Understanding Microsoft Volume Shadow Service (VSS): Architecture, Components, and Backup Process

VSS (Volume Shadow Service) is a Microsoft‑provided framework for application backup and recovery, implementing backup, restore, and data‑consistency protection. The overall workflow consists of two main phases: backup and restore.

VSS Introduction and Scenarios

VSS enables storage devices (e.g., disks, arrays) to create high‑fidelity point‑in‑time image copies, known as Shadow Copies. It can create these copies on multiple volumes or a single volume without impacting system performance. By coordinating applications, backup programs, and storage hardware, VSS achieves reliable snapshot creation. Typical use cases include:

Fast data backup and recovery;

File‑level restoration;

Tape backup, testing, and data‑mining scenarios.

Because VSS is integrated into the Windows OS, its functionality is modularized, providing development interfaces for storage hardware and software vendors. Developers can focus on their own modules, reducing overall design complexity.

VSS Component Description

The VSS framework consists of a core module, a Requestor, Writers, and Providers. Their relationships are illustrated in the diagram below:

Requestor

The Requestor initiates snapshot creation by enumerating Writers on the target volumes and collecting their metadata. Different requestor applications can be designed for various purposes, such as backup software, management tools, or custom business logic.

Writers

Writers ensure data consistency during snapshot creation. They pause application writes, flush buffers, close transactions, and perform any necessary preparation so that the snapshot reflects a consistent state. Common writers include Windows services (COM+, DHCP, Active Directory) and database engines.

Provider

Providers actually create the snapshot on the storage media. They can be hardware‑based (storage array), software‑based (OS), or system‑software providers supplied by third‑party vendors.

VSS Server

The VSS Server coordinates all modules and offers two snapshot creation methods: a full copy (clone) that duplicates all original data, and a copy‑on‑write/differential copy that only captures data that will change, resulting in faster snapshot creation but requiring the original data for full restoration.

Data Volumes

Data volumes are the logical disks that need to be backed up and the volumes that Writers use for copy‑on‑write operations.

VSS Creation Process

The Requestor asks VSS to enumerate Writers on the target volume and collect their metadata.

Writers describe their components via XML and define recovery methods, performing actions such as closing transactions and flushing buffers to ensure consistency.

VSS checks whether the requested volume supports snapshots and determines which Provider (hardware or software) will be used.

The Requestor instructs VSS to create a snapshot on the volume.

VSS locks the Writers to temporarily prevent new writes (read operations may still be allowed).

The Provider creates the snapshot on the disk according to the chosen method.

After snapshot creation, VSS unlocks the Writers, allowing them to resume normal operations, and verifies that any writes during the snapshot window were handled correctly.

The backup agent works with the Provider's CommitSnapshots method to ensure application‑consistent snapshots and to trigger array operations such as remote replication or snapshotting.

Since VSS itself does not expose Freeze/Thaw interfaces, the backup agent implements them:

Freeze : Triggers the VSS backup flow and pauses the Provider at CommitSnapshots while Writers flush caches and freeze I/O.

Thaw : Releases the pause on CommitSnapshots , allowing the backup process to complete.

When the VSS Server protects a protection group, it first calls the backup agent's Freeze interface to guarantee application‑consistent snapshot data, then invokes the Thaw interface to perform array operations (remote copy, snapshot) and signal backup completion.

Recommended Reading: OpenStack Technology and Practice Details

Note: Scan the QR code or search for “ICT_Architect” to follow the public account and obtain more e‑book information.

Stay curious and humble.