The How-To Geek Forums Have Migrated to Discourse

How-To Geek Forums / Geek Stuff

Recovery of files from shadowstorage

(3 posts)
  • Started 9 years ago by whs
  • Latest reply from whs
  • Topic Viewed 1777 times

Posts: 17584

These 2 posts I had made trying to help a poster who had lost all her files due to a disk cleanup. Since this post will probably disappear from the radar screen pretty soon, I am putting the info here because I would like to have some discussion on the subject. If it were really possible to recover lost data from the shadows the way I have done in my little test, then that would be a great help to many who are faced with a data loss. So, keep discussing.

1. Post
First down load this program:
With this you can access your last shadows in the shadowstorage. Double click on the last shadow (you have to roll down) - make sure you get the right partition (most likely C:) Then you double cick in the following sequence. C: > Windows > Users > Then the folder with your name > there you find all your folders > right click on the folder you want to recover and EXPORT it to wherever you like on your system.
NOTE: 1. When you download Shadowexplorer you wil get a funny message concerning elevated priviledges. Just skip over it.
2. You have to open shadowexplorer as administrator.

Please let me know whether this worked because you are the "first customer" for trying that out in a completely wiped out situation. We owe this to jd2066 who found the program.
Note also that it might not work because of the way shadows are being stored.

2. Post
In the context of this thread I would like to make an editorial:
The other day, jd and myself were wondering how it is possible to shadow the whole C: disk in 1GB (which seems to be the appr. size of a shadow). The suggestion was, that it only records the updates that have happened since the last shadow and it reconstructs the restore files by backing the updates out of the files that are currently on C:. This, of course, would not allow to recover your files from the shadows once your C: is wiped out. After a few experiments I am not certain any more whether this theory is true. Reasons.
1.If you look into the shadows with the shadowexplorer mentioned above, your shadowfolders are complete and contain all the files. Now one could say that shadowexplorer also uses the current C: to show you what it shows. So I made the following experiment.
2. I picked a folder (let's call it A) containing files that have been in there for a long time already and added 2 files. Then I took a shadow (Restore Point in Backup and Restore Center - left pane). Then I moved A to an external disk and disconnected the external disk. Now it was no more in C:(at least no more in DOCUMENTS where it was normally sitting). Then I looked at my folder A in the shadow I just made - and guess what, it was there not only with the 2 updates I had made but complete with all the old files that had been there since ages. And I was able to Import this folder into my system where it now is as before.
Conclusion I make: At least for USER files it seems to be backing up whole folders in the shadows. That's why I posted the above hoping KG 703 could recover her files that way. What is still a mystery to me is how it fits all this into 1GB because the system files seem to be all present too - at least they seem to be.
Your comments and suggestion would be very welcome

Posted 9 years ago
Posts: 3814

You may want to read the Microsoft TechNet article "How Volume Shadow Copy Service Works".
Though I read it and I'm still a little confused on how it works.

Posted 9 years ago
Posts: 17584

The TechNet article is interesting but most of it talks about the mechanics on how shadows are being created. The most interesting sentence was this:
"There are two methods for creating shadow copies: making either a complete copy (a full copy or clone) or copying only the changes to the volume (a differential copy or copy-on-write)."
Unfortunately there was no mention of Vista and how it's being done here. More research on the web has not yet turned up a clear answer either. But I will keep looking.

Posted 9 years ago

Topic Closed

This topic has been closed to new replies.