What's it Going to Take to Restore Previous Versions from Shadow C

[NoelC]

Sorry about the truncated subject. It should read:

What's it Going to Take to Restore Previous Versions from Shadow Copies?

Microsoft removed the Previous Versions feature from File Explorer in Windows 8.

I've been doing some digging, as I would like to continue to be able to access data in Shadow Copies (to restore a file or folder from a shadow copy-integrated System Image backup, for example).

I've uncovered a number of half-baked tools to access shadow copy data, but none of them are currently of a quality that breeds much confidence. They're either buggy or clunky. These include ShadowExplorer, Z-VSSCopy, and Previous Version Recoverer... I'd love to hear about more if you know them.

I've learned that the property page in Windows Explorer in Windows 7 that shows the Previous Versions and allows, Restore, etc. is provided by a shell extension called twext.dll, and it turns out this DLL is present and accounted for in Windows 8 as well, though notably it's a little bit smaller than the one from Windows 7. It's typically found at C:\Windows\System32\twext.dll.

The fact that twext.dll is still wired in makes me wonder whether with an appropriate registry (or some other) tweak it might be possible to just restore the Previous Versions sheet to the Properties panel in File Explorer. It seems the Microsoft people haven't really deleted it outright, but may have just hidden it.

Do any of you with more knowledge of how Explorer is put together have any ideas how to restore the Previous Versions property page? Knowledge online is a bit scarce and I'm just trying to get the creative juices flowing to solve yet another Windows 8 shortcoming.

-Noel

Edited December 5, 2013 by NoelC

[jaclaz]

Interesting.

You seemingly found another nice can full of worms awaiting to be opened.

Summing up the info here:

http://superuser.com/questions/472524/is-there-a-way-to-use-volume-shadow-copy-on-windows-8

and here:

http://blogs.msdn.com/b/b8/archive/2012/07/10/protecting-user-files-with-file-history.aspx

a lot of questions arise.

The contents of the FAQ - if I read them correctly - are appalling , it seems like you can have not a "real" Shadow copy made, but only one for a limited numbers of folders/locations.

The question is, see also this:

http://blog.cwl.cc/2012/03/windows-8-file-history-is-new-new.html

even if it is possible to re-implement *somehow* the "Previous Versions" tab, can we also "widen" the "target", i.e. have the stupid Windows 8 make a shadow copy also of something that is not inside the given limited paths?

jaclaz

P.S.: It seems that quite a bit of tinkering is needed to have Shadow Copy actually working on 8 but at least it is possible (still not connected to the missing tab in File properties):

http://blog.quiscalusmexicanus.org/2013/01/21/some-notes-on-reinstating-shadow-copies-on-windows-8/

Edited December 5, 2013 by jaclaz

[NoelC]

Thanks for your thoughts.

From my observations with the 3rd party tools, I *am* able to see all the files in my shadow-copy integrated backups, initiated via the following command, scheduled nightly:

wbadmin start backup -allCritical -vssFull -quiet -backupTarget:G:\

Given that the information actually is available, it would be quite handy to be able to more easily access it.

I imagine one of the 3rd party shadow copy access tool developers will come through sooner or later - and maybe even monetize their product, given that Windows 8 is sorely lacking the functionality. Right now, ShadowExplorer seems to have the best UI, but files recovered from shadow copies or backup are sometimes riddled with data corruption - not exactly what you want when you're recovering your critical files from backup.

-Noel

[bphlpt]

If the recovered files from the backup can not be counted on as being a true, accurate, recoverable copy, then why bother even making the backup? I mean can you really know for sure where the errors are occurring? Do you know for sure that the errors are occurring during the recovery stage? Could they be occurring during the backup stage? How can you know?

Cheers and Regards

[jaclaz]

In which "form" are the Shadow Copies generated with that command?

I mean is the end result a .vhd or .vhdx image file, right?

There are several tools that can access them, I suspect that the issues with Shadow Explorer are more with some conflict/file in use/permission/UAC/whatever than with actual filesystem/image access.

jaclaz

[NoelC]

I have verified (using virtual machines) that the command I listed can be trusted to make a full and complete system image backup, which can be restored to bare metal to recover from a catastrophic failure.

I did such backups with Windows 7 before, as well. That was more easily set up, right through the UI provided. I have achieved the same level of protection now with Windows 8.1 (I wouldn't have upgraded had I not been able to do that).

Only thing is, with Windows 7's "Previous Versions" feature, I didn't have to think about the data on the backup at all - if I overwrote a file I could just right-click on it, choose Previous versions, and it would be listed right there, with a source of "Backup".

Now, for example with Shadow Explorer, I can see the backup files. All you have to do is to select the drive from which the files were backed-up. Shadow Explorer would be a fine solution to this but for the fact that the thing has a bug in it and it retrieves the files sometimes with corruption. I have been working with the author on getting that fixed. There are other tools - e.g., Z-VSSCopy, that have a clunkier user interface but will retrieve the individual backed-up files just fine, without corruption - so I know the data is there. In a pinch I can use Z-VSSCopy today to recover files from the backup, though it's not as convenient as the full Explorer integration of Previous Versions - hence my posting.

The wbadmin command uses the volume shadow copy subsystem to do the backup, but Is not all that well-documented (per the wbadmin command help):

wbadmin start backup -?

.

.

.

-vssFull Performs a full backup using the Volume Shadow Copy Service

(VSS). Each file's history is updated to reflect that it was

backed up. If this parameter is not used WBADMIN START BACKUP

makes a copy backup, but the history of files being backed up

is not updated.

Caution: Do not use this parameter if you are using a product

other than Windows Server Backup to back up applications that

are on the volumes included in the current backup. Doing so

canpotentially break the incremental, differential, or other

type of backups that the other backup is creating.

-vssCopy Performs a copy backup using VSS. The history of the files

being backed up is not updated. This is the default value.

What it really does is create a full volume shadow copy that is not only complete but incremental, meaning after the first one is done, which copies everything, nightly System Image backups are incremental and complete quickly, often in well less than an hour - depending on how much you have changed on the disk. You have access to multiple different shadow copies, and these backups can as I mentioned be used to do a full system restoral, integrated with the Windows 8.1 recovery tools you can get to by booting a Windows 8.1 DVD. It's actually a great setup that really works, and it's utterly disappointing that Microsoft is turning away from something that's obviously very well thought-out. Idiots.

-Noel

Edited December 6, 2013 by NoelC

[jaclaz]

You don't need to bold anything I am pretty sure that you verified that the command can be trusted alright.

I was asking if the output is a .vhdx file and it seems that - while avoiding to answer my question - you indirectly confirmed that it is a .vhdx and actually a series of incremental/differential .vhdx's.

jaclaz

[NoelC]

Sorry. I wasn't trying to avoid answering specifically... I didn't perceive your question quite right.

Yes, I see one big .vhdx file (over 1 TB) and one small one (63 MB) on the backup drive, but not a whole series of them...

Yet quite clearly there are multiple backups available there... I don't profess to know how/where it's all managed, but Z-VSSCopy can show me the files in any of my recent backups and also allow me to extract them (one at a time, did I mention it was a bit clunky?). I don't think I'm going to be able to get at multiple different versions of the same file simply by mounting a .vhdx file. The access seems more complex...

-Noel

[jaclaz]

No problem I was asking that to see if I could suggest you a replacement/alternative to ShadowExplorer, but if you are already in contact with the Author I presume that the corruption issues will be soon solved.

However in the meantime you can try this thingy here:

http://redrocktx.blogspot.it/p/shadowkit.html

jaclaz

[NoelC]

Ooh, another possible 3rd party tool to solve this. Love it! Thanks!!

-Noel

[NoelC]

Well, thanks for the tip on ShadowKit, jaclaz...

It seems to be a bit clunky too. It doesn't appear to install its own service, which some of the others do - and that's good, but... Whenever I go to export a file, the method of choosing the location is an older, primitive folder selection dialog, and it seems to always create a subfolder (e.g., named "0") to put the files in, requiring some additional operations after the fact.

Ideally, a well-integrated shadow copy access tool would put up a dialog similar to Explorer (which ShadowKit does), then just let you drag files out of it to copy them to another Explorer window (ShadowKit does not allow drag), or at least just export them to exactly where you tell it and use a modern "Save As" dialog.

So the search is still on for a better tool.

-Noel

[jaclaz]

What happens if you simply map the .vhdx with imdisk (making use of discutils and of the imdisk toolkit)?

http://reboot.pro/topic/18324-imdisk-toolkit/

The issue here is that it is not clear if .vhdx format is supported by discutils (it is but not all variations of it are, seemingly).

NOT useful for the current issue, but generically related to Shadow Copies (maybe useful for *something* else. and/or, since source is available possibly of inspiration):

http://vscsc.sourceforge.net/

This, instead, may be of use:

http://dfstream.blogspot.ch/p/vsc-toolset.html

jaclaz

P.S.: This seems like a "full" alternative to ShadowExplorer, see if it fits:

Previous Version File Recoverer

http://sourceforge.net/projects/vistaprevrsrcvr/

http://sourceforge.net/projects/vistaprevrsrcvr/files/

This:

Starting with Vista, Windows allows the recovering of previous versions of files without a dedicated backup. These previous versions are stored in "System Snapshots" as "Shadow Copies" whenever a Restore Point is made by the system or manually made by the user from the System Protection tab of the System App in the Control Panel.

Microsoft limited this feature in Vista to the Business Editions. Home Basic and Premium do not have it, hence the need for this program. It turns out in Windows 8 the feature has been deprecated. The tab is not available except by accessing the computer as if it were over a network. However Previous Version File Recoverer still works, as does an alternative piece of freeware named Shadow Explorer.

may mean that if you use something like a loopback device, or anyway find a way to fake you are accessing the PC "not from itself" the missing TAB may be restored?

Edited December 7, 2013 by jaclaz

[NoelC]

Huh, if one opens a File Explorer window to \\Computername\Share, the Previous Versions tab indeed does return. Files from backups are listed as Location: Restore point.

I wonder what the logic is in hiding the functionality when on the local disk but not when the very same volume is accessed via a UNC name.

In my case it's trivial to access the drives as UNC names as I have shared all the roots anyway.

Anyway, thanks. That DOES answer my original question directly, though now that I've had a taste of the possibilities of shadow copy access functions I think I'll still keep watch for a nicely integrated solution that's not too clunky.

Blue-skying a bit... I wonder if Microsoft is thinking about ultimately coming out with an operating system for serious users that's based on a Server edition.

-Noel

[NoelC]

Not sure whether all the futzing around with looking at the Shadow Copies (above) through the back door had anything to do with it, but last night my backup failed with this error:

The backup operation that started at '‎2013‎-‎12‎-‎08T11:43:23.765618100Z' has failed with following error code '0x8078014B' (There was a failure in creating a directory on the backup storage location.). Please review the event details for a solution, and then rerun the backup operation once the issue is resolved.

A reboot solved it (after 17 straight days of near flawless performance), and my backup ran okay after.

What makes me wonder whether it was fooling with the Previous Versions panel that broke it was that in the System Protection configuration panel two different lines showing the C: partition showed up; one was set to On and one to Off. The "Off" entry had a different icon - a folder, vs. the normal drive icon. I should have taken a screen grab, but I neglected to do so. After the reboot there's only one entry for C: as there should be:

-Noel

[jaclaz]

I wonder what the logic is in hiding the functionality when on the local disk but not when the very same volume is accessed via a UNC name.

That is assuming that any decision made in the development of Windows 8 was backed by some logic.

I would first like to ask the question :

"Was any form of logic involved in what clearly results as very similar to the work of a bunch of headless chickens running in circle?"

I mean, I can understand if - for any reason (that may or may not be judged logical or intelligent) you decide to completely remove a tool, service or utility, but simply hiding it?

If you remove it, do remove it.

If you want to keep it, keep it.

Be a man, keep up to your decisions.

If you instead decide to keep it but hide it to the "normal" user, OK, then document a way through Group Policy, Registry editing, Control Panel (or whatever) the "power" user can re-enable it.

Anyway, thanks. That DOES answer my original question directly, though now that I've had a taste of the possibilities of shadow copy access functions I think I'll still keep watch for a nicely integrated solution that's not too clunky.

Good .

jaclaz