Recover data from Volume Shadow Copy mechanism (part 1 of 2)

Volume Shadow Copy is a Microsoft mechanism that can automatically backup the volume content based on pre-determined interval. If need to restore individual files,you can select any of the previous 64 versions of the shadowed volume to restore it and get the deleted, damaged or overwritten files.

At first, we need to configure and enable Shadow Copy from command line or computer management as follows:
Adds a shadow copy storage association for a specified volumeTo enable Shadow Copy for a volume, we can do the following syntax from the command-line RunAs administrator:
”vssadmin add shadowstorage /for=volume /on=storevolume /maxsize=xxxMB”
In the Shadow Copies tab of property of Volume, click  “Volume C:\” and “Settings” button
You will see the related value mapping to the above command-line
Run “vssadmin list shadows” & “vssadmin list shadowstorage” again to realize the information about shadow copy

Creates a new shadow copy of a specified volume
To create Shadow Copy for a volume, we can do the following syntax from the command-line RunAs administrator:
”vssadmin create shadow /for=volume”
In the Shadow Copies tab of property of Volume, you will see a times tag on Shadow copies of selected volume.
The above command is as click “Create Now” button so that it show a new time tag record now.
Run “vssadmin list shadows” & “vssadmin list shadowstorage” again to know there is two contents of shadow copy and its storage space is occupied now.

One day, I go wrong to delete a database “Northwind” & overwrite file content from “1” to “shadow copy” in C:\SQLFILE\TEST1.sql

How to recover these data now?

(1).Create a symbolic link to a shadow copy volume<Method 1>
Run “vssadmin list shadows /for=C:” and base on create time to find which shadow copy volume will be restored. In the output screen, we will use this shadow copy volume “\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy2” as restore base.
To create a directory symbolic link, we can do the following syntax from the command-line RunAs administrator: ”mklink /d NewLinkName ShadowCopyVolume\”
Now we can explore the content of shadow copy.

<Method 2>
Right-click the drive letter on which the shadow copy is created next to click “Properties” in menu.
In Disk Properties, click “Previous Versions” –> select one shadow copies based on data modified –> click “Open” button
Now we can explore the content of shadow copy.
When we choose either method, the loss file will be found and recovered now!

Recover data from Volume Shadow Copy mechanism (part 2 of 2)   >>>