24

I'm using the VSS api to create some shadow copies of a volume and then access them using their UNC paths.
Is it possible to get a list of some sort of just the things that changed between two consecutive shadows?

The obvious way of doing this is to go over all of the files in the volume and check for changes but there must he an easier way to do this since one of the key features of VSS is that it saves deltas of information and only saves what is changed.

Joey
  • 344,408
  • 85
  • 689
  • 683
shoosh
  • 76,898
  • 55
  • 205
  • 325
  • 1
    You should be able to do this with the change journal. The only step I'm not certain about is whether the shadow copies behave like real volumes, i.e., whether you can open a volume handle to the shadow copy and issue FSCTL commands. Anyway, see http://stackoverflow.com/a/7459109/886887 for some sample code to get you started. – Harry Johnston Jul 04 '12 at 00:04
  • Are you interested only in the case where no third-party VSS providers are present, or does the solution need to work for all cases? – Harry Johnston Jul 07 '12 at 05:08
  • @Harry Johnston adding a new provider may be an option. How do I do that? doesn't it require a reboot? – shoosh Jul 08 '12 at 14:44
  • 1
    I'm not suggesting you write a provider, I don't see how it would help. Typically a third-party provider would (or might) be present if the volume in question is on some sort of array or other hardware with built-in shadow copy support. If your software needs to support this scenario, you can't use any undocumented features but have to stick to the documented API, so the answer is "no, VSS provides no way to do that". If you *don't* need to support third-party providers, then there might be some undocumented solution. – Harry Johnston Jul 08 '12 at 21:53
  • I don't need to support any 3rd party provider. What's the undocumented solution? – shoosh Jul 09 '12 at 06:52
  • If I knew of one, I'd have mentioned it. Probably there isn't one, but only someone from the relevant team in Microsoft would know for certain. My recommendation is still to try the change journal. I'll post an answer with code for this if I get time to try it out myself, but it probably won't be in the next few days. – Harry Johnston Jul 09 '12 at 19:47
  • A similar question (again, looping through the USN on each copy, and comparing IDs) [How to compare 2 volumes and list modified files?](http://stackoverflow.com/questions/3591842/how-to-compare-2-volumes-and-list-modified-files) – GalacticJello Jul 11 '12 at 20:36
  • Have you looked at "Remote Differential Compression"? http://msdn.microsoft.com/en-us/library/windows/desktop/aa372948(v=vs.85).aspx There may be some overlap in what you're trying to do, but RDC can generate file deltas. It's used to copy portions of a file when you've something shared in common - like binary patching vs copying. – cirrus Aug 20 '12 at 17:31
  • Finally, I was a VSS user myself for many years, but I now believe the product is very inferior in many ways to Git in terms of features, performance and file handling. If you have any choice in the matter abandoning VSS is a wise decision. VSS is one can of dog food that not even Microsoft uses internally. Cheers! – ChatGPT Sep 13 '12 at 06:39
  • 1
    For the benefit of future readers, to avoid confusion: I believe @Max interpreted VSS as meaning Visual SourceSafe (a source control system, hence the comparison to Git) whereas the OP was talking about the Volume Snapshot Service (mostly used by backup software). – Harry Johnston Aug 24 '17 at 21:58

1 Answers1

1

Use a third party software like WinMerge with the shadow copy UNC paths http://winmerge.org/

This will provide a GUI for comparisons

For example, use "C:\", vs "\\localhost\C$\@GMT-2017.08.24-18.07.46"

Of course, enter a valid UNC path to coincide with the date and time of a shadow copy.

Starl1ght
  • 4,422
  • 1
  • 21
  • 49
Jim Lutz
  • 139
  • 6