What Is Shadow Copy and How to Use It
Shadow copies, or Shadow Volume Copies, are a feature introduced to Windows Server way back in 2003. Effectively, it is a functionality that allows Windows to periodically take snapshots of all the files on a Windows syste, and look for file changes made since the last check. When such a change is noted, it is recorded, indexed, and stacked on top of the previous record, which creates a neat history catalog of the file or folder in question.
This process was then added as a standard Windows feature by the time Vista was rolled out, as the "System Restore" function. Shadow volume copies are, in essence, the bedrock of the Windows "Previous Versions" feature.
Most notably, this function is completely automated and runs in the background as a system-level process.It creates "Restore Points" which aren't subject to the limitations of user-initiated file operations. This greater freedom and flexibility allow it to capture changes to files that are inaccessible to the user.
The process is not without its faults, though - since shadow copies are only a snapshot of the way the system was at the moment of the creation of a system restore point, any changes made between two system restore points are not recorded.
The upside is that Windows is set up to create a restore point every day, so when you use it, you should lose no more than a day of progress on a file, tops.
Notably, this functionality is so useful for recovery, that it's the first order of business for any ransomware creator worth his salt nowadays to ensure that shadow volume copies have been wiped before encrypting the attacked device.
How to Recover Files And Folders Using Shadow Volume Copies?
- Open a file explorer of your choice.
- Navigate to the file or folder you wish to restore to a previous version.
- Right click on chosen the file or folder, then scroll all the way down to the bottom of the dropdown menu, and select the "Properties" option.
- When the "Properties" window opens, navigate to the "Previous Versions" page.
- Choose which of the previous versions of this page you would like to restore.
Note: Using shadow volumes to restore a file or folder to a previous version will completely overwrite the current version with the version of the system that was in place at the precise moment when that particular restore point was created. If you have any doubt that the current version is something you could use or need in the future - make sure you save a copy of this current version somewhere else before performing the procedure.
