Boswell's Q&A

Me and My Volume Shadow Copy

Quick look at this often-ignored but useful Windows 2003 feature, including some gotchas to watch for when deploying it.

• By Bill Boswell
• 05/03/2005

Anon: I'm glad to hear that you're going to use one of the coolest features in Windows Server 2003. I give lots of presentations on Windows server technologies and it's surprising how few people have even tried VSS in a lab, much less deployed it in production. I think it's because nobody quite trusts VSS to be as simple as Microsoft says it should be.

If you aren't familiar with Volume Shadow Copy services, here's a quick rundown. VSS has the capability of "freezing" a volume then taking a point-in-time copy of the volume's content. Applications such as backup programs, file copy programs, data integrity verification programs, and so forth can perform their operations on the point-in-time copy, thus ensuring data consistency.

To make this magic work, VSS uses three elements. The first element is the hardware that holds the volume. Many SAN and NAS devices have features for taking point-in-time copies of a live volume. The device might maintain a complete mirror image of a volume that can be split away from the source volume. This is called a "split-mirror" copy. Other storage devices maintain a block map of a volume and collect original content in a special repository prior to permitting a block to be modified. This is called a "copy-on-write" copy. High-end storage devices typically use a combination of split-mirror and copy-on-write to take point-in-time copies. A storage device that includes a driver that allows VSS to tell the device to take a point-in-time copy is called a "VSS Provider."

You don't need a high-end SAN or NAS device to use VSS. Microsoft includes a software provider in Windows Server 2003 that can do copy-on-write operations without special storage hardware.

The second VSS element is a group of services and applications that use the volume to store data. These are called "VSS Writers." Examples of VSS Writers include SQL Server, Exchange, DHCP, WINS, IIS, the Event Log service, and others.

The third VSS element is the application that wants to perform a procedure that requires data consistency. These applications include backup programs, file copy programs, and so forth.

When a VSS Requestor needs to perform a procedure on a volume, it asks VSS to freeze the volume. VSS communicates this request to the various VSS Writers. When all the Writers have stopped their disk I/O, VSS tells the Provider to make a point-in-time copy. When that operation finishes, VSS thaws the volume and points the Requestor at the copy.

Windows Server 2003 includes a Requestor called Volume Shadow Copy for Shared Folders. This requestor allows you to take periodic point-in-time copies of a volume then present the original content in the form of previous versions of files and folders. There is a special Explorer add-on called the Previous Versions client that allows you to view the previous versions of a file and either make a copy of the previous version or overwrite the current version.

In other words, Volume Shadow Copy for Shared Folders allows you to do nearly instant file recoveries. You can even deploy the Previous Versions client to your users to let them view the file change history, if you trust them to use this feature wisely. If not, you can restrict client deployment to administrators.

That's the cool stuff. Here are the gotchas.

First, the VSS software provider needs sufficient storage capacity to maintain a database of the blocks in use on a target volume and to store the original content of blocks as they are modified. On a heavily used volume, VSS might need storage capacity from 10 to 30 percent of the target volume or more, depending on how long you want to retain previous versions. If you run out of storage space, the oldest copies are removed first. In production, you'll want to add more spindles to store the VSS files or carve out another LUN in your SAN. (The storage must be local to the server. It cannot be a mapped drive.)

Second, VSS retains a maximum of 64 point-in-time copies of a volume. This allows you to take two point-in-time copies each working day, which gives you up to a month-and-a-half of previous versions. This is a hard-coded limit and cannot be modified.

Third, VSS stores original content in 16K blocks. Unless you specifically format a new volume to use 16K allocation units, it's possible to overwhelm VSS with updates during defrag or heavy file loads if the source volume is formatted in smaller allocation units (typically 4K in size). SP1 has a fix for this issue. You can also call Product Support Services (PSS) to get hotfix KB 833167.

Be sure to let me know if you deploy Volume Shadow Copy for Shared Folders into your production environment. I'll pass on the good and bad to the other readers.

Until next week...

More on Access Based Enumeration
If you recall a column my column, "The Enforcer," I mentioned a new feature in Windows Server 2003 SP1 called Access Based Enumeration. ABE allows you to hide folders and files from users who don't have access. It's a cool feature but there aren't any tools in SP1 to take advantage of it. I got a note from the ABE product manager that there is now a command-line and GUI utility available to manage ABE and a white paper describing the feature. You can download the tool by clicking here and the documentation here.