Windows VSS: difference between two shadow copies?

Question

I'm using the VSS api to create some shadow copies of a volume and then access them using their UNC paths.
Is it possible to get a list of some sort of just the things that changed between two consecutive shadows?

The obvious way of doing this is to go over all of the files in the volume and check for changes but there must he an easier way to do this since one of the key features of VSS is that it saves deltas of information and only saves what is changed.

Stitch

You should be able to do this with the change journal. The only step I'm not certain about is whether the shadow copies behave like real volumes, i.e., whether you can open a volume handle to the shadow copy and issue FSCTL commands. Anyway, see https://mcmap.net/q/540107/-how-can-i-detect-only-deleted-changed-and-created-files-on-a-volume for some sample code to get you started. – Crucible

Are you interested only in the case where no third-party VSS providers are present, or does the solution need to work for all cases? – Crucible

@Harry Johnston adding a new provider may be an option. How do I do that? doesn't it require a reboot? – Stitch

I'm not suggesting you write a provider, I don't see how it would help. Typically a third-party provider would (or might) be present if the volume in question is on some sort of array or other hardware with built-in shadow copy support. If your software needs to support this scenario, you can't use any undocumented features but have to stick to the documented API, so the answer is "no, VSS provides no way to do that". If you don't need to support third-party providers, then there might be some undocumented solution. – Crucible

I don't need to support any 3rd party provider. What's the undocumented solution? – Stitch

If I knew of one, I'd have mentioned it. Probably there isn't one, but only someone from the relevant team in Microsoft would know for certain. My recommendation is still to try the change journal. I'll post an answer with code for this if I get time to try it out myself, but it probably won't be in the next few days. – Crucible

A similar question (again, looping through the USN on each copy, and comparing IDs) How to compare 2 volumes and list modified files? – Livvi

Have you looked at "Remote Differential Compression"? msdn.microsoft.com/en-us/library/windows/desktop/… There may be some overlap in what you're trying to do, but RDC can generate file deltas. It's used to copy portions of a file when you've something shared in common - like binary patching vs copying. – Horvath

For the benefit of future readers, to avoid confusion: I believe @Max interpreted VSS as meaning Visual SourceSafe (a source control system, hence the comparison to Git) whereas the OP was talking about the Volume Snapshot Service (mostly used by backup software). – Crucible

Answer 1

Use a third party software like WinMerge with the shadow copy UNC paths http://winmerge.org/

This will provide a GUI for comparisons

For example, use "C:\", vs "\\localhost\C$\@GMT-2017.08.24-18.07.46"

Of course, enter a valid UNC path to coincide with the date and time of a shadow copy.

Clarisaclarise