Wednesday, March 16, 2016

A simple way to view Shadow Copies on Windows 8.1 without installing or downloading software

Upon pressing "undo" accidentally in File Explorer on my Surface Pro 3, Windows 8.1 performs bad behaviour.  See details and frustration others have had here: answers.microsoft.com thread

It seems Windows 8.1 made all the contents of the folder disappear as a consequence of undoing a previous rename of the folder from "New Folder".  That is, the file entry in the Master File Table was lost. Hopefully the entries were deleted and the space is reusable (I'm not sure what how Windows manipulates the MFT in this case).

So, I wanted to recover the files from that folder.  I first found out that Windows 8 has two kinds of "backup" systems, one called File History that is intended to make regular replicas of the tracked Libraries to a separate physical disk or to a network share.  Since this File History wasn't configured and not turned on by default on my SP3, I looked toward Volume Shadow Copy, which appears to be enabled by default on the C: drive.  You can check your "System Protection" tab in System Properties to see if this is the case for you by following the first part of this tutorial: https://www.youtube.com/watch?v=jsIDfyNg7KE
In fact, you can follow the entire video if you feel you want to try the software he mentions, ShadowExplorer.

Alternatively, if you don't want to download any software and happen to have a Windows 7 Pro machine at your disposal on your network, then you can just navigate to the Windows 8.1 machine and right click the folder of interest to see Previous Versions.  This is how I recovered my files and viewed the snapshots of my Documents folder on my SP3.

Interestingly, if you try navigating to \\localhost\C$ on the Windows 8.1 computer without any software installed, you'll be able to see the Previous Versions tab, but it will be empty.  So in my case, from the Windows 7 Pro machine, I navigated to \\SP3\Users\name\Documents\ and right-clicked properties on the folder of interest.  This showed me Previous Versions with a list of snapshots and their dates.

I was afraid at first that I didn't have any shadow copies to restore because checking the Services tab in Task Manager on my SP3 indicated the VSS (Volume Shadow Copy) service was Stopped.  Also, this article says that Volume Shadow Copy Service in Windows 8 is set to manual and does not run on system startup.  Lucky for me, Shadow Copies were being made and I was able to use a Windows 7 computer on the same network to browse the "Previous Versions" of the folders on the SP3 running Windows 8.1 without even downloading other software such as ShadowExplorer mentioned above or Z-VSScopy.