The Limitation of Simple Backups
In a Windows enterprise environment, backing up data is not as simple as copying files from one drive to another. If a file is currently open and being written to by a user or a background service (like a live SQL database or a virtual machine file), the Windows operating system places an exclusive lock on that file. Traditional file-copying tools cannot read it, causing the backup job to fail.
To solve this, Microsoft invented the Volume Shadow Copy Service (VSS). VSS takes an instantaneous, frozen “snapshot” of an entire hard drive. Backup software then copies data from this frozen, read-only snapshot, bypassing all file locks, while users continue to read and write to the live, original hard drive.
While most administrators use third-party backup software that interacts with VSS in the background, Windows includes a highly advanced, built-in command-line tool that allows you to manually create, expose, and manage these snapshots: diskshadow.
Step 1: Launching the Diskshadow Interpreter
Unlike simple commands like ping or dir, diskshadow acts as its own interactive command interpreter (similar to diskpart).
- Click Start, type
cmd. - Right-click Command Prompt and select Run as administrator.
- Type
diskshadowand press Enter.
Your prompt will change from C:\Windows\System32> to DISKSHADOW>, indicating you are now inside the interpreter.
Step 2: Creating a Manual Snapshot
Let’s assume you have a massive SQL database running on the D: drive. You are about to perform a risky software upgrade, and you want an instantaneous, block-level undo point before you begin.
Inside the DISKSHADOW> prompt, enter the following commands in sequence:
set context persistent- (This ensures the snapshot survives a reboot. Without this, the snapshot vanishes as soon as you exit the tool).
begin backup- (This signals to VSS and any VSS-aware applications, like SQL, that a backup is starting, forcing them to flush their data to disk).
add volume D: alias MyDatabaseSnapshot- (This adds the D: drive to the snapshot queue and gives it a friendly name).
create- (This is the trigger. The system freezes the I/O for a fraction of a second and creates the shadow copy).
end backup- (Signals that the creation phase is complete).
You have now successfully created a frozen snapshot of the entire D: drive at that exact millisecond.
Step 3: Exposing the Snapshot to Windows
The snapshot exists, but it is currently invisible to the normal Windows File Explorer. To browse the files inside the snapshot, you must “expose” it by assigning it a temporary drive letter.
Still inside the DISKSHADOW> prompt, run:
expose %MyDatabaseSnapshot% X:
Now, open Windows File Explorer. You will see a new X: drive. If you browse this drive, you will see a perfect, read-only replica of your D: drive exactly as it looked when you ran the create command. You can safely copy the database files out of this X: drive without any file lock errors.
Step 4: Cleaning Up
Snapshots consume physical disk space. As the live D: drive changes over time, Windows must store the original blocks in the snapshot storage area. If left unchecked, this will eventually fill up your hard drive.
When your backup is complete, or your software upgrade was successful, you must destroy the snapshot.
- First, remove the temporary drive letter:
unexpose X: - Then, delete the actual snapshot from the VSS system:
delete shadows exposed %MyDatabaseSnapshot% - Finally, type
exitto leave thediskshadowinterpreter and return to the normal command prompt.
Step 5: Scripting for Automation (Advanced)
Because diskshadow requires a specific sequence of commands, it can be scripted.
You can create a text file (e.g., C:\Scripts\BackupScript.txt) containing all the commands from Step 2.
You can then use Windows Task Scheduler to run the following command automatically every night at 3:00 AM:
diskshadow /s C:\Scripts\BackupScript.txt
This allows you to leverage enterprise-grade VSS snapshot capabilities using completely native, free tools built directly into Windows 11.