Volume Shadow Toolkit (VsToolkit)

The Volume Shadow Copy Service is a service introduced in Windows NT and developed in every following Microsoft Operating System up to Windows 7 and beyond. It is based on snapshot capabilities provided by the NTFS file system, which allows copying files while they are in use (even locked by an application writing them). In short, if a file is being modified, a consistent copy of the old version (actually a copy of the blocks of that file which are being modified) is kept and new data are written to an alternate location, therefore preserving the former state of the volume as long as the snapshot exists. Support for this feature varies a lot depending on which Windows is in use: e.g. Windows 2003 supports persistent snapshots while Windows XP only supports temporary snapshots.

VsToolkit will give you the advantage of shadow copies for backing up your data using Personal Backup (or any other suitable backup software). It is a modified version of VSHADOW.EXE bundled with the Microsoft SDK 7 based on the C++ program VSCSC.EXE (Volume Shadow Copy Simple Client). The program is featuring a -exec option to start any program or batch script with the temporary virtual drive generated by the VSS system as command line parameter:

• The current version 2.3 (2017-12-28) supports Windows 7,8 and 10 for both x86 and amd64.
• Using the -exec option only one temporary snapshot (also known as shadow copy) of only one volume can be created. This is different from the original VSHADOW.EXE, which can create shadow copies of multiple volumes and many other things, such as permanent snapshots. Also some other options have been removed.
• It can execute a program or script of your choice, using the option -exec. The name of the temporary virtual device created for the snapshot is passed to the script as a command line parameter, which means it will be saved into the %1 variable.

Important notes

• VsToolkit must be started as administrator. It is not sufficient to be logged on with an account having administrative rights. Even in this case the program must be started using the option Run as administrator. This is being caused by the protection of the Windows user access control.
• The drive specified in the command line is formatted in NTSF.
• The operating system is Windows 7 or newer.
• The version of VsToolkit must match to the system (i.e. the 32 bit version on a 32 bit system or the 64 bit version on a 64 bit system)

Using VsToolkit together with a batch script

This is the primary usage of the program
VsToolkit -exec=script.bat C:
If everything works as expected, this is what should happen:

1. A new snapshot is created for volume C: which corresponds to a volume such as
   "\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1"
2. The script named script.bat is invoked with this volume name as parameter. At this point script.bat can access the snapshot which is immutable and can be read with no problem at all.
3. When script.bat terminates, the snapshot gets deleted and so is the volume with the above name.
4. The script itself can start any backup program, e.g. Personal Backup.

Using VsToolkit manually

VsToolkit retains many options of VSHADOW.EXE:

• -q: list (query) snapshots
  VsToolkit -q
• -qx={SnapSetID}: List all shadow copies in this set
  VsToolkit -qx=
• -qs={SnapID}: List the shadow copy with the given ID
  VsToolkit -qs=
• -ws: List writer status
  VsToolkit -ws
• -wm: List writer summary metadata
  VsToolkit -wm
• -wm2: List writer detailed metadata
  VsToolkit -wm2
• -da: delete all snapshots
  VsToolkit -da
• -dx={SnapSetID}: Deletes all shadow copies in this set
  VsToolkit -dx=
• -ds={SnapID}: Deletes this shadow copy
  VsToolkit -ds=
• -wait: pause VsToolkit just after snapshot creation
  VsToolkit -wait C:
  The snapshot will remain valid until RETURN is pressed!

• -log={filename}: Write to log file instead of screen
  VsToolkit -log=status.log -ws

Links

• Volume Shadow Copy Simple Client
• Personal Backup