Recover Files with the Shadow Copy Feature

As humans, we make mistakes. No matter how perfect we think we may be, there will be times when we realize that what we just did was not what we intended to do. However, the realization usually doesn’t sink in until a little later and then once it dons on you that you’ve either just deleted or over-saved the most important research paper you have ever written in your life, panic usually will then follow. Sweat starts to drip down your forehead, you begin convulsing and of course, swearing and curses will ensue. I’m sure this sounds very familiar to some of you because like I said earlier, users of all types, no matter how careful some may think they are, make mistakes. But it’s OK to make mistakes. Why? Because if you have some type of disaster recovery plan in place, you’ll be able to at least recover a partial replica of that deleted file and get right back to work. With the shadow copies feature, we can do just that. Learn how to use it before another crisis happens.

If you’re familiar with the System Restore function, then you should feel right at home with Previous Versions because they both utilize the same technology to create copies of files on your system. That technology is called Shadow Copies. To be more specific, it is part of the Volume Shadow Copy Services (VSS) service within a Windows operating system environment. At its core, VSS allows the computer to create snapshots of your computer and data at certain intervals. When you accidentally delete or over-save a file, you can browse the shadow copy for that folder and restore the file back to the last version of when that backup was created. VSS is an awesome technology because of how it works behind the curtains. Rather than backing up files as is, instead it creates a snapshot (copy) of your system and it would then work with this read-only “copy” in the background. This allows you and other applications to continue working with your data without fear of lock-ups. In fact, Microsoft allows third-party software to utilize and take advantage of the VSS service for creating backups within their own applications as well.

If you’ve ever used System Restore, than you might have already realized that you could pick between different versions of restore points to restore to. If you installed an application that corrupted your registry today, you’ll definitely want to pick a restore point created yesterday or whatever is the latest one prior to that application being installed. However, with System Restore, it only helps you if you needed to restore the registry or other important system files. It doesn’t allow you to specifically restore that deleted research paper located in your Documents folder. This is where Previous Versions come into play. Previous Versions is very similar to System Restore but it is more granular in that you get to specifically choose what you want to restore. If set up correctly, Previous Versions can play a major role in your disaster recovery plan (you do have one right?).

Enabling Previous Versions

By default, your computer should already have the System Restore and Previous Versions feature enabled. However, it doesn’t hurt to check so that’s what we’ll do right now.

1. Right-click on Computer within your Start Menu and select Properties.


2. Select the System Protection link from the left panel.

System Protection

3. Select the drive you want to configure shadow copies for under the Available Drives section and hit the Configure button. For most users, this would be the C: drive. Under the Restore Settings heading, you should see three options. The first allows the system to both create System Restore points as well as previous versions of files. This option should have been selected and enabled by default. The second option allows you to disable System Restore but enable previous versions only (oddly, you can’t just enable System Restore itself). The last one allows you to completely disable both features, which is not recommended unless you have a very good reason for doing so. Be sure that you the first option is enabled.

Underneath that section you are able to configure how much disk space shadow copies are allowed to be stored on your drive. The more disk space you allow, the longer the retention period for each restore point created. As disk space runs out, older copies are overwritten.
If you want to start from scratch and clear all currently stored copies of restore points and previous versions of file from your system, simply hit the Delete button. In most circumstances, you shouldn’t have to do this.

Restore Settings

Creating Automatic Restore Points at Log On (Optional)

As mentioned earlier, the Previous Versions feature is closely tied to System Restore. In order for you to restore a deleted file using Previous Versions, there has to be a restore point created *before* the file was deleted from your system. Technically, Windows 7 is suppose to automatically create restore points whenever you install a new application, Windows Updates and pretty much everyday after every startup. However, I found this to be untrue. I use my laptop everyday and I certainly don’t have restore points created everyday. This can be an issue because remember, in order to recover a deleted or overwritten file, there must be a copy of it created by VSS beforehand. The more copies that are created, the more chances there are for you to restore a file back to its original version (or closest to it whenever it was deleted or overwritten). Since System Restore wasn’t working the way I thought it would, I decided to take matters into my own hands. Rather than relying on Windows, I’m going to manually use a script, which automatically creates a restore point every time it is run, and create a new scheduled task with it.

1. I’ve already talked about how to create a manual script to automatically create restore points in this article. In this example, I will be using the version of the script that will create a silent restore point. This silent version doesn’t ask for any user input. It just creates a standard restore point with the same label every time it is run. The only way to differentiate between the restore points created by this script is by looking at the date and time it was created.

2. Once you have the script, I will now create a new scheduled task for it to have it actually run every time I log on to the computer. Open Task Scheduler by searching for the term within your Start Menu and hit Enter.

Task Scheduler

3. Click on the Action menu and select the Create a Basic Task option. Give a name for the task such as “Automatic Restore Point Creation” and then hit Next.


4. In the Trigger section, select the When I Log On option and hit Next.


5. In the Action section, select the Start a Program option and hit Next.


6. In the Start a Program section, click on Browse and select the script. Hit Next and then the Finish button.

Start Program

7. Once the task has been created, your last step is to open the task’s properties menu (simply double click on it) and enable the Run with Highest Privileges option. This allows the task to run without having to nag you with the UAC prompt every time. This option can be found in the General tab within the task properties.


Once this task has been created, every time you start up the computer and log in, a new Restore Point will be created. Here you can see a couple of restore points that has been created due to me restarting the computer and logging on:

Restore Points

Using Previous Versions

All versions of Windows 7 allows you to recover files using the Previous Versions feature. On Windows Vista, only the Business edition and above supports this recovery procedure natively. So, if you are using Vista Home Premium or below, you will not see the Previous Versions tab, which is where you recover files from. However, the good news is that while you don’t see the tab, the VSS service is still active and actively making shadow copies in the background! Microsoft decided to remove the GUI portion (the Previous Versions tab) so that users can’t get to it. To recover shadow copied files, you will need a third party utility like Shadow Explorer. This utility presents you with a GUI front end to access the shadow copies made on your hard drive. Yes, this is another reason why you should ditch Vista and join Windows 7.

Alright, so with all that out of the way, I can finally show you how to use the Previous Versions feature within Windows. Luckily, it isn’t hard at all as just about anyone can learn it. Believe it or not, all it takes is a couple of mouse clicks. The only requirement is that you need to know ahead of time where the file or folder that you need to recover resides at.

1. Locate the folder for the files you are currently trying to recover from. Simply right-click on the folder and select Properties. Select the Previous Versions tab. If you don’t see the tab, read the above blockquote. You should now see every shadow copy that was made. If you don’t see any shadow copies, then you’re out of luck. You’ll need to recover your files either from one of your other backups or if not, then using third party file recovery software.

Previous Version

2. The more shadow copy versions you see here (organized by date), the more choices you have in recovering the right version of your file. Select the version you want to look at and press the Open button. A new window will open and it should show you all of the files within that folder during the creation of that restore point. As you can see below, I am missing two documents in my current folder (top) when compared to the Previous Versions folder (bottom).


3. To restore a file from the shadow copy folder, simply drag the files over/out. Believe it or not, that’s all there is to it! You have now successfully recovered that deleted file or that research paper you have accidentally saved over.

Notes to Consider

  • It is up to you when you want to create a restore point. The only recommendation is that you personally know when one will take place and not rely on Windows itself to create one for you. By following the procedure I’ve listed above, you can be sure that a restore point will be created every time you log in to the system. This increases your odds of recovering a file you have just deleted or accidentally altered. The disadvantage of creating so many restore points is that as the restore points reach its allotted space limit on your disk, it starts overwriting the older one’s. If you deleted a file a week ago and only now realized that you need it back, it may be too late. All those new restore points (due to you logging on numerous times throughout the week) have erased the older restore points where the file you needed to recover resides at. Therefore, you need to strike a balance for creating restore points that work for you. You can actually use the Task Scheduler to create your own schedule of when it should run the script. For example, you can have it run every other day at a specific time. Point is, create a schedule based on your computing habits and behavior. Everyone is different.
  • Do not rely on restore points and shadow copies as your only method of data backup! Shadow copies should be incorporated into your backup scheme but it shouldn’t be relied upon as the only method. Remember, if your hard drive crashes or somehow your computer gets stolen, shadow copies will do you no good at all!
  • Previous versions of files also allow you to recover an entire folder as well. Once again though, your only requirement is knowing where that folder was located at prior to deletion. Once you know that, you’ll have to go a folder up in the hierarchy to recover that folder. For example, if deleted a folder located at C:UsersSimonDownloadsResearch Papers, to recover it back, I’ll have to right-click on the Downloads folder (since the Research Papers folder has already been deleted) instead to access the Previous Versions tab and then recover the Research Papers folder within a shadow copy.
  • If you have a dual-boot configuration of Windows 7/Vista with an earlier operating system (such as Windows XP), you could lose all of your restore points every time you boot into the earlier operating system. This is because the earlier operating system doesn’t know how to handle the newer format type of shadow copies in the newer operating systems. If this is applies to you, then read this article first for an explanation on why this is happening. Finally, go over this Microsoft KB article very closely to apply a fix.
  • Although the Previous Versions feature can be used as a file version comparison tool, it’s not as efficient as using Dropbox. Dropbox is mostly known as an excellent file and data syncing service but it also incorporates a simple yet highly efficient file provisioning tool. When you modify a file, Dropbox will keep a copy of the old version, which you can access within Dropbox’s web interface.
  • Recovering a deleted file or folder is much easier with the Previous Version feature when compared to using third party utilities to manually scan your hard drive. With the former, you can rest assure that the file recovered within the shadow copy is the exact version as it was during the time of the restore point creation. By using third party utilities to scan your hard drive in hopes of recovering the deleted files, there is a possibility that the file being recovered will be corrupted and therefore, unusable.
VN:F [1.9.22_1171]
Rating: 0.0/5 (0 votes cast)

Speak Your Mind


(humans only, please) *