Continuously backs up files in your Libraries, Desktop, Contacts, and Favorites to an external drive or network location. It keeps multiple versions of each file and lets you restore any version. It is not a full system backup.
• Backup and Restore (Windows 7): Creates a full system image and scheduled file backups. It is more comprehensive but requires more storage and is slower.

For most home users, File History is easier and more reliable for day-to-day file recovery. Shadow copies are best for system-level restore points or when you want to recover a file without a separate backup drive.

Costs and Storage Considerations

Shadow copies consume disk space on the same volume. The default maximum is 5% of the drive size (or 10% on Windows Server). If you have a 1 TB drive, that means up to 50 GB of snapshot space. The actual usage depends on how much data changes between snapshots. If you modify a 10 GB database, the snapshot will need to store the original 10 GB blocks, even if the rest of the drive is empty.

To change the storage size, use vssadmin resize shadowstorage /for=C: /on=C: /maxsize=20GB. Be careful: shrinking the size too much will cause older snapshots to be deleted immediately. There is no way to recover them once they are gone.

Frequently Asked Questions

Can I access shadow copies on another computer?

Yes, if the drive is physically connected to another Windows PC, you can mount it and use tools like vssadmin list shadows to see the snapshots. However, the snapshots are tied to the volume GUID, so you may need to assign a drive letter first. In practice, it is easier to restore the snapshot on the original machine.

Why are my shadow copies taking up so much space?

Every time a file changes, VSS saves the old version of the changed blocks. If you have large files that change frequently (like a database or a virtual machine disk), the shadow storage can fill up quickly. Check usage with vssadmin list shadowstorage and consider moving the shadow storage to a different drive with vssadmin add shadowstorage.

Do shadow copies protect against ransomware?

No. Ransomware often deletes shadow copies as part of its attack to prevent recovery. Even if it did not, the encrypted files would be written to the volume, and new snapshots would capture the encrypted state. Always keep an offline or cloud backup that is not continuously connected.

How long are shadow copies kept?

There is no fixed retention period. They are kept until the storage limit is reached, then the oldest are deleted. On system protection, snapshots are also deleted when the system runs a disk cleanup that includes “System Restore and Shadow Copies.�

Can I create a shadow copy of a drive that is not the system drive?

Yes, you can create shadow copies of any NTFS volume, including external drives, as long as the VSS service is running. However, the drive must be NTFS and have enough free space for the shadow storage.

What happens if I delete a file and then create a shadow copy?

The shadow copy will not contain the deleted file because the deletion happened before the snapshot. You need to restore from a snapshot that was created before the deletion. If you do not have one, the file is likely gone unless you have another backup.

Related

• SSD Cache for Repeated Reads: When Does It Actually Speed Up Arrays?
• Garden Windows and Doors: A Practical Guide
• UK to Korea Flight: Routes, Duration & Airlines