Windows Vista "Time Warp": Understanding Vista's Backup and Restore Technologies

The Discussion

• 

  All I want to know is how to turn VSS off.

  The absolute last thing I want is old copies of sensitive files hanging around on my hard disk without my knowledge.
  
  I back up my own files just fine, and only want Vista to keep it's hands to itself.

• 

  troposphere wrote:

  

  All I want to know is how to turn VSS off.

  The absolute last thing I want is old copies of sensitive files hanging around on my hard disk without my knowledge.
  
  I back up my own files just fine, and only want Vista to keep it's hands to itself.

  
  
  You have full control to turn off Previous Versions. Did you watch the video? The answer lies therein...
  C

• 

  Ok, I admit I am a little confused. Does this take snapshots are predefined intervals or does it version a file everytime it is saved? So, if I save my document at 10:00 AM... then make a change and save it at 10:10 AM do I get both versions? Or, is that considered one change because it was saved between snapshot intervals?
  
  Also, any chance NTFS will support the recycle bin? It seems at this time (XP) it is a shell feature cause I only get files in the recycle bin if I delete using explorer? But, if I use command line or some other app those files aren't put in the recycle. I would love to see the recycle bin be a file system feature.
  
  THanks,
  BOb
  
  
  

• 

  >>> All I want to know is how to turn VSS off. The absolute last thing I want is old copies of sensitive files hanging around on my hard disk without my knowledge. I back up my own files just fine, and only want Vista to keep it's hands to itself.
  
  Thanks for your feedback. We got similar requests from various users to have a way to mark certain files as "sensitive" and therefore remove them from Recycle Bin or Previous Versions (especially from shadow copies).
  
  Vista (and Windows in general) doesn't have today a way to mark certain files as "sensitive".
  
  What you can do to prevent sensitive files on a shadow copy/previous versions - one of the following solutions:
  1) Encrypt sensitive files using a special key that yo then obliterate. This is one of the safest methods as it makes sure that these files will be "un-decryptable" moving forward.
  2) Turn off System Restore, as Charles mentioned
  

• 

  >>> Ok, I admit I am a little confused. Does this take snapshots are predefined intervals or does it version a file everytime it is saved? So, if I save my document at 10:00 AM... then make a change and save it at 10:10 AM do I get both versions? Or, is that considered one change because it was saved between snapshot intervals?
  
  The shadow copies are taken at a predefined interval (daily, at 4:00 AM in the morning). Or if the system is sleeping at that time, then they are taken a few dozen minutes after idle time (but before the system goes to sleep again).
   
  
  
  >>> Also, any chance NTFS will support the recycle bin? It seems at this time (XP) it is a shell feature cause I only get files in the recycle bin if I delete using explorer? But, if I use command line or some other app those files aren't put in the recycle. I would love to see the recycle bin be a file system feature.
  
  Correct - Recycle Bin is primarily a Shell feature. However, you can use the Previous Versions feature to retrieve older copies of deleted files, no matter what application deleted them.
  
  Thanks, Adi

• 

  If I can open a previous version directly, what happens if I try to make changes and save them to that previous version (not the current version.)
  
  Apologies if you answer this in the video, I haven't finished it yet.
  

• 

  From all the negative articles I've read on the internet not one mentioned VSS, so... Congratulations!
  
  About System Restore: In previous versions it would only restore the system and application files but wouldn't touch any documents. Is this still the case? I found it pretty handy that documents weren't touched.
  
  

• 

  >>> If I can open a previous version directly, what happens if I try to make changes and save them to that previous version (not the current version.)
  
  You will not be able to do that - the Previous Versions will appear in explorer as read-only shares, with a special name, like this:  
  
  \\localhost\C$\Users\ (‎Today, ‎February ‎27, ‎2007, ‏‎7 hours ago)

• 

  >>> About System Restore: In previous versions it would only restore the system and application files but wouldn't touch any documents. Is this still the case? I found it pretty handy that documents weren't touched.
  
  That's correct - the user data will not be replaced, only system-related binaries and stuff.

• 

  I have Home Premium on one system, which doesn't support the Previous Versions feature. The daily restore points on my system are more than 1GB, even when I'm not doing much more than web browsing during the day. What is being stored in there that takes so much space? Are previous versions still being stored there but the UI is hidden because I need Ultimate?
  

• 

  I wish there was a way to explicitly select paths for the Backup tools to backup.  It's hard to find a balance between the files I want backed up and space usage by just picking generic file types.  I ended up just creating a scheduled task that runs "robocopy /mir" once a week, which works fine.

• 

  It's a real usefull feature and it worked great. But how can i delete all versions of a file? Lets say i saved a sesitive file to the Public folder accidentally and the next day i want to delete it forever. Is this possible?
  

• 

  I'm not completely sure but I think there is a company that has created software that cleans out previous versions.

• 

  timewarp? my god.. sometimes i wonder what  microsofts marketing dept. are thinking.. im sure its a great tech, but with a name like that everyone will just scream apple (time capsue) knockoff..  something that im sure is not even true.
  
  i wish ms marketing why try and do justice the really smart and useful things that the devs come up with, and that they dont try to play of the names of lesser software complnies..

   

• 

  aL_ wrote:

  

  timewarp? my god.. sometimes i wonder what  microsofts marketing dept. are thinking.. im sure its a great tech, but with a name like that everyone will just scream apple (time capsue) knockoff..  something that im sure is not even true.
  
  i wish ms marketing why try and do justice the really smart and useful things that the devs come up with, and that they dont try to play of the names of lesser software complnies..

   

  
  
  "Time Warp" was the code name for this technology....

• 

  The "delete all previous versions" of a file would be a really important utility. The example mentioned previously of wanting to expunge all traces of a sensitive file is a good one, but the first example that came to my mind while watching the video was malware removal.
  
  ie. lets say you update your AV/AS software, so now it catches a lot of stuff that was missed before & now it finds that you have installed malware... the AV software will have to be able to remove the current files as well as removing any/all previous versions of them to ensure a clean system (and that the system won't get re-infected by the user restoring previous versions of evil files).
  
  I also wonder if it's possible for advanced malware to inject files into previous versions in order to hide them for later re-activation.
  
  
  
  

• 

  Few questions:
  
  are the previous versions read-only shares always available?
  Specifically are they mounted when accessed, or always there?
  
  
  Can you talk some about the effects of defrag on previous versions?
  
  
  In the video it discussed VSS and hardware providers, does previous versions work with hardware providers on Vista?
  On Longhorn?
  
  
  The integration of previous versions also works with shares on W2003?
  
  
  How does previous versions work when DPM is installed?  Can DPM be installed on Vista, or is this just a server technology?
  
  

• 

  Very informative video. Can anybody help me figure out why "Previous Versions" are not working for me? I'm running Vista Business, and if I browse to a network share that I have access to (it's on a Windows 2003 server with shadow copies enabled), I can right-click on files or folders and clearly see previous versions of my files.
  
  But no such luck on my local hard disk. I have System Restore enabled on my C drive, I've gone to the command line and checked vssadmin, and I can see that there is 15% of the drive reserved for shadow copies, I can check System Restore and can see that restore points are being created. But no matter what I do, any time that I right-click on a file or folder or even on the entire C drive to check for previous versions, there are never any previous versions available.
  
  What am I doing wrong?
  

• 

  >>> "Time Warp" was the code name for this technology....
  
  Correct. One note - we used the code name "Timewarp" since 2001-2002, basically when the whole "Previous Versions" project was started. As mentioned in the video, the first shipping vehicle for Previous Versions was Windows Server 2003. What Vista added was support for local Previous Versions.
  

• 

  >>> I also wonder if it's possible for advanced malware to inject files into previous versions in order to hide them for later re-activation.
  
  That won't work as shadow copies are essentially read-only volumes.

• 

  >>> are the previous versions read-only shares always available?
  Specifically are they mounted when accessed, or always there?
  
  [adi] They are mounted when accessed for the first time.
  
  
  >>> Can you talk some about the effects of defrag on previous versions?
  
  [adi] This is a complicated topic - we performed many defrag-related optimizations in shadow copy technology in Windows Server 2003 and even more optimizations in Vista. What's new in Vista is an optimized defrag strategy that would minimize (and even eliminate) side-effects of defrag (like unnecessary growth of the shadow storage area during defrag, or eliminating unnecessary performance implications related with the Copy-on-write, etc). It migth be a great topic for a blog post..
  
  
  >>> In the video it discussed VSS and hardware providers, does previous versions work with hardware providers on Vista? On Longhorn?
  
  [adi] Hardware providers are not supported on client releases of Windows since this is a essentially server technology. In the next Windows server release (code-name Lonhgorn) we have a number of improvements of VSS Hardware technology - stay tuned!
  
  
  >>> The integration of previous versions also works with shares on W2003?
  
  [adi] Yes, this continues to work as in Windows XP SP2.
  
  
  How does previous versions work when DPM is installed?  Can DPM be installed on Vista, or is this just a server technology?
  
  [adi] The Previous Versions tab is integrated with DPM storage as it used to in XP timeframe.
  

• 

  Very informative video. Can anybody help me figure out why "Previous Versions" are not working for me? I'm running Vista Business, and if I browse to a network share that I have access to (it's on a Windows 2003 server with shadow copies enabled), I can right-click on files or folders and clearly see previous versions of my files. But no such luck on my local hard disk. I have System Restore enabled on my C drive, I've gone to the command line and checked vssadmin, and I can see that there is 15% of the drive reserved for shadow copies, I can check System Restore and can see that restore points are being created. But no matter what I do, any time that I right-click on a file or folder or even on the entire C drive to check for previous versions, there are never any previous versions available. What am I doing wrong?

  There will be no Previous Versions displayed if a file didn't change at all between the current version and previous versions on the corresponding restore points. You should see at least one version if you:
  1) Create a system restore point containing the file
  2) Modify this file
  3) Right-click to see its previous versions.
  
  

• 

  Adi Oltean wrote:

   There will be no Previous Versions displayed if a file didn't change at all between the current version and previous versions on the corresponding restore points. You should see at least one version if you:
  1) Create a system restore point containing the file
  2) Modify this file
  3) Right-click to see its previous versions.
  
  

  
  
  Adi:
  
  Sorry, but been there, done that. I've had system restore enabled on the main Vista partition (C:\) since Feb. 3 and it is definitely creating restore points, and I've changed a lot of files on a daily basis, but there still are no Previous Versions displayed.
  
  I do see previous versions displayed on a network file share that is creating shadow copies on the server (Windows 2003 server), but none on my local C drive.
  
  Jill Zoeller has been trying to help me figure this out, but so far we've come up with no reason why it shouldn't work, but it doesn't.
  

• 

  Hi K0lo
  I am very interested in your problem as I two have the same issue starting back on Feb  3 or 4 .
  
  I have looked extensivily into task scheduler to recreate a start point to test this , it fails consistantly also I have checked all the shadow copy writers ,copies ,volumes and they seem to be in order and working. I have searched thru the registry and can also see the keys related to the indivdule shadows but I have no previous versions or restore points .
  
  The only way I have found to create one , is to manually create a restore point and that remains but no others appear after system checkpoint should of been created.
   
  I do have bitlocker enabled from usb ( i dont have a TPM) and think this maybe something to do with the problem. I have disabled it once and I had some previous versions reappear ???(amongst a million other configerations)
   My next move will be to decrypt the whole drive 60+gb of data and try with no bit locker enabled. Do you have bit locker enabled?
  Please let me know how your going with this issue as I have searched high and low for related info on this issue I was supprised when I saw your post as is exhactly the same I am sure there will be others with the same
   regards
       thecheif

• 

  thechief:
  
  I just fixed this about an hour ago, so your post is timely. Apparently the GUI client that displays "Previous Versions" of files communicates with your network adapter via its localhost address. In my case I was unable to communicate with the adapter, thus no shadow copies could be displayed.
  
  The cure is to go into your network adapter's properties page and make sure that "File and Printer Sharing for Microsoft Networks" is checked off. Once I did that the shadow copies were immediately displayed.
  
  In my zeal to secure the machine against outside intrusions I had disabled file and printer sharing in several places (at the network adapter, in the control panel's "Network and Sharing Center" page and at the Windows firewall). You can disable the latter two but you must have the first one enabled for this feature to work.
  

• 

  Thanks K0lo
  mine checkbox is checkoff but I will play around with those settings
  and see if I can get a positive outcome by the way do you have bitlocker enabled
  thecheif 

• 

  Sorry; I forgot to include that in my last post. No, I do not have BitLocker enabled.
  

• 

  Hi k0lo
  
  I double checked all as you advised and stiil the same ,I am sure this has somthing to do bitlocker
  
  regards
  
  thcheif

• 

  I like Vista, but I wish they would fix a few things with ShadowCopy:

  1. Vista's Backup system "ShadowCopy" is a great concept, but it's done at set intervals. It would be much better if a ShadowCopy of a file was made automatically when a file is saved. For example, let's say I made a few changes to a file and save it a few times while I'm working on the file. But then I realize I made a mistake and would like to go back one version. Because ShadowCopies are made at set intervals, I can probably revert back to yesterday's version, not a version saved 10 minutes ago.

  2. Also it would be nice to tell Vista what folders/files that the ShadowCopy should NOT make back-ups of -- in order to save valuable harddrive space. For example, when you use Media Center to record programs, you create large files that are probably each at least 3GB. These files are inherently meant to be stored temporarilly: you watch the recorded program and then you delete them. However, with ShadowCopy this deleted large file is kept in the background. So it would be nice if you could tell Vista not to backup the "Recorded TV" folder and thus saving harddrive room.

• 

  best wishes!
  
  -Joey

• 

  Strangely TimeWarp seems have an effect of warping time - changes seem to be made to previous and not current versions of the file.  It is mighty confusing.
  
  

  • I have an application which stores its data in a Jet MDB.
  • A User of the application goes in and makes changes then quits
  • A user goes into the application again and changes are viewable (All normal so far)
    
  • The date and timestamp of the MDB file has not changed on disk (The puzzle begins)
    
  • A binary compare of the file on disk shows that it is unchanged since the version which was installed (The riddle deepens)
    
  • Delete the MDB (Sanity lost from this point forward)
    

  The user runs the app again - lo and behold it no longer works crikey it still works even though its data file has been deleted!  If the user goes into the options in the application to choose the data file then they clearly see the file which has been deleted and which is not visible by Exploring to the folder. 
  

  My conclusion is that my application (at least for this one user - will all other users link to the same 'previous' version which contains current data?) is using a previous version.  Certainly not what I would have envisaged.
  

  What *exactly* is going on here? How can I control all of this? More's to the point - how can I possibly rely on my operating system not playing with my sanity?
  
  
  Only further point to add - This scenario has the MDB located in a sub-folder of Program Files - I am upgrading my app to work under Vista where the data file should be held elsewhere.  I was testing the 'existing XP user upgrading to Vista' scenario expecting that they would get an error when the MDB was opened since it *should* have been read-only as a result of being in Program Files.
  

  
  

• 

  Hi Adi,

  As per comments at
  http://www.geekzone.co.nz/freitasm/2516

  "After working with Microsoft on this issue I found out that 32 bit requestors won't work with 64 bit VSS services "

  Is this correct for W2K8 server (Longhorn)?
  I wish its not.

  Thanks
  

• 

  Great information! For the longest time I couldnt get shadow copy to work. Then I discovered that after re-enabling "TCP/IP NetBIOS Helper" service, shadow copy started working immediately

  Can anyone else confirm that VSS requires TCP/IP NetBIOS Helper to be set to Automatic?

• 

  Adi Oltean wrote:

  >>> "Time Warp" was the code name for this technology....
  
  Correct. One note - we used the code name "Timewarp" since 2001-2002, basically when the whole "Previous Versions" project was started. As mentioned in the video, the first shipping vehicle for Previous Versions was Windows Server 2003. What Vista added was support for local Previous Versions.
  

  
  
  awsome.. i had no doubt that microsoft were the first ones with this tech. its just ticks me of that apple will claim that this is their invetion
  
  but those guys have some mean reality distortion filters..

• 

  The restore point feature is finally useful in Vista. Thats great.
  What really sucks is the backup software integrated. IMHO if the original Veritas based backup + restore point serve together is the best combination. For details on my comment of the backup in Vista u may go here:
  http://bugthis.blogspot.com/2007/11/vista-wtf-whats-wrong-with-previous.html
  
  Ok now my question is, I really wanna throw away that backup software immediately, but I still want my Previous Versions working. Any good backup software recommendation? I know Live OneCare DOES NOT WORK (and its a shame as Live is MS product).
  

• 

  If there are several volume shadow copies and I change a file, will the previous blocks of the file be changed once or that a copy will be saved for every shadow copy?

• 

  Is this based on any system services?  because disabled a lot of them that I wasn't using to conserve memory. I've used VSS once before in my C drive and now I've enabled it on my D: drive (which contains all my data) but it still hasn't made any backups yet. Also the ones that were originally there in C drive are also no longer there. Have I disabled something it needs that i have to re-enable again?