Shadow Copy Windows 10 All You Need to Know
Content of this article:
- What is Volume Shadow Copy in Windows 10
- How to restore lost files using shadow copy in Windows 10
- How to delete shadow copies in Windows 10
- Can volume shadow copy replace backups
- Free Windows 10 backup software to protect computer
What is Volume Shadow Copy in Windows 10
Volume Shadow Copy is a feature available in Windows 10/8/7 that creates snapshots (shadow copies) of disk volumes, even when they are in use. It is implemented as a Windows service called the Volume Shadow Copy service. By using it, you can create or store shadow copies on a local disk, external hard drive, or network drive.
Shadow Copy requires NTFS file system to create and save shadow copies. So only NTFS volumes can be protected when you enable Shadow Copy technology in Windows Backup and Restore. The same is true for System Restore and File History.
You probably have more shadow copies than you know. Every time a system restore point is created, you will have a valid shadow copy. When your Windows 10 system does not work as it should, you can use system restore point to restore Windows 10 to previous version.
As mentioned, Shadow Copy maintains snapshots of the entire volumes, so you can also use shadow copies to recover deleted files besides restoring system. By default, System Protection is turned on for system drive (C: drive). You can manually enable volume shadow copy to protect other volumes besides C: drive.
How to restore lost files using Windows 10 shadow copy
If you have shadow copies available on the drive where you lost files, then you can easily use the Previous Versions to restore deleted files. If you don't create any shadow copy, you can choose to enable volume shadow copy in Windows 10 first.
For example, to restore some files that were saved on Desktop, you can try the following steps:
1. Locate the Desktop folder in File Explorer.
2. Right-click on the Desktop folder and select Properties.
3. Navigate to Previous Versions tab, and then select the right version you want to restore and select Restore.
Notes:
Restoring Files with Previous Versions in Windows 10
Recovering Deleted Files with Shadow Explorer
How to delete shadow copies in Windows 10
By default, Windows 10 allows you to take 5% of the volume space to store shadow copies and it will be deleted if the Volume Shadow Copy in Windows 10 has a high disk usage. Also, you can choose to manually delete it, either delete all shadow copies or delete all but the latest one. Please follow the steps below.
To delete all shadow copies:
1. Right click on This PC, then select Properties and System Protection. Or you can directly go to Control Panel > System and Security > System, then tap on System Protection in the System Properties window.
2. Click Configure.
3. In a new pop-up window, click Delete to delete all shadow copies.
It is recommended to delete all but the most recent shadow copies. To only save the most recent shadow copy, you can use the built-in utility Disk Cleanup.
Besides, you still can delete shadow copy in Windows 10 using cmd, vssadmin delete shadows, for example. For detailed steps, please refer to: delete shadow copies in Windows 10 (4 solutions are included).
Shadow Copy Windows 10 not working
As mentioned earlier, shadow copy is used for creating snapshots in Windows 10, but sometimes it may not work.
1. Shadow copies may not be created regularly by the default settings.
2. Shadow copies may not correctly keep all the changes.
3. Troubleshooting Shadow Copy Issues in Windows 10
4. Your valuable shadow copies may be deleted due to the Volume Shadow Copy Windows 10 high disk usage issue.
5. Backup failed if you turn off Volume Shadow Copy Service.
6. It does not support schedule shadow copy in Windows 10 like previous version of Windows, Windows 7, for example.
Well then, is there any available way to protect your computer and data on it? The answer is Yes, you can choose to create a backup with free backup software Qiling Disk Master Standard, instead of a snapshot, which does not completely rely on the Volume Shadow Copy Service. And it's an all-in-one backup software for Windows 10/8/7 that can continuously protect your computer in all aspects.
Simple and effective way to protect your computer
Here you will use free backup software - Qiling Disk Master Standard to safeguard your computer completely, below are the benefits of it.
- Support 4 backup solutions, Comprehensive Backup Options with Qiling Disk Master Standard
- Support multiple scheduled backup settings. Comprehensive Backup Options with Qiling Disk Master Standard
- Provides two backup services, namely, Microsoft VSS and Qiling Backup Service. Robust Backup Solution with Qiling Disk Master Standard
- Supports various backup destinations, such as internal disk, external hard drive, network drive, cloud drive, NAS, etc.
- Support Windows 10/8/7/XP/Vista.
In addition, you can enjoy more useful features in the advanced version of Qiling Disk Master Standard, such as,Qiling Disk Master Professional. It provides you an worry-free backup method to schedule backup only changes, it's the differential backup. Also, you can delete old backups with Backup Scheme to avoid high disk usage issue.
Then, download free backup software Qiling Disk Master Standard and create an auto backup task with it.
1. In the main interface of Qiling Disk Master Standard, click the Backup tab and select System Backup. If you want to backup the entire hard drive, just select Disk Backup.
2. In the System Backup screen, you can see system-related partitions have been included automatically. Just click the folder shapped button and choose a location folder or drive to store the backup image. It is recommended to backup Windows 10 to an external hard drive.
3. Then click Schedule and OK to enable the default backup settings, it's daily incremental backup. Also, you can combine other backup interval and differential backup per your needs. After that, click Proceed to start the process.
Please be sure all the backups are intact if you use the default backup settings, otherwise the restore process will fail. To avoid this issue, you can choose to use differential backup(supported by professional version).
Other features you can use:
- Event triggers (advanced version): Advanced Backup Capabilities with Qiling Disk Master Standard
- USB Plug in (advanced version): Automatic File Transfer with Qiling Disk Master Standard
Compared with Windows Backup and Restore, Qiling Disk Master is super fast. It took me 4 minutes to backup 70GB of data on a SATA SSD. If you use NVME SSD, it will be even faster.
When the backup completes, you can create a bootable media in case serious issues. It gives you a chance to boot your PC from the Qiling bootable media and restore system image to new hard drive when your system fails to boot.
Further reading: Windows elevation of privilege vulnerability
On Jul 20, 2021, Microsoft released a privilege vulnerability issue, it's said that the reason is overly permissive Access Control Lists (ACLs) on multiple system files, including the Security Accounts Manager (SAM) database.
And any attacker who successfully exploited this vulnerability could run arbitrary code with SYSTEM privileges, then install programs, view, change, or delete data or create new accounts with full user rights. And this requires the attacker has the ability to execute code on a victim system.
And Microsoft promises to update the CVE as the investigation progresses. They added the affected versions of Windows in the Security Updates tab and provides 2 available methods to fix this issue. Below are the outline of them:
Step 1. Check if your computer is affected. Open cmd as administrator, Type icacls c:\windows\system32\config\sam and hit Enter. If you get a response like BUILTIN\Users:(I)(RX), it means unprivileged users can read the SAM file and your system may be attacked.
Step 2. Then, if your computer is affected, check if there are any shadow copies on your computer. Type vssadmin list shadows and hit Enter.
Step 3. Block unprivileged users from accessing to sensitive registry files. You can use cmd or powershell.
- For command prompt, type icacls %windir%\system32\config\*.* /inheritance:e command and hit Enter
- For powersell, open it with priority, type icacls $env:windir\system32\config\*.* /inheritance:e command and hit Enter.
Step 4. If your computer has shadow copies, type vssadmin delete shadows /for=C: /quiet command and hit Enter.
Modifying Inheritance Settings for System Files Across Multiple Partitions
Step 5. Verifying VSS Shadow Copies
Step 6. Restart your computer and create a system restor point in the System Properties window.
After these changes are made, the newly created shadow copies should have some read-write permissions, so the unprivileged users cannot access essential system files on yours computer. Also, you can check if your computer is affected again using icacls command.
Related Articles
- Alternative to Shadow Copy Cloner Windows 7/8/10
You will learn how to backup system with Shadow Copy Cloner and a safer way in Windows 11/10/8/7. - Solved: Windows Backup Failed to Read from the Shadow Copy
Learn how to fix the error: Windows backup failed while trying to read from the Shadow Copy on one of the volumes being backed up when you backup using Windows tool. - 5 Methods to Fix System Image Backup Failed in Windows 10/8/7
Many reasons can cause system image backup failed in Windows 11, 10, 8, 7. This article includes 4 solutions to fix 3 different situations and a free backup tool to create system image easily. - How to Delete Backup Files in Windows 10 When Backup Disk Full
Windows 10 backup disk may get full after saving multiple versions of backups. Learn to manually or automatically delete all kinds of backup files.