Creating shadow copies from the command line on Windows

A less-known feature in Windows is the command-line support for shadow copies. The command is called VSSADMIN.EXE and is already present in the operating system - just run it without parameters and you will see some sample usage. Here are some quick examples:

1) Creating a shadow copy on C:\. This works only in Server 2003 only with the built-in command-line tool. In XP, hovewer, you cannot create shadow copies from the command-line, and you can have maximum one shadow copy per volume. If you start the backup process through NTBackup, it will create shadow copies under the cover.

vssadmin create shadow /for=C:

2) Listing shadow copies (run it while NTBackup is running, for example - you should see some shadow copies)

vssadmin list shadows

3) Listing shadow copy writers. These are application-level components that participate in the shadow copy creation. For example, a SQL server database is flushed out to get a consistent image on the shadow set. As an exercise, run this command during NTBackup.

vssadmin list writers

4) Listing shadow copy contents. This is tricky since the shadow copies are not regular (standalone) volumes. These are pseudo-volume devices, without a drive letter or volume name, in the form \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopyNNN. You can still access their contents from the command line, if you know how. For example, copying a file from the shadow copy can be done this way:

dir > c:\somefile.txt


vssadmin create shadow /for=c:


vssadmin list shadows


(get the shadow copy device, let's say that this is \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy12)


set VSHADOW_DEVICE=\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy12


copy %VSHADOW_DEVICE%\somefile.txt c:\somefile_bak.txt

Or, finally, to enumerate all files on a shadow copy device we will use the "for /R" command. Note that we used %i and not %%i so the command below will not work properly in a CMD batch file:

dir > c:\somefile.txt


vssadmin create shadow /for=c:


vssadmin list shadows


(get the shadow copy device, let's say that this is \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy12)


set VSHADOW_DEVICE=\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy12


for /R %VSHADOW_DEVICE%\ %i in (*) do @echo %i

As a final note, I want to add that the VSS API allows much more flexible ways to manipulate shadow copies. Through the VSS API you can assign drive letters to them, etc.