DR – Recover files from Shadow Copy (link method folder or file level)


You have corruption or loss of files and need to recover and maybe your previous versions doesn’t show any previous versions either. You may even get a warning that restoring the previous copies are not supported as there is a system volume on that disk.



Open command prompt with administrative permissions
View the shadow versions using the command, replacing the <drive> with the actual drive letter

vssadmin list shadows /for=<drive>:\

Review the list to determine which point in time you would prefer to restore. In this case we are restoring the shadow copy from 7:00 AM

Contents of shadow copy set ID: {dded75d9-9f01-4753-b03e-ba8e12f034cc}
Contained 1 shadow copies at creation time: 6/13/2016 7:00:18 AM
Shadow Copy ID: {46cd0e5a-4710-468d-bddc-e0ca718f3fd2}
Original Volume: (D:)\\?\Volume{21c2d4e2-5207-407f-6e5b-5d86975ec320}\
Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy336
Originating Machine: fileserver01.NA.mydomain.com
Service Machine: fileserver01.NA.mydomain.com
Provider: ‘Microsoft Software Shadow Copy provider 1.0’
Type: ClientAccessible
Attributes: Persistent, Client-accessible, No auto release, No writers, Differential

Type and press enter

mklink /D <drive>:\Folder_recovery_path\ \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy#\

(as per below)


You will get “symbolic link created” if successful

Note the MUST NOT exist and there must be a trailing slash “\” at the end of the HarddiskVolumeShadowCopy#, replacing # with the actual number and is the point in time you want to restore or you may get the following warning


Using windows Explorer navigate to your folder in this case w:\vss_link\d_folder and use as you would to browse your files.


Tested Platform

Windows 2008 R2 Server

Hits: 281

Leave a Reply