Product Reviews

Ooops! Recovering Deleted Files: Volume Snapshots vs. Undelete 4.0

Microsoft Volume Shadow Copy Services and Undelete 4.0 are a potent one-two punch.

• By Danielle Ruest and Nelson Ruest
• 05/01/2004

Anyone who has suffered through these situations well knows that backups are lifesavers, but backups should not be the only answer. In fact, there are ways to provide a first line of defense in document and file protection.
One of the easiest is good file management habits: Save often and always, turn on the auto save feature if your office automation tool includes one, delete files through the Windows Explorer so that they will go first to the Recycle Bin, only empty the Recycle Bin when you have to, and so on. But even then, there are no Recycle Bins on network file shares — not until now, that is.

That's because Windows Server 2003 includes the Volume Shadow Copy Service. VSS is fast and easy to implement — and it has an immediate, positive impact on administrative workloads. That's because of the way the shadow copy service works with shared folders. The VSS service automatically takes a "snapshot" of the files located in any shared folder where the service has been enabled. These snapshots include an image of the contents of the folder at a given point in time. Depending on the space you make available to it (each VSS snapshot is 100MB in size), you could have up to 64 different snapshots of a disk volume. Because Microsoft has made a client component of VSS — the Previous Versions client (see Figure 1) — available along with the VSS, end users themselves can access these snapshots.

Figure 1. Users can now restore their own files from shadow copies. All they need is to access the properties of the file or folder they want to restore and click on the Previous Versions tab. This tab lists all available shadow copies. Users only need to locate the version they need and either restore it directly or view it to determine if it is the right one. The Previous Versions client must be deployed on workstations and mobile systems before this functionality can be made available to users.

This means that once implemented and the client deployed, users can pretty much recover any lost file by themselves, in the privacy of their own desk, without having to bother anyone and without the embarrassment of having to tell someone they've lost a file once again. The shadow copy service is designed to assist in the process of recovering previous versions of files without having to resort to backups. In this way, VSS is very much like a server "undelete."

By default, Windows Server 2003 creates shadow copies twice a day; at 7:00 a.m. and 12 noon. This schedule can be changed if it doesn't meet your requirements.

Shadow copies do not replace proper backups; they provide a first line of defense, that's all. Nevertheless, this feature is a boon to system administrators because it really does take work off your hands and it's easy to implement. Once your file server is ready, enable shadow copies (through disk properties). Set the copies to be stored on a drive that is separate from the file storage drive and deploy the Previous Versions client — the TWCLI32.MSI can be found in %systemroot%\system32\clients\twclient. Finally, educate your users and evaluate if the shadow copy schedule you set is right for your environment.

Undelete for Servers
If shadow copies aren't enough, you can install Executive Software's Undelete 4.0 on your file server, which replaces the Recycle Bin with an enhanced Recovery Bin (see Figure 2).

Figure 2. Using Undelete Server Edition, administrators can restore files deleted on server shares. Undelete automatically traps all file deletions and stores them in the disk's Recovery Bin. Users do not see server Recovery Bins unless they have a local version of Undelete Professional installed.

You can configure servers to use a single Recovery Bin for all drives or use one bin per drive. The latter will reduce disk input and output operations and improve the protection of your servers. In addition to the Recovery Bin, Undelete includes Undelete from Disk and Emergency Undelete. The first lets you search a disk drive for items that have been emptied from the Recovery Bin for possible recovery. The second lets you boot from the Undelete CD to possibly let you recover data that has been erased from a hard disk. In many cases, Emergency Undelete has more chances of working than Undelete from Disk since it does not perform any operations on the disk you are attempting to recover data from.

The installation of Undelete Server Edition is straightforward. Simply pop in the CD and select Install from the auto run screen. A few minutes and one reboot later, your Recycle Bin will have been replaced by a Recovery Bin. Undelete works by installing an I/O filter that traps all deletions from disk at the moment of deletion. Instead of deleting a file, it renames it and stores it in the Recovery Bin folder. By default, the Recovery Bin is set to take up to 20 percent of each disk drive for which it is activated. When the bin is full, it will automatically begin to replace older versions of its contents.

To recover a file, simply open the Recovery Bin, locate the file to restore and right-click on it to select restore. This operation must be performed by an administrator on the server, unless you have selected to use Undelete's Push Install feature to deploy Undelete Professional to all your workstations. This will not only give users access to server Recovery Bins, but also protect files stored on their local systems. Beware though! Since Undelete stores all deleted files in the same location, this may give curious users access to files they would not normally see.

The major difference between Undelete and the Volume Shadow Copy Service is time. Undelete catches all deletions as they occur, giving you real time protection. VSS takes a snapshot in time of the contents of a disk. This means that if a snapshot was taken an hour ago and you delete a file you were working on for the last fifty minutes, there will be nothing to recover. On the other hand, Undelete only protects files that have been deleted whereas VSS protects everything on the server. If you need to restore a version of a file that is five days old, but was never deleted, VSS will provide it whereas Undelete will never have had a copy in the first place.

Our recommendation: At the very least, provide a first line of defense by migrating all your Windows file servers to Windows Server 2003 and enabling VSS. Distribute the Previous Versions client to all systems. In fact, make it part of your standard operating environment and base-system build. Follow VSS best practices — found in Windows Server Help — to identify the best schedule for your environment. Educate your users on file recovery. And, if constant recovery of lost files is really important to you, install Undelete Server Edition. This will provide double protection for your user's data. If you want complete protection and peace of mind, deploy Undelete Professional to all your systems. This will enable your users to be completely self-sufficient.