There is always a need for “backups” in case something is lost or deleted. We all come across accidental deletions, random modifications and misplaced files that may disappear mysteriously. In response to this, Microsoft introduced a new technology through Windows XP, called Volume Shadow Copy Service (VSS) or in simple terms Shadow Volume Copies (SVC). This feature is embedded in the operating system of the system and is enabled by default.
What are Shadow Volume Copies (SVC’s)?
The technology enables Windows to create a backup of all the data in the system, either manually or automatically. It basically takes a “snapshot” of the data. This backup material is stored in SCV’s that can be either saved on the local storage device or an external device.
However, the data saved is only the modifications made in that file and not the entire file per se. This is done to ensure that space is efficiently occupied. This data, if deleted or modified, can later be restored individually by Windows. There are two methods that can be used to recover and restore data that SVC’s use: Windows Previous Versions and Shadow Explorer.
# 1 How do I recover files using Windows Previous Versions?
The Previous Versions feature helps in restoring a specific file/folder from the SVC storage. Here are the steps to follow to use this method:
- Open the folder that contains the file/folder that you want to recover
- Right-click that file and select Properties option
- Select Previous Version tab which displays a list of all the previous versions that were saved on the SVC along with the details of date and time
- There are two options provided: The Copy and the Restore
- The Copy option will restore the selected file/folder to the specified location
- The Restore option will rewrite on the existing data on the hard drive in the previous version.
- Click on the Copy button and create a folder to save the restored data; click on Copy again
# 2 how do I use Shadow Explorer to recover files/folders from SVC’s?
The versions that are saved on the SCV’s can be recovered, as it is an easier-to-use interface. A shadow copy displays a list of all the drives and their respective dates that are saved on. Follow these steps to recover the data: using Shadow Explorer. After installation of the software:
- Select the drive and the date from which you want data to be recovered
- Select the destination folder and right-click on the folder
- Select Export followed by the location and click OK to finish the procedure
A word of caution: The ransomware will try to delete the SVC’s when it detects the SVC’s by encrypting the victim-system. It does so, so that the user is disabled from recovering the data. So the user should be careful before responding to the prompts.
However, the SCV’s are temporary in nature. They are saved on the local or external devices but are susceptible to getting lost or deleted. Also, if the application is not enabled, the data cannot be stored under backup. It may not survive reboot of the system. For better performance, the user may have to approach third-party tools like Remo Recover.
The SVC’s are in-built and very helpful. Keeping these in mind, you can use this feature smartly and effectively. Windows 10 is an ideal version that allows this application. This will keep you updated on your files and data.