How do you create a Writable VSS Snapshot?

Question

This implies you can create a writable vss snapshot: Usability limit for Volume Shadow Copy Service (VSS) in Windows

But how do you do it? I've played around with things, I can get a FAT/FAT32 partition VSS snapshot to be writable by removing the read-only flag on the volume, but for NTFS it reports ERROR_WRITE_PROTECT

Could you share what you have done? Like steps, use tools or winapi and on Windows server or client? — Rita Han, Jan 17 '20 at 06:35
It be helpful if you could provide a sample that is writable using as a VSS requester via IVssBackupComponents. InitializeForBackup, SetContext, SetBackupState, GatherWriterMetadata, (deal with components), StartSnapshotSet, AddToSnapshotSet, PrepareForBackup, DoSnapshotSet. Get volume from vsobjprop.Obj.Snap.m_pwszSnapshotDeviceObject, use that handle for Win32 functions. Or just what step I need to add/do to make it writable (besides removing read-only attribute from volume, which already did and works for FAT/FAT32). — df234987, Jan 17 '20 at 20:02

score 0 · Accepted Answer · answered Jan 18 '20 at 08:10

0

Shadow copies are read-only. It requires additional operation if you want to convert a shadow copy to a read/write LUN.

IVssBackupComponentsEx2::BreakSnapshotSetEx with VSS_BREAKEX_FLAG_MAKE_READ_WRITE option can make the shadow copy LUN be exposed to the host as a read-write volume.

For an example you can refer to official sample: VShadow Volume Shadow Copy Service sample. Use -bw command to break the shadow set into writable volumes.

answered Jan 18 '20 at 08:10

Rita Han

9,574
1
11
24

that's sorta what I thought, but when I tested on FAT32 partition, it was great! I could simply remove the read-only volume flag and modify the snapshot (if I turned on the read-only bit on the volume again, those modifications were lost, but leaving it off worked). Any thoughts on how the team may want to enable that type of support for NTFS? – df234987 Jan 20 '20 at 01:46

score 0 · Answer 2 · answered Jan 29 '21 at 16:47

keeping hardware luns (and the associated BreakSnapshotSetEx) aside, there are 2 potentials ways in which one could get hold of a writable snapshot in a purely software way. First one is to write a custom VSS writer and expose the OnPostSnapshot event handler. This is where the snapshot becomes writable first immediately after vss creates it so that all involved writers could do their specific rollback corrections on the snapshot device. The second one is to write a block device driver driver that layers a writable differencing image on top of a read only persistent snapshot device.. much like how differencing virtual disks work.

How do you create a Writable VSS Snapshot?

2 Answers2