Volume Shadow Copy question

[voltron]

Hi;

This got me interested due to some issues I've seen in another forum.

How does Volume Shadow Copy affect antivirus/malware scanning of hard drives installed in a pc system? Freezing/BSOD are instances that were given with advices pointing to "stopping the Volume Shadow Copy"...

What may be negative issues IF you disable the Volume Shadow Copy Service?

Is it safe to leave it disabled for a long period of time or say, forever?..Maybe long term effects or something...

or better yet,

What is Volume Shadow Copy Service and what does it do?

If you have only one hdd (the Local C:/ system disc), is it safe to stop it or not? Maybe pros and cons...

If you have 3 hdd's (active partition, one for backup and one reserve) again maybe pros and cons...

If you are in a RAID arrangement, how can this be an issue....(disable/leave it for a long time)?

Thanks in advance for the replies!

[Pilgrim]

I cannot answer all your questions but I can tell you that I have had the Volume Shadow Copy Service disabled for as long as I can remember.

If you want to know what it is read this http://en.wikipedia.org/wiki/Shadow_Copy

One reason that I can remember for disabling it was that it conflicted with the backup software that I was using at the time.

I have not experienced any problems at all having this disabled nor have I heard of anybody who has.

[voltron]

Hi;

Interesting....I'm using Acronis True Image as backup imaging program..might you share any issues with yours so I can gain some know-how? Thanks for the link!

[safeguy]

Volume Shadow Copy is the background service that is necessary for the built-in Windows System Restore to work...if you disable it, System Restore won't start/work for you.

The answer to whether it's safe to disable it or not or whether it is recommended to do so depends on how you view the importance of System Restore and how much you rely upon it if things go wrong on your PC. If you do use System Restore, then don't disable VSS.

Another thing to take note of is that there are virtualization software that depends on VSS to work such as Returnil, Shadow Defender, etc. If you use those, then do not disable VSS.

I personally wouldn't recommend disabling it....but if you do so, then make sure you've got a valid and sound reason to justify your action. And make sure you have some sort of backup/imaging software that you can rely on as an alternative....

[voltron]

Hello safeguy;

Thanks for the reply and the inputs. Very well pointed out!

It was also one of the given remedies.."...disable system restore then perform a full scan again.." Seems there is really something wrong with the program when to remedy a scan problem is to disable the Volume Shadow Copy service/system restore...what if the user has no alterative way of backup? Or when you disable it (loose all restore points ) and then still the problem arises...

In fairness to the antivirus/malware program I can say that it is an "isolated case" and onlya few are experiencing it. But then again if say, you are the one affected then you maybe towards a dilemma...

I also am not keen on that advice given though I am not well versed with the service. The reason I got curious and asked here.

So in the existence of such problems of that particular antivirus/malware program, the scanning feature has definitive conflicts with the Volume Shadow Copy service of Windows..right?

Nice one

[Pilgrim]

voltron,

I cannot recall specifics of the problems that I had as it was 2 years or more ago.
I have been using True Image for a long time but I think that when I had the problems I was still using Ghost 10.

Although I have the VSC service disabled System Restore still works but does not create automatic restore points.
Programs like Revo and Registry First Aid create restore points automatically as do many MS updates, they can also be created manually.

I was surprised to read safeguy's comment about Returnil as I use the 2008 version and have no problems with it.

I should point out as you do not mention which OS you are using that what I have said relates to XP-SP3, I have no idea if the same applies to others.

Although it also applies to XP and is somewhat out of date have a look at THIS.
When I reduced the number of services that run automatically this was one of the main sources that I used and although it has not been updated to allow for SP3 I still find it one of the most useful for all things XP related.

[voltron]

Hi Pilgrim-online ;

OS's are XP SP3 and Vista Home Basic. Hmmm...I disabled it to just give it a try at XP SP3. I lost all my restore points:-( It's a good thing I did an image backup before I did that. Well frankly it was the schedule of my image backup so after it I tried it. Wham all went my restore points!

I did used Norton Ghost before but did not like it. Acronis is the best of the lot for me.

Haven't tried Returnil though....I have a license but not have ha the guts to try it out....Maybe on a spare hard drive. But this is interesting on how it affects virtualization states.


Just started trying out Vista(..before I got to Windows 7...late user..been stuck with XP SP3 a looong time) and I aim not to try disabling VSC in Vista. Might give me headaches!

[Pilgrim]

Hi voltron,

It is a long time since I turned off VSC so I cannot remember what happened to restore points when I first turned it off, as I said apart from creating automatic system points it still works on both my computers and System Restore is not my first choice anyway, that would be Erunt and then Acronis.
I only run Acronis manually after deleting unwanted files but I include restore points.

I always liked Ghost but I had to reinstall it and it repeatedly failed to re-register.
After all attempts to get any joy through their website or by email I sent a letter to their head office and about 2 months later got a reply from one of their managers in Ireland saying that they were very sorry and my license number had been re-entered into their system, by this time I had bought True Image and have never looked back, although I still have the Ghost CD and have used it a couple of times since.
If I was starting again there are plenty of free offers for other programs that get the job done so I would probably go with one of them, when I got my Netbook last year I started by using a Paragon program, the only negative for me was that it did not offer incremental backups but it worked well.

I have XP-SP3 on both my computers and doubt that I will change although I have watched with interest the changes to Ubuntu over the last couple of years and in the unlikely event that I ever built another PC I might well give that a try before I considered buying anything, although the PC that I have might well last longer than me.
From everything I have heard I would never touch Vista and I have not seen anything in 7 that would make me want it enough to upgrade, having said that I have added a couple of things from 7 into XP but that is as far as I shall go.

I stayed with the free version of Returnil 2008 because there is nothing extra in the 2010 version that I want although I do have a licensed copy of 2010.
I still use the last 2.4 version of Comodo Firewall for the same reason.
I prefer programs that do one thing well rather than several things not so well.

[safeguy]

My mistake for not being precise in my explanation earlier. I was referring to the System Restore in Windows Vista/7 which works differently (and is better than) from the one in XP...

In Windows Vista, System Restore features an improved interface and is based on Shadow Copy technology. In prior Windows versions, it was based on a file filter that watched changes for a certain set of file extensions, and then copied files before they were overwritten.[2] The advantage of using Shadow Copy is that block-level changes in files located in any directory on the volume can be monitored and backed up regardless of their location

Wiki: System Restore

I suggest you guys to read this:

The Complete Guide to Windows System Restore (It's Better than You Remember)

As for Returnil 2008, I've never used it but from what I believe, the 2010/2011 version works with VSS in a way or another (you can check at Wilders forum)...hence the caution not to disable it.

[Ande]

Volume shadow is used by some backup software to synch between the disk to be backed up and the backup disk (okay, MS uses this for that too).
If you're not using a real-time backup, then you can turn it off. If you're using a real-time backup, like Memeo, then you need the service running.