Shadow Copy snapshot file contents silently corrupted on Windows 8.1

I originally posted this issue at Microsoft Community ( http://answers.microsoft.com/en-us/windows/forum/windows8_1-files/shadow-copy-snapshot-file-contents-silently/06a5e25b-6607-45eb-81a1-71cfc2b0cce3 )  but I think it might get more attention here.

Historic overview:

One user had problems with Folder Redirection sync resulting in data loss (details are irrelevant) and we had to recover missing data from PC's VSS snapshot of CSC cache (regular VSS snapshot by System Restore).

In short steps:

  1. Elevate to SYSTEM with PsExec (CSC folder is heavily protected by ACL so we have to use SYSTEM to access it)
    psexec -i -s -d CMD
  2. Get relevant shadow copy with
    vssadmin list shadows
  3. Mount shadow copy with
    mklink /d C:\ShadowMount \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\
  4. Recover data with
    robocopy C:\ShadowMount\Windows\CSC\...\data D:\Backup /E

No errors were seen and a few test files were consistent. About a month goes by and user reported that most of the data was corrupted. We determined that data had been corrupted already during recovery from Shadow Copy.


We have been able to reproduce this on 3 Windows 8.1 systems so far (not tested on 7 yet).

We also tried to over Network provider just in case, but we still see corruption

  1. net use vss$=\\?\Globalroot...
  2. popd \\localhost\vss$
  3. Access data


Symptoms:

Snapshot age seems to be largely irrelevant (corruption in both snapshots taken a month ago and yesterday).

Parts of the file or whole files are filled with NULLs. It seems that NULLs occur at cluster borders (4kB clusters).

It does not matter if file exists on live volume or has been deleted/moved since snapshot.

File is OK on live volume.


For example one text log file (for easy content analysis), size ~244kB analyzed in Hex Editor

  1. Beginning of file has 12kB of data (last data char is position 2FFF)
  2. After that, only 00 characters (NULL)
  3. Data continues at position 3B000 until end of file

ChkDsk /scan shows no errors. The system has been patched up-to-date with WU patches. No LDR hotfixes deployed to my knowledge.

Systems are running regular HDD (so TRIM hasn't cleared up clusters).
Background defragment is enabled.

No VSS errors in Event Log.

The files were very unlikely to be in use (old documents, images, beforementioned old log file) during snapshot.


We're aware that Previous Versions has been dropped in Windows 8, but underlying Shadow Copy technology still exists and should continue to work.


We are considering that this might be a bug in VSS. Shadow copy is not consistent and parts of it are either dropped, overwritten or... something.

Might it be a bug or am I missing something? Should we get a MS support case?
We didn't find any relevant KB articles for Windows 8.1 but found one similar case: http://superuser.com/questions/888383/shadow-copy-recovered-files-contain-lots-of-null-blocks
Windows 7 and previous seem to have had a similar case in the past: https://support.microsoft.com/en-us/kb/2748349

May 13th, 2015 5:53am

Hi Don,

Volume Shadow Copy does not exist in Windows 8.1. It was removed since Windows 8. A new feature named File history is replaced.

Previous versions UI removed for local volumes

https://msdn.microsoft.com/en-us/library/windows/desktop/hh848072(v=vs.85).aspx

Free Windows Admin Tool Kit Click here and download it now
May 14th, 2015 2:42am

Shadow Copy does exists in Windows 8.1 as it is required functionality for System Restore and consistent backup.

Your link confirms that Previous Versions UI has been removed, but explicitly states that Shadow Copy technology still exists:
"Developers who need to create shadow copies of local volumes can still do so by calling VSS APIs in custom code."

VSS API's and tools still exist, but retrieved data is corrupted.

May 14th, 2015 4:00am

If your copy file is not corrupted, try this tool ShadowCopy V2.02 https://www.runtime.org/shadow-copy.htm 
Free Windows Admin Tool Kit Click here and download it now
May 15th, 2015 4:58am

If your copy file is not corrupted, try this tool ShadowCopy V2.02 https://www.runtime.org/shadow-copy.htm 
May 15th, 2015 8:57am

If your copy file is not corrupted, try this tool ShadowCopy V2.02 https://www.runtime.org/shadow-copy.htm 
Free Windows Admin Tool Kit Click here and download it now
May 15th, 2015 8:57am

The issue remains unresolved.

I just created a Microsoft Professional Support incident, let's see what happens...

June 8th, 2015 11:37am

Hi Don

Thanks for your update. Look forward to receive your good news.

Free Windows Admin Tool Kit Click here and download it now
June 9th, 2015 1:46am

Ok, thanks for your update. It seems the only way is to waiting the hotfix now.
June 17th, 2015 5:48am

Microsoft Professional Support confirmed the issue (previously unknown by Microsoft). No workarounds but there will very likely be a public hotfix in the future (currently there is no timeline).
Free Windows Admin Tool Kit Click here and download it now
June 17th, 2015 10:31am

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics