In the past, I presented various ways to browse these mysterious device objects called "shadow copies". Shadow copies are static images in time (snapshots) of your volume contents, at some point in the past. These shadow copies are volumes on their own, with a file system namespace accessible through the regular Win32 APIs such as FindFirstFile/FindNextFile. For example the existing sample code in MSDN for these APIs that enumerates files on a real volume will work just fine on a shadow copy volume. In fact, that's how all backup applications are accessing shadow copy content today.
So, if these devices are real volumes, how can we view them in Explorer? It turns out that you can't view them by default - this is simply because these are volumes without an associated drive letter or root mount point. However, in XP or Windows Server (and Vista), you can still access these shadow copies by assigning them a drive letter using utilities like DOSDEV, or by doing tricks with the FOR command, etc.
Now, if you have Vista, it is much simpler to access shadow copy devices directly from Explorer. The trick is to use a new feature called Symbolic Links: to access the contents of a shadow copy as a "directory", simply create a symbolic link to the device. Vista also includes a convenient command-line tool called MKLINK.EXE to create symbolic links, which makes this operation very easy.
Here is an example of accessing the contents of a shadow copy device. The first step is to enumerate shadow copies on the machine, using the VSSADMIN LIST SHADOW command. This will give us the devices and also a creation timestamp.
C:\Windows\system32>vssadmin list shadows |more vssadmin 1.1 - Volume Shadow Copy Service administrative command-line tool (C) Copyright 2001-2005 Microsoft Corp.
Contents of shadow copy set ID: {c72c8036-d563-43c8-b351-1994dfad580a} Contained 1 shadow copies at creation time: 2/23/2008 9:59:04 AM Shadow Copy ID: {f3727808-bea6-4b59-bef7-6849ee721709} Original Volume: (C:)\\?\Volume{3e83355f-7c0e-11dc-b416-806e6f6e6963}\ Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy4 Originating Machine: Adi-Game-PC Service Machine: Adi-Game-PC Provider: 'Microsoft Software Shadow Copy provider 1.0' Type: ClientAccessibleWriters Attributes: Persistent, Client-accessible, No auto release, Differential, Auto recovered
Contents of shadow copy set ID: {0bf23f77-8461-4869-b391-da4d213940a5} Contained 1 shadow copies at creation time: 2/24/2008 4:00:24 AM Shadow Copy ID: {87d59b22-9e84-4d0d-81ca-2b565d6f7e55} Original Volume: (C:)\\?\Volume{3e83355f-7c0e-11dc-b416-806e6f6e6963}\ Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy5 Originating Machine: Adi-Game-PC Service Machine: Adi-Game-PC Provider: 'Microsoft Software Shadow Copy provider 1.0' Type: ClientAccessibleWriters Attributes: Persistent, Client-accessible, No auto release, Differential, Auto recovered
C:\Windows\system32>mklink /d c:\shadowcopy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy5\ symbolic link created for c:\shadowcopy <<===>> \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy5\
C:\Windows\system32>dir c:\shadowcopy Volume in drive C has no label. Volume Serial Number is 4A02-860C
Directory of c:\shadowcopy
12/14/2007 01:46 AM <DIR> Asi 01/15/2008 12:56 AM <DIR> bin 12/13/2007 11:59 PM <DIR> debuggers 12/13/2007 11:55 PM 17,644,031 dir.log 01/14/2008 11:41 PM <DIR> Downloads 01/01/2008 05:50 PM <DIR> dumps 12/30/2007 11:43 PM <DIR> garbage 01/08/2008 11:13 PM <DIR> Garmin 10/15/2007 09:03 PM <DIR> Intel 12/30/2007 11:59 PM <DIR> Program Files 01/27/2008 01:32 AM <DIR> Program Files (x86) 01/15/2008 12:17 AM <DIR> test 01/30/2008 06:52 AM <DIR> Users 12/14/2007 01:55 AM <DIR> WinDDK 02/13/2008 05:23 AM <DIR> Windows 02/21/2008 10:43 PM <DIR> Work 1 File(s) 17,644,031 bytes 15 Dir(s) 147,657,666,560 bytes free
That's it. Now I have a persistent link called c:\shadowcopy which points to the contents of the shadow copy device - which is the image of my C:\ drive at 4:00 AM (this is when my latest system restore point was created).
A new notes,though:
1) Make sure you use the "/D" option in MKLINK so you create a directory-based, not a file-based symbolic link
2) Make sure you append a backslash to the shadow copy device in the MKLINK command (marked in red above)
If this made you interested about shadow copies - note that you can create, enumerate and delete shadow copies programatically using either VB scripts that use the WMI API for shadow copy administration, or by using the VSS API (documented publicly on MSDN). Sample code is available in the Platform SDK as well.