Windows: Access to VSS snapshots

From time to time it can be quite helpful to be able to access snapshots of drives, be it to quickly restore a file or to compare the contents of two files. A VSS snapshot can always be made accessible without having to restore the snapshot. However, there are two different ways depending on the attributes of the VSS snapshots.

In this example, there are two VSS snapshots. The first has the attribute "Client_accessible", the second does not have this attribute:

Snapshots with the attribute Client_accessible are often created by backup software during the backup. This type of snapshot cannot be mounted as a drive via Diskshadow and the "expose" command. When attempting to mount the snapshot, a corresponding error message is generated:

As snapshots with the "Client_Accessible" attribute cannot be mounted as a drive, a symbolic link must be created. This can be done with the following command:

mklink /d c:\snapshot \

The final backslash "\" at the end of the device name is important. The command for the first snapshot from the example would therefore be as follows

mklink /d c:\snapshot \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy4\

The specification "c:\snapshot" represents the name under which the snapshot is to be made available; no directory with the same name may exist. The snapshot is then available under c:\snapshot. Reading and copying files is therefore no problem.

The second snapshot has no "Client_accessible" attribute and can therefore be mounted directly via DISKSHADOW.

The command for this is as follows:

expose  :

So in this example it is

expose {7c0a3aba-a397-483c-9449-273148811202} s:

The snapshot is then available as drive S::

The snapshot can now be accessed like a drive and files can be copied or compared. It is also possible to restore a file.