Understanding Volume Snap-Shot Services ...

Lots of people have asked, so here the short overview on how it works.

VSS, or Volume Snapshot Services, is used in two ways.

1. To provide previous Versions of Files and


2. To ensure backup applications don't have issues with open files

The two work in much the same way. At the specified intervals, a snap-shot is taken. Let's first talk about the snap-shot.

Taking a Snap-shot
A snap-shot occurs at the specified time of creating previous versions (defaulted to 7am and 12-noon), and at the time of backup (which is defaulted to 11pm).

A snap-shot takes usually less than 1 or 2 seconds to create. So how does it copy your entire hard drive in 1 or 2 seconds? It doesn't.

In actuality, it creates a hidden storage area to keep blocks of data. This storage area has a structure, (which takes up 10mb of space total), an area of size 300mb is created (hence why you can minimally create a 310 mb space for previous versions.

No files are moved.

What actually happens is from this point forward, the first time a file is changed, the differences in the files are stored in the hidden location, and the new changes are stored in the actual place on the hard drive. The next time it changes, the old-new changes are lost, as the new changes over write them. Only changes are copied the first time they change after a snap-shot is taken.

That's all there is to it? .... ok, so not all of it.

I bet the first question comes to mind. How come this just doesn't eat up your hard drive, 300 mb at a time?

Well, this is because on each snap-shot, if the space wasn't used, it's truncated, so it only keeps the smallest amount of data required to recover the original hard drive.

So using these snap-shots (or differential areas), at each snap time, the computer can re-construct a virtual hard disk of exactly what the hard disk looked like at that point of time. It does this using all the snap-shots that have occured after the point in time you want to look at the hard drive. This is because if a file has changed through time, the data for that file is contained in all snap-shots and needs to be read to be reconstructed.

So, if you're looking at the snap-shots, by right-clicking on a volume, going to properties and then choosing the Shadow Copies tab. It looks like this:


From here, you can create or delete snap-shots, you might notice if you delete one of the ones in the middle, you don't recover any space, but if you delete the last one, you recover the space. This is due to what I mentioned earlier, how all snap-shots ahead of the earliest one are required to create the virtual hard disk.

Now this process keeps going and going and going, retaining previous versions of files for all your users. It maxes out at the specified limit, or 60 snap-shots, whatever comes first.

Any questions? Feel free to ask in the comments below, and I'll dive into details.