Windows 2003 ermöglich es dem Administrator durch Schattenkopier dateien zu sichern die sich dennoch im Zugriff befinden.
Microsoft bietet im VSS SDK einige Tools an um Schattenkopien per cmd zu erstellen und zu verwalten. Nach der Installation des VSS SDKs gibt es ein %programfiles%\Microsoft\VSSSDK72\Tools\VSSReports die notwendigen Tools.
Erstellen einer Schattenkopie
%programfiles%\Microsoft\VSSSDK72\Tools\VSSReports>vshadow -p c:
VSHADOW.EXE 2.2 - Volume Shadow Copy sample client
Copyright (C) 2005 Microsoft Corporation. All rights reserved.
(Option: Persistent shadow copy)
(Option: Create shadow copy set)
- Setting the VSS context to: 0x00000009
(Gathering writer metadata...)
(Waiting for the asynchronous operation to finish...)
Initialize writer metadata ...
Discover directly excluded components ...
Discover components that reside outside the shadow set ...
Discover all excluded components ...
Discover excluded writers ...
Discover explicitly included components ...
Verifying explicitly specified writers/components ...
Select explicitly included components ...
* Writer 'System Writer':
- Add component \System Files
* Writer 'MSDEWriter':
- Add component \server123\MS_ADMT\ADMT
- Add component \server123\MS_ADMT\master
- Add component \server123\MS_ADMT\model
- Add component \server123\MS_ADMT\msdb
* Writer 'WMI Writer':
- Add component \WMI
* Writer 'Registry Writer':
- Add component \Registry
* Writer 'Event Log Writer':
- Add component \Event Logs
* Writer 'IIS Metabase Writer':
- Add component \IISMETABASE
* Writer 'COM+ REGDB Writer':
- Add component \COM+ REGDB
Creating shadow set {51248111-4e3c-45fa-bb47-a97a37e2f27a} ...
- Adding volume \\?\Volume{bf857546-1817-11dc-b831-806e6f6e6963}\ [C:\] to the s
hadow set...
Preparing for backup ...
(Waiting for the asynchronous operation to finish...)
(Waiting for the asynchronous operation to finish...)
Creating the shadow (DoSnapshotSet) ...
(Waiting for the asynchronous operation to finish...)
(Waiting for the asynchronous operation to finish...)
Shadow copy set succesfully created.
List of created shadow copies:
Querying all shadow copies with the SnapshotSetID {51248111-4e3c-45fa-bb47-a97a3
7e2f27a} ...
* SNAPSHOT ID = {ac41b3b6-a61a-47a8-bb7f-161a05900c3b} ...
- Shadow copy Set: {51248111-4e3c-45fa-bb47-a97a37e2f27a}
- Original count of shadow copies = 1
- Original Volume name: \\?\Volume{bf857546-1817-11dc-b831-806e6f6e6963}\ [C:
\]
- Creation Time: 25.06.2009 08:40:41
- Shadow copy device name: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1
- Originating machine: server123.domain.local
- Service machine: server123.domain.local
- Not Exposed
- Provider id: {b5946137-7b9f-4925-af80-51abd60b20d5}
- Attributes: No_Auto_Release Persistent Differential
- Mark all writers as succesfully backed up...
Completing the backup (BackupComplete) ...
(Waiting for the asynchronous operation to finish...)
(Waiting for the asynchronous operation to finish...)
Snapshot creation done.
Mit diesem Befehl wird eine Schattenkopie der Laufwerk c: erstellt. Der Parameter -p sorgt dafür, dass die Kopie persistent ist. Das Bedeutet, dass die Kopie nach dem beenden von vshadow nicht gelöscht wird. Dies müssen wenn notwendig manuell geschehen.
Anzeigen der Schattenkopie
%programfiles%\\Microsoft\VSSSDK72\Tools\VSSReports>vshadow -q
VSHADOW.EXE 2.2 - Volume Shadow Copy sample client
Copyright (C) 2005 Microsoft Corporation. All rights reserved.
(Option: Query all shadow copies)
- Setting the VSS context to: 0xffffffff
Querying all shadow copies in the system ...
* SNAPSHOT ID = {ac41b3b6-a61a-47a8-bb7f-161a05900c3b} ...
- Shadow copy Set: {51248111-4e3c-45fa-bb47-a97a37e2f27a}
- Original count of shadow copies = 1
- Original Volume name: \\?\Volume{bf857546-1817-11dc-b831-806e6f6e6963}\ [C:
\]
- Creation Time: 25.06.2009 08:40:41
- Shadow copy device name: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1
- Originating machine: server123.domain.tld
- Service machine: server123.domain.tld
- Not Exposed
- Provider id: {b5946137-7b9f-4925-af80-51abd60b20d5}
- Attributes: No_Auto_Release Persistent Differential
In der Übersicht der shadow copies ist eindeutig zu erkennen, dass diese Kopie Persistent angelegt wurde.
shadowcopy mounten
vshadow bietet weiter die Möglichkeit, einzelne Shadow Kopien direkt zu mounten….
md c:\vsmount
C:\>vshadow -el={ac41b3b6-a61a-47a8-bb7f-161a05900c3b},c:\vsmount
VSHADOW.EXE 2.2 - Volume Shadow Copy sample client
Copyright (C) 2005 Microsoft Corporation. All rights reserved.
(Option: Expose a shadow copy)
- Setting the VSS context to: 0xffffffff
- Exposing shadow copy {ac41b3b6-a61a-47a8-bb7f-161a05900c3b} under the path 'c:
\vsmount'
- Checking if 'c:\vsmount\' is a valid empty directory ...
- Shadow copy exposed as 'c:\vsmount\'
shadowcopy dismounten
… jedoch kann vshadow gemountete Kopie nicht wieder dismounten. Hier muss der Umweg über mountvol zur Datenträgerverwaltung gegangen werden.
mountvol c:\vsmount /P
shadowcopy löschen
Wie bei der Erstellung der shadow copy erwähnt, muss die angelegte Kopie manuell gelöscht werden…
vshadow -ds={ac41b3b6-a61a-47a8-bb7f-161a05900c3b}
VSHADOW.EXE 2.2 - Volume Shadow Copy sample client
Copyright (C) 2005 Microsoft Corporation. All rights reserved.
(Option: Delete a shadow copy)
- Setting the VSS context to: 0xffffffff
- Deleting shadow copy {ac41b3b6-a61a-47a8-bb7f-161a05900c3b} ...
