Antimail : VSS

A simple way to access Shadow Copies in Vista

AdiOltean — Thu, 28 Feb 2008 21:37:18 GMT

In the past, I presented various ways to browse these mysterious device objects called "shadow copies". Shadow copies are static images in time (snapshots) of your volume contents, at some point in the past. These shadow copies are volumes on their own, with a file system namespace accessible through the regular Win32 APIs such as FindFirstFile/FindNextFile. For example the existing sample code in MSDN for these APIs that enumerates files on a real volume will work just fine on a shadow copy volume. In fact, that's how all backup applications are accessing shadow copy content today.

So, if these devices are real volumes, how can we view them in Explorer? It turns out that you can't view them by default - this is simply because these are volumes without an associated drive letter or root mount point. However, in XP or Windows Server (and Vista), you can still access these shadow copies by assigning them a drive letter using utilities like DOSDEV, or by doing tricks with the FOR command, etc.

Now, if you have Vista, it is much simpler to access shadow copy devices directly from Explorer. The trick is to use a new feature called Symbolic Links: to access the contents of a shadow copy as a "directory", simply create a symbolic link to the device. Vista also includes a convenient command-line tool called MKLINK.EXE to create symbolic links, which makes this operation very easy.

Here is an example of accessing the contents of a shadow copy device. The first step is to enumerate shadow copies on the machine, using the VSSADMIN LIST SHADOW command. This will give us the devices and also a creation timestamp.

C:\Windows\system32>vssadmin list shadows |more
vssadmin 1.1 - Volume Shadow Copy Service administrative command-line tool
(C) Copyright 2001-2005 Microsoft Corp.

Contents of shadow copy set ID: {c72c8036-d563-43c8-b351-1994dfad580a}
   Contained 1 shadow copies at creation time: 2/23/2008 9:59:04 AM
      Shadow Copy ID: {f3727808-bea6-4b59-bef7-6849ee721709}
         Original Volume: (C:)\\?\Volume{3e83355f-7c0e-11dc-b416-806e6f6e6963}\
         Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy4
         Originating Machine: Adi-Game-PC
         Service Machine: Adi-Game-PC
         Provider: 'Microsoft Software Shadow Copy provider 1.0'
         Type: ClientAccessibleWriters
         Attributes: Persistent, Client-accessible, No auto release, Differential, Auto recovered

Contents of shadow copy set ID: {0bf23f77-8461-4869-b391-da4d213940a5}
   Contained 1 shadow copies at creation time: 2/24/2008 4:00:24 AM
      Shadow Copy ID: {87d59b22-9e84-4d0d-81ca-2b565d6f7e55}
         Original Volume: (C:)\\?\Volume{3e83355f-7c0e-11dc-b416-806e6f6e6963}\
         Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy5
         Originating Machine: Adi-Game-PC
         Service Machine: Adi-Game-PC
         Provider: 'Microsoft Software Shadow Copy provider 1.0'
         Type: ClientAccessibleWriters
         Attributes: Persistent, Client-accessible, No auto release, Differential, Auto recovered

C:\Windows\system32>mklink /d c:\shadowcopy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy5\
symbolic link created for c:\shadowcopy <<===>> \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy5\

C:\Windows\system32>dir c:\shadowcopy
Volume in drive C has no label.
Volume Serial Number is 4A02-860C

Directory of c:\shadowcopy

12/14/2007 01:46 AM    <DIR>          Asi
01/15/2008 12:56 AM    <DIR>          bin
12/13/2007 11:59 PM    <DIR>          debuggers
12/13/2007 11:55 PM        17,644,031 dir.log
01/14/2008 11:41 PM    <DIR>          Downloads
01/01/2008 05:50 PM    <DIR>          dumps
12/30/2007 11:43 PM    <DIR>          garbage
01/08/2008 11:13 PM    <DIR>          Garmin
10/15/2007 09:03 PM    <DIR>          Intel
12/30/2007 11:59 PM    <DIR>          Program Files
01/27/2008 01:32 AM    <DIR>          Program Files (x86)
01/15/2008 12:17 AM    <DIR>          test
01/30/2008 06:52 AM    <DIR>          Users
12/14/2007 01:55 AM    <DIR>          WinDDK
02/13/2008 05:23 AM    <DIR>          Windows
02/21/2008 10:43 PM    <DIR>          Work
               1 File(s)     17,644,031 bytes
              15 Dir(s) 147,657,666,560 bytes free

That's it. Now I have a persistent link called c:\shadowcopy which points to the contents of the shadow copy device - which is the image of my C:\ drive at 4:00 AM (this is when my latest system restore point was created).

A new notes,though:

1) Make sure you use the "/D" option in MKLINK so you create a directory-based, not a file-based symbolic link

2) Make sure you append a backslash to the shadow copy device in the MKLINK command (marked in red above)

If this made you interested about shadow copies - note that you can create, enumerate and delete shadow copies programatically using either VB scripts that use the WMI API for shadow copy administration, or by using the VSS API (documented publicly on MSDN). Sample code is available in the Platform SDK as well.

[RO] Seminar - Storage si programare distribuita

AdiOltean — Thu, 03 May 2007 20:57:00 GMT

Florin Lazar, Todi Pruteanu si cu mine am demarat in cursul acestei saptamani un seminar tehnic pe teme de storage in Vista si programare distribuita in WCF. Mai multe detalii aici: http://reg.studentclub.ro.

Pana acum seminariile din Bucuresti si Cluj au avut un raspuns fantastic! Daca aveti opinii, impresii (pozitive sau negative) m-as bucura sa le puneti in sectiunea de comentarii...

Si nu in ultimul rand, multumiri lui Todi si Microsoft Romania pentru organizarea acestui eveniment.

Windows Home Server - links

AdiOltean — Fri, 16 Mar 2007 01:43:27 GMT

A friend of mine didn't know about Windows Home Server - so I sent him these links:

- Main site: http://stopdigitalamnesia.com

- Interview with Charlie Kindel http://channel9.msdn.com/ShowPost.aspx?PostID=270965

- Download: https://connect.microsoft.com/site/sitehome.aspx?wa=wsignin1.0&siteid=38

- Articol on Wikipedia: http://en.wikipedia.org/wiki/Windows_Home_Server

- Blog: http://blogs.technet.com/homeserver

- Press release: http://www.microsoft.com/Presspass/press/2007/jan07/01-08WindowsHomeServerPR.mspx

Previous Versions in Vista - on Channel 9!

AdiOltean — Tue, 27 Feb 2007 05:29:48 GMT

Hot and fresh from Channel 9: a session on Shadow Copies in Vista, and its applications: Previous Versions and the brand-new System Restore.

Check it out.

The next generation of storage management is here!

AdiOltean — Thu, 07 Dec 2006 08:45:00 GMT

Storage management is complex, we all know it. For many people, even the simplest opeartions in a SAN look like black magic. It's no wonder why - if you want to, say, create a brand new 5 TB file share using your brand new your SAN box: you need to create a new LUN in your SAN, mounting it on a machine, initialize the disk, create partitions, assigning drive letters, create the file shares and assign proper permissions, etc.

The new Windows product launched today solves this problem. WUDSS offers simple, easy-to use wizards, for the complex operations above, plus of course, the famous Finish button. It's that simple!

And, yes, as you could guess, the main theme is simplifying and integrating all storage management scenarios (at least for file servers) in a single management UI:

- A new out-of-the-box experience (OOBE) that allows you to "initialize" your brand new shiny storage box with a few mouse clicks.

- Combined file, print and block-level storage services in a single management interface

- Easy remote management through a single HTTP URL

- New cluster configuration wizard that vastly simplifies provisioning and creation of shared disk resources.

The product will ship on Dell's new PowerVault NX 1950 hardware initially, and other OEMs will incorporate it in other NAS boxes.

P.S. WUDSS stands for Windows Unified Data Storage Server 2003 - a long name, in our established Microsoft tradition :-)

Time Machine: Vista Previous Versions are now making their way into Mac OS X Leopard...

AdiOltean — Mon, 07 Aug 2006 23:25:00 GMT

Mac OS X Leopard incorporates now a previous versions feature called Time Machine - similar with something that we added in Windows Server 2003 a while back, and recently in Windows Vista as well.

If you just read the text at http://www.apple.com/macosx/leopard/timemachine.html it looks a lot with what Vista already offers as well - automatic backup of your whole system at night, ability to use an external drive for your backups (Vista can also backup to a DVD-RW), ability to restore any file by going back in time, etc.

However, their UI is very interesting - it is a Flip3D-like browser of previous versions of your file system.

P.S. Time Machine? Funny enough - when we designed the Previous Versions feature in Windows Server 2003 back in 2001, the code name of our product was Timewarp.

The Previous Versions feature in Vista - an ArsTechnica review

AdiOltean — Mon, 31 Jul 2006 22:30:00 GMT

ArsTechnica noticed our new Previous Versions feature in Vista. Give it a click:

http://arstechnica.com/news.ars/post/20060730-7383.html

More VSHADOW stuff: how to backup Exchange, SQL, NTFS

AdiOltean — Wed, 25 Jan 2006 23:47:00 GMT

While researching for the previous post, I just started a few searches for VSHADOW on the internet, and I found more interesting usages of it. One example: EqualLogic published a nice technical report of using VSHADOW to backup/restore Exchange, SQL and NTFS. Here is the link:

http://www.equallogic.com/docs/tr-ms-vshadow.pdf

Just to bring you up to speed: VSHADOW was written to showcase for VSS backup and restore capabilities. The source code is available on the VSS SDK. You can use VSHADOW to backup/restore Exchange/SQL/NTFS on any hardware array that implements VSS HW providers, in a similar way as outlined in the paper above.

P.S. BTW - standard disclaimers apply. I am not affiliated in any way with EqualLogic.

Fast backup of Virtual Server images (using VSHADOW)

AdiOltean — Wed, 25 Jan 2006 23:39:00 GMT

Jeff Trumbull published a very nice script on how to backup a Virtual Server image wiht about one minute of downtime!

The solution uses VSHADOW.EXE, a small command-line utility that can be used to create shadow copies. VSHADOW is part of the VSS SDK

How to build a cheap backup server

AdiOltean — Sat, 21 Jan 2006 23:18:00 GMT

A while back, our team helped the Small Business Server team with some interesting VSS issues just before shipping SBS 2003. The issues were solved, and each member of our team got a free CD of SBS 2003. So, I decided to do something with it - an SBS machine that also can be used as a SBS and backup server.

After several trips to Fry's (to watch for the green labels and get the best deals) this is what I settled for:
- Case: Antec Sonata II. A little bit pricey, but I wanted a case with a real solid design and a very good power source (Antec SmartPower 2.0 450W). Price after rebates: $70, which is pretty good keeping in mind that only the source is sold separately for almost $60. This is the only component from the server on which I didn't try to get the cheapest thing available. You should never go cheap on the power source, or you'll regret.
- MB + CPU combo: ASUS K8V-MX plus Athon64 3000+ socket 754. Price: 130$. Cheap, powerful enough (more than enough) for what I intended to do, but unfortunately no Gigabit ethernet. Still, I had video output included thanks to the K8M800 chipset, which saved me from buying a separate video card.
- CPU fan: 15$
- Memory - 2x512 PC3200 DDR400: 70$. Probably even cheaper these days.
- Two 250 GB SATA harddisks: $60 each after rebates. I intended to use them to hold the backups. A RAID-1 controller is included in the motherboard, but unfortunately it is not bootable, so I needed a separate harddisk to hold the OS. Even if they have very similar characteristis, the harddisks are not the same model (Western Digital and Hitachi). I could get only one of each due to the "one rebate per house" limitation. So this is an unusual mirror pair, but it seems to work pretty well.
- One additional 200 GB PATA main harddisk to hold the OS. Probably overkill, but I thought it was a nice deal to get it for only $40 after the rebate.An alternative was to buy instead a dedicated Adaptec PCI RAID controller which is bootable from (and use the SATA harddisks to hold everything), but I would have ended up with the same price anyway.
- No mouse, keyboard, video card or monitor. It's a server after all. Like an iPod, the server itself has only two cables going into it: the network cable, and the power cord. (I needed to borrow a keyboard, a mouse and a monitor during SBS setup, however).

Total: $445 (after various rebates). Max downtime on future issues? A few days, (including more Fry's trips) which is good enough for me. If any part breaks, I can replace it easily (and if the main PATA harddisk breaks, all I have to do is to buy another one and do an ASR restore).

The most painful part in this scheme was the SBS setup, which required countless reboots (to install SBS 2003, then SBS SP1, then apply various security patches, etc.). But now it pretty much works by itself, with zero management from my side.

In the end, I have a nice-looking NAS box with lots of free space on backup shares. With Exchange, Sharepoint and SQL Server incuded. The server performs a scheduled backup of itself on the backup disks, while keeping the last twenty backups available.

[update: minor typo fixes, as usual :-)]

Using NTBackup to achieve P2V

AdiOltean — Fri, 20 Jan 2006 12:48:00 GMT

I always thought about writing a post about physical-to-virtual migration strategies in combination with VSS, but I never got to it. So it's not surprising that others started to uncover this trail :-)

One particular technique in this area is described in Lindsay Donaghe's blog - she uses NTBackup to do pretty much the following:
1) Backup the physical machine (Windows XP, or something similar). It is important that the backup is done using the ASR mode (Automated System Recovery) because the virtual machine hardware will be different.
2) Create a virtual machine. She uses VMWare but you can use Virtual PC as well.
3) Perform an ASR restore on the newly-created machine. Done!

I would add one more thing. The technique is also useful as a testing procedure to verify that your ASR backup can be actually used to perform a restore. Otherwise, an untested backup is a useless backup, as Murphy would say...

Windows Backup - highlighted as one of the main Vista features!

AdiOltean — Thu, 05 Jan 2006 23:20:00 GMT

Whoohoo! Windows backup is there. Proeminently:

http://www.microsoft.com/windowsvista/features/default.aspx#wvC2

They also mention the Shadow Copy (aka Previous Versions). This is a standard feature now in Windows Server 2003, which is invaluable for many many customers. Now we are bring it to the masses directly into Vista.

Did you delete a file by mistake? Or did you overwrite it and lost your old work? Just right-click on it (or on the parent directory) and you will see all its previous versions in the last month.

GetVolumeInformationW warnings in VSS - what do they mean?

AdiOltean — Mon, 12 Sep 2005 20:34:00 GMT

I mentioned a while back a weird-looking event log entry:

Event Type: Warning
Event Source: VSS
Event Category: None
Event ID: 12290
Date: 8/30/2004
Time: 12:37:19 PM
User: N/A
Computer: SomeMachineName
Description:
Volume Shadow Copy Service warning: GetVolumeInformationW
(\\?\Volume{57d9017d-f07e-11d8-8e52-505054503030}
\,NULL,0,NULL,NULL,[0x00000000], , 260) == 0x00000005.
hr = 0x00000000.

The error code (0x00000005) is the return code from the GetVolumeInformation API on the volume with the name \\?\Volume{57d9017d-f07e-11d8-8e52-505054503030} (you can see the correspondence between volume names and drive letters by running the MOUNTVOL command).

What this means in the context of VSS? Let's assume that you set up Y: to be the shadow storage for volume X: (i.e. when X: is shadowed, the shadow copy files for X: are stored on Y:). There are several cases that can lead to this error:

1) If the error is 0x00000005 (i.e. ERROR_ACCESS_DENIED), then you either do not have sufficient access rights on the corresponding volume (X: or Y:) for the Local System account, or there is an application (Chkdsk or Format) which acquired exclusive access to the volume. Make sure that Local System has enough access rights to the root.

2) If the error is 0x00000002 or 0x00000003 (i.e. ERROR_FILE_NOT_FOUND or ERROR_PATH_NOT_FOUND), then one of the X: or Y: volumes are missing.

As I already mentioned in my previous post, this is one of the classical cases where the code calls a Win32 API which is not supposed to fail (or at least the programmer that wrote the code did not expect the API to fail). But it turns out that in reality this API does fail in some ways that were not anticipated. That's why it is important to have a good feedback loop between the PSS engineers and the development team...

VSS writers and inconsistent shadow copies

AdiOltean — Thu, 01 Sep 2005 07:19:00 GMT

A few days ago, a customer told me that he encountered a weird error while using NTBackup to backup the system. The error text looked like this in backup log:

Media name: "System State.bkf created 8/29/2005 at 5:38 PM"
Volume shadow copy creation: Attempt 1.
"MSDEWriter" has reported an error 0x800423f0. This is part of System State. The backup cannot continue.

Error returned while creating the volume shadow copy:800423f0

The first thing that we observe is the particularly cryptic message which doesn't really tell anything, except that an error occured. Unfortunately this is an example of a useless message: what is the message transmitted here? What should be the next steps to remedy the situation? Fortunately, developers at Microsoft (including me) started to realize in the last how important is to have the right error message infrastructure in place - but I digress.

Being familiar with VSS, I immediately spotted the issue: 800423f0 is VSS_E_WRITERERROR_INCONSISTENTSNAPSHOT (documented briefly here on MSDN, in the VSS SDK section).

What is an inconsistent shadow copy?

Let me step back and offer some context to this problem. VSS is a complex infrastructure that allows backup applications to create, list, delete shadow copies in order to get a reliable backup. These shadow copies are especially useful during backup, where you need a stable "version" of your data. Shadow copies are nothing more than static images of the system volumes, images that are frozen in time. More technical information about VSS can be found here.

VSS also allows applications to participate in the shadow copy creation process. Applications can receive various notifications during backup and restore - notifications that are used to ensure that these applications do have a consistent stored image on the shadow copy. These notifications are received through some dedicated software components called VSS writers. For example, AD has one writer, Exchange another writer, SQL another one, etc. (you can actually enumerate the writers on your machine and their state through the VSSADMIN LIST WRITERS command).

Now, a consistent image is absolutely needed in order to guarantee a reliable restore of your applications. At restore time, nothing is worse than to discover that your backed-up data is corrupt or inconsistent. And this is the reason for adding a special error code to denote the fact that a certain writer is in "inconsistent state" during the creation of a certain shadow copy set.

For example, if you have a SQL database with the database on X:\ and logs on Y:\, and you create a shadow copy set containing only X:\, then the shadow copy is inconsistent with respect to the SQL writer. That doesn't mean that the shadow copy will be inconsistent with respect to other writers - it is very likely that no other writer will have data on X:\.

What is the solution?

I'm skipping for now the technical details on why this "inconsistent snapshot" can cause problems, and go directly to the solution. The workaround to the NTBackup problem sounds weirder than the usual set of workarounds, but here it is:
1) Isolate all the relevant volumes on the machine that might contain active SQL databases and/or logs.
2) On each of these additional volumes (which are not related with the system state) create one empty file.
3) In NTBackup, along with the system state, include these empty files created above. (but not the large database files). This will include that all these volumes will be part of the shadow copy set, and therefore the MSDE Writer should not fail anymore with 0x800423f0.

This will eliminate the NTBackup error when you have this type of failures with the MSDE/SQL writer. A similar problem can happen with the AD writer (named the NTDS writer on domain controller). The solution is very similar.

Technical details...

Why does this work? Well, it's essentially a limitation of NTBackup. NTBackup doesn't "know" whether the SQL writer is important enough such that a failure in it should abort the system state backup. Part of the reason is the fact that some system services (like UDDI) depend on SQL or MSDE. Also, the particular mode used to create shadow copies is based on the assumption that the correct set of SQL-related volumes need to be present in the set (in the example above, X:\ and Y:\). If one volume is present and the other one is missing, the writer goes into an error state. Now, if you select at least one file in a given volume, NTBackup will include that volume in the shadow copy set. Since both the database & log volumes are now in the set, the SQL writer is happy.

That said, I would also like to mention that the level of integration between NTBackup and VSS is atypical in this specific case - a different backup application should choose to enforce writer consistency not at the volume level, but at the component/file level. Such an backup application will cause the SQL writer to go in a failed state only if you select the database file and not the log file, for example. In other words, if one of the writer-related files is present in the set and the other ones are missing, only then the writer goes in a failed state.

One might appear confusing from the details above. How does the writer know whether the backup application needs volume-level consistency (i.e. NTBackup) or component/file-level consistency (all other backup apps)? The answer is that the application has the ability to choose between the two consistency modes, in the IVssBackupComponents::SetBackupState(...) API. The first parameter dictates the selection model for this backup session. The recommended value is bSelectComponents == TRUE, which also tells that the backup application will select the necessary writer components during backup. The bSelectComponents == FALSE is a value maintained for legacy reasons (compatibility with NTBackup, mainly) but in general, it is not a good choice to use this mode, especially if you want to keep track what writer components are present (and in consistent state) on the shadow copy set.

One more note: The VSHADOW.EXE sample requestor, provided in the VSS SDK, provides a sample implementation of a backup application that works in component mode. BETEST.EXE is a more complex VSS requestor, that uses advanced VSS features.

Data Protection Manager closer to shipping...

AdiOltean — Sat, 09 Jul 2005 01:27:00 GMT

The new Data Protection Manager is almost done! From Infoworld:

Microsoft has completed production of its disk-based data backup and recovery system and will release the product to manufacturing in the next 30 days, said Ben Matheson, group product manager for DPM at Microsoft. The vendor also has set the pricing for the product at $950 for one DPM server and the ability to protect three other file servers. Microsoft has completed production of its disk-based data backup and recovery system and will release the product to manufacturing in the next 30 days, said Ben Matheson, group product manager for DPM at Microsoft. The vendor also has set the pricing for the product at $950 for one DPM server and the ability to protect three other file servers.

For some, DPM seems too revolutionary - for example Josh Meier from Ars Technica misses the point on how DPM would integrate enterprise backup solution. DPM is not a complete replacement for tape backup - it is a complementary solution that can go in parallel with a tape-based backup. In fact, DPM already has integrated support for tape-oriented backup as well, in addition of providing fast recovery abilities at the file level.

Microsoft designed DPM from the ground up to interoperate with existing tape-based backup and recovery products, but recommends that customers use disk as well because of the unreliability and time-consuming nature of tape.

"DPM doesn’t really replace anything; it's designed to be complementary," Matheson said. "Ninety percent or more customers rely on tape backup, but when it comes time to do recovery, it’s slow and unreliable ... we are advocating that customers have a disk-to-disk-to-tape backup scenario."

(update - fixing link)