Use VSS to Expand your Short-Term Restore Options

If your organization is anything like nearly every other organization I have worked with, you will find that the vast majority of file restore requests are from the very recent past. In fact, IT Today cites that industry-wide a full 40% of all restore requests are from the last 7 days. If the lion-share of all restore requests are going to be from such a small window in time, why not set yourself up to better service those requests? Especially when there is no extra software to buy and only a small price to pay in storage.
Every version of Windows Server starting with Server 2003 (Workstation OSes had this feature beginning with XP) has included a feature called Volume Shadow Service or VSS, which is capable of taking "snapshots" of the file system at frequent intervals, so that a view of what the system looked like at the specified time can be quickly produced. Unfortunately, very few of the organizations that I have worked with have actually taken advantage of this feature. Imagine the surprise on your user's face, when they ask for a file or folder from yesterday because they accidentally overwrote or deleted it, and you ask them what time they would like it restored from.
For details on how VSS works, see the Wikipedia article on VSS.
In the strictest sense of the word, VSS is NOT a disaster recovery technology as it is dependent on the file system that it is stored on. Since that file system is on the same server as it is protecting (and typically on the same volume as the protected data), you can quickly see that VSS cannot be guaranteed to be available to restore from should the server itself fail.
In a VSS implementation, you set aside a portion of a disk volume to be used for VSS Snapshots. This space is typically a part of the original volume, so there is no repartitioning necessary. You then setup a schedule of when the system should take snapshots. When the system runs out of space in its snapshot area, it simply removes the oldest snapshots until there is sufficient space for a new snapshot.
The first step in implementing a VSS solution is estimating the amount of disk space you need for your snapshots. There are a couple of ways to get a good estimate of the volume of the amount of change your system undergoes.

1. If you do incremental backups of the system in question, simply use the average volume of backups for a period of time
2. If you do not do incremental backups, simply run ROBOCOPY in list mode with the MAXAGE argument to see the volume of files that are changing per day or week.

Once you know how much space is changing per day, you can look at the total volume of space on the volume and make an educated decision about how much space you can "give up" to snapshots and how far back in time snapshots will typically be available. Amazingly, in all of the organizations I have been involved with the number of snapshots you choose to take in a day typically doesn't have a huge impact on the space calculation. This is because VSS is a block-level "backup", where are as both of the estimating methods shown are file-level backups.
To actually enable VSS on a disk volume, simply right-click on the volume in My Computer, Explorer, or Disk Management and choose Properties. Once the properties windows appears, select the Shadow Copies tab. You will then see a screen similar to the following:

While you can simply click on the Enable button, I wouldn't recommend it as the defaults are likely not what you would choose on your own. The best course of action would be to select the Settings button, which will produce the following screen:

In most environments I have been involved with, there is not a separate volume on the system available for VSS snapshots and as VSS Snapshots should not typically be relied upon for true disaster recovery the default of placing the snapshots on the same volume as the data is acceptable. Simply enter in the amount of space you wish to reserve in the Use limit field. By default, the system will take 2 snapshots per weekday: 1 at 7AM and 1 at 12PM. If this is to your liking, simply click ok, and you are done. If you are anything like me, you would prefer more granularity than that. To change the schedule, simply click on the Schedule button and you will be presented with a screen similar to the following:

In most of the implementations I have been involved with, the multiple schedule use has been found to be unwieldy. As a result, most implementations I have seen have removed the second schedule, the 12PM item, and instead used the repeat task options available under the Advanced button options to have snapshots taken every hour or 2 during the business day. Click Ok to all of the windows and you are all set. Snapshots will begin to be made at the prescribed intervals.
Ok, we have all been in the situation where a server suddenly is nearly out of disk space. If you encounter this situation on a VSS enabled volume, simply lower the amount of disk space available to the VSS snapshots. The system will then begin removing older snapshots to meet the new, lower threshold.
To browse or restore historical files from a VSS volume, simply right-click on the folder you wish to view from any VSS enabled client (XP and newer OSes) and choose properties. Navigate to the Previous Versions tab. Select the snapshot from the time you wish to browse and click Open. Find the file(s) or folders you wish and view, copy, or move them as you need to.
Even without including the potential productivity gains from the end-user community due to less lost work, VSS quickly pays for itself as it is rare for a VSS restore to take more than a couple minutes. This allows you and the other support staff members to complete the restore request far quicker for the end-user community and move on to the next request.