# Backup Internals: What is VSS, how does it work and why do we use it?

As happens sometimes, our more technically minded customers question a system that “just works”. We like these sort of customers, as they keep us on our toes. In this specific case, the question was [is it safe to continue using my computer during imaging](https://support.macrium.com/topic.asp?TOPIC_ID=4968&whichpage=1) and the answer is yes, although the longer explanation is much more involved. After the ensuing discussion, one of our community members suggested we write this information up as a FAQ entry somewhere and internally we felt it was worth preserving the information from that thread, so this blog post is an extended, polished version of our notes there.

### Reflect can take an image of a live system. How does this work?

![backup-internals-what-is-vss-how-does-it-work-and-why-do-we-use-it.jpg](https://strapistoragemacrium.blob.core.windows.net/strapi-uploads/uploads/backup_internals_what_is_vss_how_does_it_work_and_why_do_we_use_it_b601339115.jpg)

#### A simple disk write

Internally Macrium Reflect relies on a Microsoft Windows component called VSS, which stands for Volume Shadow Storage. Microsoft’s VSS operates by taking what is called a copy on write snapshot of your system. This allocates a small temporary storage space. Then, every time you write to a part of your disk, the information on the disk is first copied to the snapshot before allowing the write to take place.

![backup-internals-what-is-vss-how-does-it-work-and-why-do-we-use-it-2.jpg](https://strapistoragemacrium.blob.core.windows.net/strapi-uploads/uploads/backup_internals_what_is_vss_how_does_it_work_and_why_do_we_use_it_2_2b2e865126.jpg)

#### VSS in use

This technique makes VSS quite efficient. A snapshot only contains as much data as has changed since the snapshot started — you do not need an entire copy of your disk. Also, writes are only affected for used space — free space does not need to copy anything, as there is no original to preserve.

![backup-internals-what-is-vss-how-does-it-work-and-why-do-we-use-it-3.jpg](https://strapistoragemacrium.blob.core.windows.net/strapi-uploads/uploads/backup_internals_what_is_vss_how_does_it_work_and_why_do_we_use_it_3_d78810a2c9.jpg)

### Reading data

However there is another side to this advantage. The more writes made after the snapshot springs into existence, the more VSS must store. So if you perform an excessive amount of disk activity during imaging, the snapshot storage space may become large. VSS imposes a cap on this space, and should a snapshot attempt to exceed it, VSS will stop its copy on write behaviour and delete the temporary storage.

Once the snapshot is finished with, the space can be freed up again — so the temporary storage space is only needed during use.

### What determines where this storage space is?

There is no magic to this — VSS chooses sensible defaults based on your available drives. This configuration can of course be altered and Microsoft provide a tool for this called [VSSAdmin](https://technet.microsoft.com/en-us/library/cc754968%28v=ws.10%29.aspx).

### Is the data taken at a point in time really consistent?

This is a difficult question to which there is no straightforward answer. As you may have realised already, if a copy is in progress when the snapshot starts, only the completed part of the copy will be included in the snapshot. The rest of it will count as new writes and the old, inconsistent blocks will be copied to the snapshot!

To understand how VSS gets around this we need to understand a little more about VSS architecture so I’ll introduce three terms:

*   **Provider**: in VSS land, a provider provides the VSS service and is responsible for all the co-ordination elements. Essentially this is the “core” of VSS. Microsoft include a VSS Provider with Windows, and Reflect uses this. (Technically speaking, there are two components, the co-ordinator and the provider, however, for simplicity we have combined these for the purposes of explaining VSS.)
*   **Requester**: a requester is, as you might expect from the name, an application that requests a snapshot to be made. This request goes to the provider.
*   **Writers**: these components provide a mechanism for applications to be alerted to the creation of a snapshot, so they can prepare their data for snapshotting. VSS providers can notify VSS writers that a snapshot has been created, and the VSS writer can then perform the appropriate action. Once the snapshot has been taken, the provider again notifies the writers, so they may let the applications resume.

VSS Writers are an important part of VSS for certain environments. Imagine you are running a heavily loaded database server in production, or a virtual machine cluster. The database server will have open and be manipulating its database files, processing transactions etc. while the VMs are continually performing disk operations for the virtualised OS. Taking a point-in-time snapshot might be fine but, due to the amount of IO, it is likely to catch one or more of these services off guard in an inconsistent state.

The role of writers is to inform these applications a snapshot is about to be created. The application can then perform any tidy up operations necessary to ensure what is on disk is consistent. The snapshot starts and the applications are then notified they can continue. Now the on disk state should be fine.

### When do I need to check my applications are VSS aware? I.e. when do I need VSS writers?

You need VSS writers for applications that perform large amounts of IO and depend heavily on the state of the files they are writing if you wish to back them up. Virtual machine disk images are a perfect candidate for this — the running image could easily become inconsistent.

Most applications do not write to disk in quantities of data large enough to be a problem. Many applications from Microsoft are also VSS aware, which helps greatly.

### What about current and previous snapshots?

VSS is smart enough to keep track of its temporary storage location, and will exclude anything in it, including the current temporary storage area and any persistent snapshots that have been previously created. So when the data is read by your backup software, you only get what you need.

### When is VSS in use and when is it not with regards to taking a backup?

Now a question you may not have thought of — when is VSS in use? Well, VSS solves the problem of imaging a live system neatly, so whenever you image your system with Reflect you are probably using VSS.

There is one exception to this — we have a fall-back mechanism for live versions of 32-bit Windows client operating systems up to Windows 7 (so XP, Vista and 7) called pssnap.sys. Reflect can use this on these systems if VSS is unavailable. pssnap provides the same copy-on-write technique as VSS, but with fewer extra features (pssnap.sys is not a VSS provider and is independent from VSS). Why have both systems? Well, VSS is a core component of Windows and available on every edition of Windows greater than XP SP2. We know it will be there as Microsoft are committed to this feature and it makes sense to use it as it is highly reliable. Before VSS we had no such mechanism so we built our own. It is equally as reliable but we felt the feature additions of VSS and the support for writers for enterprise scenarios really meant VSS made sense.

However in the rescue environment we do not use, or need to use, either pssnap.sys or VSS. Why? Because the system is not in use so the data should be perfectly consistent at all times. Of course we may well end up including persistent snapshots if they exist because without VSS they are not excluded.

### You keep saying VSS is a Windows feature, yet only Reflect uses it…

Actually, that’s not true. Windows itself uses VSS for system restore points! These system restore points are the persistent snapshots that might exist in your shadow storage.

That’s it. If you’d like to read about VSS directly from Microsoft, you can read their article on [TechNet](https://technet.microsoft.com/en-us/library/cc785914(v=ws.10).aspx).

You can download a 30-Day Trial of Macrium Reflect [Home](/products/home), [Workstation](/products/business/standalone/workstation), [Server](/products/business/standalone/server), [Server Plus](/products/business/standalone/server-plus), or [Site Manager](/sitebackup).

backup-internals-what-is-vss-how-does-it-work-and-why-do-we-use-it.jpg

A blog describing what VSS is and how we use it.

What is VSS, how does it work and why does Macrium use it?

As happens sometimes, our more technically minded customers question a system

Backup Internals: What is VSS, how does it work and why do we use it?

# Customer support the Macrium Way

**Customer support is one of those odd things for a business. It is a direct cost to the business and doesn’t bring in revenue that directly impacts the bottom line, yet customers have high expectations that when something goes wrong, there is someone they can turn to to help them out. Companies that recognise the importance of helping and supporting their customers only stand to benefit.**

Without a doubt, customer support is something that is ingrained in the culture at Macrium. Every day, everyone at Macrium is responsible for engaging with our customers and answering queries and technical problems they have. In this blog I wish to share with you how we go about dealing with support and show how we offer what we hope is a unique and excellent experience for our customers.

## What we offer

There are several ways that our customers can get help if they are having problems with Macrium Reflect. If it is simply a case of how to do something, then there are a selection of video tutorials on [Youtube](https://www.youtube.com/macrium). They do not have any sound, but this is something we are hoping to address in the future.

There are also many HowTo style articles in our [knowledge bas](https://knowledgebase.macrium.com)e as well as some more in-depth articles on error codes that may be encountered, the subtleties of how Reflect handles different types of hardware configurations and some of the more edge case scenarios that may be chanced upon. 

Customers who have bought Macrium Reflect have access to the [Macrium Forum](https://forum.macrium.com). The purpose of the forum is to give Macrium users the opportunity to help each other out as well as share and discuss ideas and concepts about backup and imaging. We regularly check the forum, answering questions and offering solutions to any unanswered posts as quickly as possible.

If a customer is unable to get the solution to their problem from the outlets above, the last stop is to email support directly. We get all sorts of email requests from simple prospective sales questions to in depth technical issues. Regardless of its type, each case is careful reviewed, discussed and more significantly, answered by the software developers who wrote the software.

## How we deal with support

Technical support is handled by the software developers who wrote the software. This guarantees that we can offer a qualified answer straight away. There is no triage system. There is no 1st, 2nd, 3rd or nth level support whose primary goal is to either pretend that the people dealing with the customers know what they are talking about when they don’t or delay the customer, hoping they will go away. At Macrium, you get straight through to the experts who can answer the question directly.

![customer support meeting](https://strapistoragemacrium.blob.core.windows.net/strapi-uploads/uploads/customer_support_the_macrium_way_9741432175.jpg)

Every morning, the development team meet to discuss the support cases that has come in during the night. This gives us the opportunity to discuss specific cases in detail and propose the best solutions. It also allows us to share knowledge throughout the team. The support cases are then assigned to individual engineers who respond directly to the customer. From an engineer’s point of view it is nice to have contact with the people who actually use the software we are writing. Some support issues are also fed back into the product. They may have come about because of a bug in the software or suggest that a part of the product is not clear or easy to use. Since it is the developers dealing with the support issue, a fix can be incorporated back into the product straight away if necessary. Similarly, questions that crop up frequently can be addressed by writing a knowledge base article, improving the knowledge base for our customers and also allowing us to reply with a detailed response in a much more timely and consistent manner.

Some have criticised us for not offering telephone support. On the face of it, this is a fair criticism, but have you ever received good or excellent service from a telephone support line that doesn’t come with a premium price tag? Being put on hold, transferred to another person or department and being fobbed off with scripted answers that doesn’t answer the question are all common place on telephone support lines. This is not the Macrium Way and we feel that by having the time to consider each problem as it arrives by email allows us to provide an answer that is both personal and technically excellent. This is the least we feel our customers deserve.

Without customers, Macrium would not exist and it is our goal to ensure that any customer who encounters a problem with Reflect is answered with a solution as quickly as possible.

technical-support-the-macrium-way-1.jpg

Customer support is one of those odd things for a business. It is a direct cost to the business and doesn’t bring in revenue that directly impacts the bottom line, yet customers have high expectations that when something goes wrong, there is someone they can turn to to help them out. Companies that recognise the importance of helping and supporting their customers only stand to benefit.

Macrium Technical Support 2012

Customer support is one of those odd things for a business. It is a direct cost

Customer support the Macrium Way

# Technician’s License: Reflect as a portable application

One of the long standing requests for Macrium Reflect is the ability to be able to image any system, regardless of whether Reflect is installed. Our Technician’s License offering previously gave you a key that would let you install on any number of PCs, but running installers is cumbersome, especially if you work with PCs that are not yours.

What you really need is something like this:

![Screenshot of Technician's USB via Autoplay](/no-image-to-display.jpg)

There are some unique challenges running Reflect in a portable mode. But first, what does the Technician’s Application get you? What should it get you? As it stood, we could already create PE-based USB sticks which would boot and allow you to image any system; to this, we’ve added a copy of Reflect that can be used from a live system.

That means given one USB stick, you can either boot up the PE environment to rescue a system, or insert the stick and image/restore a live system. If you’ve purchased a technician’s license and are connected to the internet, you should see this option in your recovery screen:

![Option to create technician's USB](/no-image-to-display.jpg)

How do you know you’re going to get this option? If you’ve purchased a technician’s license, this now shows up on your splash screen:

![Splash screen showing technician's word](/no-image-to-display.jpg)

If you check this option, Reflect will be copied to the USB stick along with all the files it needs to run.

So, what are the challenges of running Reflect from a USB stick? Well, here’s some of our modifications to Reflect to make it work:

*   The portable version of Reflect acts in a similar manner to the PE version — it’s essentially a cut down version without features such as loading backup definitions, because these can’t be reliably found (this could be any computer, after all).
*   The portable version must not touch the local system. So, all logging is disabled and registry is read only — if you have settings, these will be loaded, but if you don’t, the usual defaults will apply.
*   Unlike the PE version, VSS must be used as the volumes are online.
*   Licensing. We added a variety of technician’s mode checks to the licensing. Internally, we had discussions about issuing specific technician’s mode keys, but we decided this was inconvenient for large numbers of our customers who already have a technician’s license — so we decided an easier method was to make this part of the activation process. You’ll need to run an online activation to enable the technician’s features and you’ll need to be online when creating a technician’s USB stick (but not any other type of rescue media) so we can validate the license. We decided this was not hugely inconvenient — once done, the stick can then be used offline for the duration of the license.
*   Standalone services — previously, internal components of the application required the presence of ReflectService to run. Clearly, we cannot assume ReflectService is there, so we adjusted some of our components to compensate.
*   Stick removal and executable memory mapping. This one’s a bit technical, but basically standard executables are not designed to be run from media that might then be removed — luckily, we can (and do) cope with this via some special magic.

That’s it. Now, you can take the USB stick, insert it into a PC and run Reflect with all the essential backup/restore features you need:

![Reflect Technician's mode in operation](/no-image-to-display.jpg)

I left off one killer feature, though — because it’s a good one. If you’re used to using Reflect on systems that use, for example, RAID controllers, you’ll know you often need to add drivers to the rescue media in order to boot. With the Technician’s USB, we’ve enhanced that functionality — the copy of Reflect that runs on the live system can take drivers from the live system for unsupported devices and add them to the USB stick, making them available for the bootable environment that’s also on the stick!

![Driver Injection Dialog](/no-image-to-display.jpg)

That’s it for the current iteration of the Technician’s USB stick — however, stay tuned, we’ve other developments in the pipeline. We’ll be rolling this functionality out shortly — keep an eye out for a new update.

**When will it be ready?**

Shortly. We’re just going through the final testing phase before releasing this gradually to customers with a Technician’s License.

**Update 26/09/2012**: This functionality is now live in the latest release for customers with a technician’s license.

One of the long standing requests for Macrium Reflect is the ability to be able to image any system, regardless of whether Reflect is installed.

Macrium Reflect as a portable application

One of the long standing requests for Macrium Reflect is the ability to be able

Technician’s License: Reflect as a portable application

# Virtual Disk Drivers, UAC and NT

Macrium Reflect, as you may know, has the ability to mount your backup images as drives in Windows Explorer. We do this via a device driver which presents your image as a disk drive to the system.

One of the major wishlist items for Reflect has been a standalone installer for our image mounting product. Conceptually, this isn’t too hard to do, except our driver was never really written for that purpose; so as part of the work developing this product, I made quite a number of modifications to the driver, including adding support for the mount manager and plug ’n’ play support so that our images are ejectable along with any other removable medium.

**First Problem: UAC, or, why DefineDosDevice does not play with Vista or greater**

The traditional route for creating drive letters was to do something like this:


```
TCHAR VolumeName\[\] = \_T(“Z:”);  
TCHAR DeviceName\[\] = \_T(“\\Device\\VDisk1”);

if (!DefineDosDevice(  
DDD\_RAW\_TARGET\_PATH,  
&VolumeName\[4\],  
DeviceName  
))  
{  
// error case  
}  
```

However, be aware — this does not work with UAC; at least, not as expected. Firstly — DefineDosDevice creates a symbolic link from a given drive letter to your device. In principle, this is exactly what you want to achieve; however, depending on who you are depends on where the link is created:

*   NTAUTHORITYSYSTEM: link is created in \\GLOBAL??
*   Administrator running as elevated — link is created in the elevated user’s session space
*   Administrator running as normal privileges — link is created in the normal user’s session space

So, depending on who you are depends on how visible your drive letter is. For example, if you create the drive as an administrator running as a normal user, when you run explorer in elevated mode you won’t be able to see the drive! Conversely, drives created from an elevated mode are invisible to the non-elevated users.

This situation arises because as of Windows Vista, DosDevices are by default local to your current session and with UAC enabled, an administrator user logs in with two sessions — one with the privileged administrator token and one with the filtered normal privileges token.

By constrast, NTAUTHORITYSYSTEM can DefineDosDevice into the \\GLOBAL?? space, which is the behaviour for all users on Vista.

So the first challenge — how to make a device accessible to normal, unprivileged users. Normally, they cannot DeviceIoControl to devices with the default permissions. Luckily, using a SDDL string, we can describe the device’s permissions:

```
RtlInitUnicodeString(&usSDDL,  
\_T(“D:P(A;;GA;;;SY)(A;;GA;;;BA)(A;;GA;;;BU)(A;;GA;;;WD)”));

ntStatus = IoCreateDeviceSecure(  
pDriverObject,  
sizeof(DEVICE\_EXTENSION), // we defined this structure  
&usDeviceName, // name of device.  
FILE\_DEVICE\_DISK, // Present disk device  
FILE\_DEVICE\_SECURE\_OPEN, // don’t allow trailing names.  
FALSE,  
&usSDDL, // security descriptor  
NULL,  
&pDeviceObject  
);  
```

Just for interest’s sake, if you’re lost as to what I’m talking about — download WinObj and have a poke around. You should be able to find all your sessions and symlinks:

![Screenshot of the WinObj program in operation.](/no-image-to-display.jpg)

So, getting this far we can mount a device either for the unprivileged administrator, or for the privileged one. Alternatively, we can run a service and create a symlink as NT AUTHORITYSYSTEM.

This is not a particularly polished solution, although it does work.

**Second Problem: The NT Mount Manager**

Now, whilst DefineDosDevice works, for all intents and purposes, we’re not really obeying NT’s management of volumes at all. To do this properly, we really need to use the NT Mount Manager. Three messages matter:

*   IOCTL\_MOUNTMGR\_VOLUME\_ARRIVAL\_NOTIFICATION — let the mount manager know we’ve arrived.
*   IOCTL\_MOUNTMGR\_CREATE\_POINT — create a mount point, e.g. a drive letter.
*   IOCTL\_MOUNTMGR\_DELETE\_POINTS — Undo CREATE\_POINT.

Using these, and responding appropriately, we can create a volume via the mount manager which will show up in the global win32 devices namespace as \\GLOBAL??Volume{GUID} and appear as a link \\GLOBALX: -> DeviceTarget.

Combined with IoCreateDeviceSecure, this allows us to receive messages from our userland-side code, e.g. Reflect, and let Windows know a volume has arrived. We can then remove it when the times comes for this, too.

This has a number of advantages over the Windows 9x-era solution set:

1.  Works with UAC. This is a really crucial part of modern Windows, and requiring customers disable it would be poor. Similarly, we should be able to mount images from both elevated and normal states, which we now can.
2.  Delegates handling drive letters to Windows. Although we might request a certain letter, Windows knows if these have already been allocated or it cannot hand us one for some reason — and sorts that out for us.
3.  Plays correctly in every other possible way with Windows Volume Management, should we wish to support these features in the future.

What would I like to bring in next? **Plug and Play support**. It would be great to be able to eject images from the PnP manager as if they were devices. Oh, and we have some other ideas in progress too.

Macrium Reflect, as you may know, has the ability to mount your backup images as drives in Windows Explorer. We do this via a device driver which presents your image as a disk drive to the system.

Virtual Disk Drivers

One of the major wishlist items for Reflect has been a standalone installer for our image mounting product. Conceptually, this isn’t too hard to do, except our driver was never really written for that purpose.

Virtual Disk Drivers, UAC and NT

Your #1 resource for data backup, recovery, imaging and deployment insights and tips to help you develop your organisation's disaster recovery plan. | 2012

Cart

Macrium Software

Latest Blog Post

Latest Video

Need Help?