Questions on Volume Shadow Copies

To the best of my knowledge shadow copies on other than Windows Server OS's are not manageable by the user.  That function is done by the OS itself.  You can limit how much space is used by shadow copies by changing System Protection usage amounts but doing that can cause issue with shadow copy protection if you set limits to low.  Generally 10 to 15 percent of free disk space allocated for this purpose is acceptable.  You can go smaller percentages on larger disks but Windows is quite good at setting the appropriate levels here on it's own without user intervention!

I did a little more experimenting on this issue.

First test, I uninstalled the last Generic volume shadow copy, even though it was not a grayed out item. It looked like it worked, but when I went into the Event viewer I found I would get the following errors every few minutes.

VSS Error Event ID 12305:
Volume Shadow Copy Service error: Volume/disk not connected or not found. Error context: CreateFileW(\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy86,0x00000000,0x00000003,...).

Operation:
   Removing auto-release shadow copies
   Loading provider

Context:
   Volume Name: \\?\Volume{319d4afe-babf-4fcf-ad3e-90407de32c12}\
   Execution Context: System Provider

I rebooted and the generic volume shadow copy was recreated and the errors went away. Back to where I started.

Next, I changed Snapshot from "VSS without writers" to "VSS" for my test backup, ran the backup and it created another shadow copy.
Then I changed it to Acronis Snapshot and ran backup. No shadow copy created and it looks like all is fine.

Using vssadmin, I changed the MaxSize on C: from unbounded to 20GB, which was about 3 times the amount of space claimed to be used (nut less than allocated). This ended up deleting all my C: restore points. When I looked in Device Manager, all Shadow copies above about 58 were then grayed out. Then I changed MaxSize on D: to 20GB (well above what was used) and this deleted the one restore point on D:. It also grayed out all the rest of the shadow copies in Device Manager. [I was prepared for my Restore Points to be deleted. I've never successfully restored to one in all the years they've been used.]

I then went to Device Manager and uninstalled all the generic volume shadow copies, one at a time. All was OK and no errors.

I created a new restore point and that gives me one enabled Generic volume shadow copy... ShadowCopy1.

Finally, I went to Acronis and changed the Snapshot to Acronis Snapshot for all the File and Folders backups. I found that the Disk backups were set to VSS and if I changed them to Acronis Snapshot I would get a suggestion that it should only be done if VSS was problematic. So I left them as VSS.

What I don't understand is why all those shadow copies are connected since they seem to be useful for one backup only. Should ATI be able to release them when the backup is done? Will Windows release them when the space is filled up? If they take very little disk space, one could end up with thousands of them in the registry and that is not good.

I have submitted a case to Acronis about the unreleased shadow copies, but I would be interested to know if others are experiencing the same thing.

It is easy to check. In Device Manager, select View->Show hidden devices. Then expand Storage volume shadow copies. On my system, I was finding a very long list and all of them were enabled devices. Right clicking one of the devices and selecting Properties, then Events tab, one can see when the device was initially configured. Most of them matched my daily backup time.

Anyone else have a big list?

In the Devices manager there is usually a long list of shadow copies. I can confirm this. From time to time I urge myself to delete "deattached / hidden" devices and so also shadow copies listes there. No idea if this helps. I think Acronis is working on a tool to detect VSS issues but it is not available yet.

Also a list of deattached volumes might get lenghty. Some of them could be explained by deattached USB sticks or phones etc.

Karl, detached USB sticks were not an issue for me. All of the listed devices were accounted for as either System Restore Point (5 of them) or Acronis backups (over 80). Once the Acronis backup was done, the shadow copy was left taking up space but completely useless and inaccessable. I also found that the limit on my C: drive for shadow copies was unbounded, which was odd because I had set up to a value earlier.

Bruno,

detached USB sticks were not an issue for me > i was referring to the other list of hidden devices called volumes (should be right above the volume shadow copy node)

I agree with you about the strange behaviours of system restore point settings. I have noticed that upgrading to major Windows 10 version like now it is with 15063 often (99%) causes these effects:

- VSS (merely system restore) for drive C gets disabled if it was enabled prior the upgrade
- VSS (merely system restore) for drive C gets disabled and the amount is set to maximum or as you say "unbounded"

So Karl, getting back to my original question... do you have a long list of Generic volume shadow copies that are created by Acronis and still enabled?

Dang, I'm glad I read this.  I disabled system protection long ago and didn't think to even check.  Like Karl, after the Windows creator update, system protection was enabled and set to 100% and remains there.  Luckily, it's not really using much space at the moment, but am glad that I know to turn it off again.

While everything is still on though, I'd like to note that:

1) I also have several hidden "generic volume shadow copy" entries and and "volumes" entries in disk management.  Only 2 "generic volume shadow copy" entries are active, the rest are greyed out.  

2) I ran vssadmin list shadows and only 2 are listed - which matches the number of active "generic volume shadow copy" entries mentioend above. 

3) I ran a few backups (with the same task) and then ran "vssadmin list shadows" again and still only 2 items returned.  Refreshed disk management and still only 2 active items there as well.  

4) I deleted system restore points and turned off system protection.  Now there are no active "generic volume shadow copy" entries.  However, the greyed out ones remain.  

Hi Bobbo,

I assume you meant Device Manager, not Disk Management in your comments.

When you ran a few backups, are they configured to use VSS or Acronis Snapshot?

You can get rid of the grayed out generic volume shadow copies, but you need to just uninstall them one at a time.

In my case, none of the shadow copies were grayed out until I reset the size. Also, vssadmin would only show the ones produced by System Restore points, not the ones left by Acronis even though they were still enabled in Device Manager.

Bobby can you please submit a new problem to the Feedback hub about this and share the link? Thanks! I will contribute there. Screenshots are very helpful for MS.

Here was my earlier feedback: https://aka.ms/Rfvq0e

BrunoC wrote:

So Karl, getting back to my original question... do you have a long list of Generic volume shadow copies that are created by Acronis and still enabled?

here is my current state, but I ATIH has not run often since the upgrade to 15063.

I have a new and distressing update to this issue.

Tonight, my monthly C: drive backup ran on schedule. I left this backup using the VSS snapshot option. Unlike my other backup tasks, which are File an Folder backups, this one was a disk based backup.

After it ran, I looked to see if it would leave a shadow copy around. What I found was that in Device Manager all my generic volume shadow copies were grayed out. When I looked at System Restore, I found that all of my valid restore points were gone!

I checked the VolumeSnapshot-Driver event logs. There is evidence that the shadow copies were all accounted for at the time of the last system boot, less than 5 hours before the backup task was run. At 25 seconds after the scheduled start of the backup task, there is an Event 107 and then 108 for each of the restore point snapshots. And after that... they are all hosed.

Bottom line, I do not trust Acronis to use VSS.

BrunoC,

Just curious, are you running SQLServer on your computer?

Enchantech wrote:

BrunoC,

Just curious, are you running SQLServer on your computer?

Nope. I have Windows 10 Pro. It's a home use PC that I keep as lean as possible.

Is there any worded description for the event 107 and 108 errors?

I think the 107 error is not really an error but is a reporting function sort of like an echo in a batch script file.  I find o reference to the 108 error. 

Enchantech wrote:

Is there any worded description for the event 107 and 108 errors?

I think the 107 error is not really an error but is a reporting function sort of like an echo in a batch script file.  I find o reference to the 108 error. 

These are Information, not Errors in the event log.

107:

Reading of a snapshot diff area's metadata began.

Volume GUID: {319d4afe-babf-4fcf-ad3e-90407de32c12}
Snapshot GUID: {14f73dba-1fa4-11e7-afab-2c4d54cf13d9}

Guidance:
When a volume is brought online or reverted to a snapshot, the volume snapshot driver reads the diff area for the most-recent persistent snapshot (if any).  The diff area for earlier persistent snapshots is typically read the first time the snapshot is read from.

You should expect this event when a volume is brought online, reverted to a snapshot, or when reading from a persistent snapshot for the first time after bringing a volume online.  This event may also occur if a volume is dismounted that contains snapshots that have not been read since the volume was brought online.  No user action is required.

108:

Reading of a snapshot diff area's metadata completed.

Volume GUID: {319d4afe-babf-4fcf-ad3e-90407de32c12}
Snapshot GUID: {14f73dba-1fa4-11e7-afab-2c4d54cf13d9}
Count of 1MB Reads: 1
Count of 16KB Reads: 2
Diff Area Metadata Size: 1064960 Bytes
Total Data Read: 1081344 Bytes

Guidance:
When a volume is brought online or reverted to a snapshot, the volume snapshot driver reads the diff area for the most-recent persistent snapshot (if any).  The diff area for earlier persistent snapshots is typically read the first time the snapshot is read from.  The size of the diff area metadata may be less than the total number of bytes read if the diff area is discontiguous on disk.

You should expect this event when a volume is brought online, reverted to a snapshot, or when reading from a persistent snapshot for the first time after bringing a volume online.  This event may also occur if a volume is dismounted that contains snapshots that have not been read since the volume was brought online.  No user action is required.

Neither of these really tell me much. They were the only messages at the backup time. The Event 104 from the prior boot told me I had 10 snapshots. A reboot after the backup did not generate an Event 104. It did show the normal 100 and 101 events for each of the now defunct shadow copies. I created a single System Restore point and the subsequent boot shows a 106 event for the new restore point and a 104 event telling me there is 1 snapshot found. I never received any 105 events, which would indicate an inability to successfully activate a snapshot.

One of the things that occurred to me is that I have set the VSS storage space to 20GB. Although the used space was previously reported to be well below that, I am wondering if there may be an issue where ATI is needing too much space and thus the older snapshots were deleted. If that's the case and ATI is in competition for space with restore points, then I for sure will not use VSS for my backups.

Been away for a couple of days so am playing catch up.

Bruno - to address your earlier question - yes, all are using VSS as the default method.  I have since turned off system protection though as that has been my default configuration as restore points have never worked very well for me and file protection has been hit or miss.  

I did mean device manager and not disk management in my earlier post.

As for the shadow copies being removed in your system - could that have occured after moving the slider from 100% to something else (shrinking it)?  Doesn't sound like it, but just to be sure.

When you run an Acornis backup with VSS enabled, does the slider move to 100% during the backup and return to the original size when it's done?

BrunoC,

I thought as much with those events.  I think there is a possibility that Windows itself removed your shadow copies.  From what I understand in reading Windows 10 VSS is or has not been known to be fully developed.  Some changes were made to the service as new code was written to provide for File History for example and the ability for a user to directly view shadow copies was removed in Windows 8.1 and then carried over to 10 as well.

Check your other post on the CAPI2 513 error, I  posted what I believe to be a sollution to that for you there.

Bobbo_3C0X1 wrote:

Been away for a couple of days so am playing catch up.

Welcome back!

Bobbo_3C0X1 wrote:

Bruno - to address your earlier question - yes, all are using VSS as the default method.  I have since turned off system protection though as that has been my default configuration as restore points have never worked very well for me and file protection has been hit or miss.  

The fact that you have protection turned off may be why you are not experience what I am. I have protection on. That said, I don't think I've had a successful restore since Windows XP. On the other hand, I take a lot of care so I don't need to.

Bobbo_3C0X1 wrote:

I did mean device manager and not disk management in my earlier post.

Yeah, I figured that.

Bobbo_3C0X1 wrote:

As for the shadow copies being removed in your system - could that have occured after moving the slider from 100% to something else (shrinking it)?  Doesn't sound like it, but just to be sure.

When you run an Acornis backup with VSS enabled, does the slider move to 100% during the backup and return to the original size when it's done?

I assume you mean the slider on the Windows System Protection configuration box. I did discover that moving the slider will most likely result in complete loss of restore points. I used vssadmin to set the max to 20GB a week or so ago. Since that time, I did some software removals and installs that generated about half a dozen restore points.

When my backup ran that lost all the restore points, I was nowhere near the PC, let alone the slider. The loss definitely occurred as a result of the backup being run, but there was no error indication at all.

Prior experience led me to believe there would be an unreleased shadow copy when this backup ran, as there was with my other backups. This one was different. The difference in the backups is that the others were File and Folder backups and this recent one was a Disk backup.

Acronis has a support case now. Meanwhile, I'm just staying away from VSS. Either Windows can have it, or Acronis can have it, but not both. For now, let it be Windows.

BTW, there is a nice NirSoft tool called ShadowCopyView that lets you look inside the shadow copies. Thanks to Nir.

Yeah, the system protection slider for percentage of drive space to allocate was what I was referencing.

And no, I am not using system protection anymore so can't really duplicate now, but it was re-enabled by default and set to 100 by Windows after the Creators update applied so that's where I was able to see some of this happening.

Basically, I leave system protection off now, but continue to use VSS for all of my backup products (I have about 5 installed for testing, comparison and diversity of restore options and locations).im not doing any Windows backups though.

if you are, I bet you could leave vss for Windows and use the Acronis snapapi method for Acronis backups instead of vss or vss without writers. That was the default method in 2014 and earlier and it worked just fine. You really only need vss if you are trying to backup open sql or oracle databases.

Interesting conversation on the topic of VSS usage.

It has always been my understanding that True Image removed shadow copies once the task requesting the snapshot completed.  Bruno seems to have found this not to be the case at least with file/folder based backups.  We will see what support says about that!   He now finds that a full OS System disk backup has removed all previously stored shadow copies! 

I would offer the following explanation for the disappearing shadow copies as a result of the full disk backup.

First, it is known that Windows itself controls the removal of shadow copies based on allocated disk space for these shadows.  It is also known that files appearing greyed out are either missing from where they are suppose to be or have permission settings which deem them unaccessable.  It is also known in the case of Bruno that he automatically set the size limit of shadow copy stoarge space to 20GB prior to running the backup which removed all known shadow copies.

I suspect that the shadow copy list shown in Device Manager contains currently available shadows which are darkened and greyed shadows which probably no longer exist.    In the case of these available shadows in Bruno's scenario being removed I suspect that with total available space for shadows limited to 20GB, existing shadow copies taking up some of that space, and space requirements for a full disk backup shadow copy exceeding the remaining available space on disk that Windows removed the existing shadows so that the backup task could run successfully using VSS.

What I would recommend here would be that either the user let Windows and True Image manage allocated space for shadow copies which should allow for existing shadows to remain while a full disk shadow is created in most cases or, the user whom has System Protection enabled chooses to either not to use shadows at all or to use the Acronis Snapman shadow feature to avoid this problem where available disk space for shadows has been  limited by the user.

I did some testing today for the Acronis case and wanted to quickly summarize the results.

Test 1: System Protection On with max usage set to 20GB (4%) on C: and one System Restore point there, claimed to be using only some MB of data so it looked like there should be lots of room left. Device Manager only showed one enabled generic volume shadow copy. I ran a VSS backup and when done, there were two disabled generic volume shadow copies left. The System Restore point was destroyed.

Test 2: I uninstalled the disabled shadow copies, increased the max usage to 90+GB (20%), created a System Restore point and then repeated the test. This time, the System Restore point I created was maintained but the second shadow copy that was created by Acronis was left enabled. This is what I was seeing before in that the Acronis shadow copies were accumulating.

Test 3: I turned off System Protection. The backup created a shadow copy which was left disabled. Repeated backups would just use the same shadow copy number and not accumulate them. I could see it in Device Manager being enabled and then disabled.

In summary, I think if protection is on, Acronis will leave shadow copies enabled unless running out of space in which case everything is wiped out.

So, I would venture to say that if you want System Restore points to be maintained, do not use VSS for Acronis. But if you turn protection off, it's OK.

I'll be awaiting analysis of the Process Monitor logs, etc. to see if Acronis finds anything.

very interesting findings, thanks for your efforts @Bruno!

Bruno, there is no compatibility issue between System Restore points and VSS backup with Acronis True Image. When doing a system backup, using VSS method is recommended over "Acronis snapshot" as it lets the system prepare to be saved in a consistent state in the backup. There is absolutely no need to disable System Protection, moreover, it is better to leave it enabled as an additional source of recovery points, an extra protection layer.

The whole purpose of the shadow storage is to store the shadows, so it is perfectly normal for shadows to be accumulated there over the time. As Enchantech said, the cleanup procedure there is fully automated and you have control over how much disk space to allocate for them.

I understand you supposed the very first system recovery point to be destroyed after running Acronis backup based on what you saw in the NirSoft user interface. Have you checked the actual system restore wizard (e.g. by clicking the button "System Restore..." under "System Protection" tab of Advanced system properties) to see what system recovery points are available? I think you would have seen that the original system restore point was still there, available for restoration at any time.

Finally, I would like to re-iterate that we do not recommend turning off System Protection feature of Windows, Acronis True Image VSS backups co-exist with it just fine.

Regards,

Slava

Hello Slava, thanks for the comments. I have a few reactions.

On your comment about the NirSoft interface... it is fully consistent with what is seen by clicking the "System Restore..." button, so I have no misunderstanding there.

I agree that keeping System Protection on in Windows is good for added protection.

While Windows and Acronis VSS do co-exist just fine, they are in effect competing for space. Going back to my post #22 on this thread, the Test 2 I ran was where I have concern. Every time I run a backup using VSS (with or without writers), a shadow copy is created and it is left active, meaning it is using up space. Yet all these shadow copies are not seen by Windows System Restore, NirSoft or vssadmin. One can only see the Windows restore points. Eventually, after enough backups are run the space will be full and Windows will manage it by removing the oldest, which can mean a valid restore point. Or, if the shadow storage space is "unbounded", these things will accumulate forever. There could be thousands of them.

When Windows does a restore point, it makes perfect sense that the shadow copy is enabled so that the restore point is available. But once Acronis True Image has finished a backup, I don't see any reason that the shadow copy should still be enabled (as evidenced by Device Manager) as there is nothing it is good for any more.  The results in Test 3 are what I would expect to see if System Protection was on, but it only works that way if System Protection is off. At least on my system.

Slava, I just installed ATI 2017 build 8053 on my other PC running Windows 7 Pro. I left the backups to use VSS and I'm finding they are all working as I would expect them too. So there is a problem that exists only on my Windows 10 Pro PC. Support case 02963294, dealing with this issue, was closed but now I feel it should be reopened.