guide · static export
PC

Recover a File from a Volume Shadow Copy

Previous Versions, the mount trick for files Explorer refuses to hand over, and how to keep copies from silently disappearing.

by@guidox updated:10/31/26 time:15 min level:Beginner tested on:Windows 11 24H2 works on:Windows 10, Windows 11 tools:Command Prompt as administrator, File Explorer
TL;DR

Open **Properties > Previous Versions** on the folder, or mount the shadow copy with `mklink /d` and copy the file out. Shadow copies exist only when System Protection or a backup tool created them.

Before you start

Requirements

  • Admin rights
  • System Protection enabled
  • Fifteen minutes
Step by step

Instructions

01

Check whether copies exist at all

The list names every shadow copy on the volume with its creation time. An empty list is an answer, not a fault: nothing was ever captured for that drive.

vssadmin list shadows /for=C:
02

Use Previous Versions first

For a normal folder the shell does the work: pick the timestamp before the mistake, open the file, and copy it out. Never restore the whole folder over the current one.

Right-click the folder > Properties > Previous Versions
tipCopy, do not Restore, unless you are sure the whole folder should go back to that state.
03

Mount the copy when the shell refuses

A shadow copy is a device path, not a folder. Linking it makes it browsable, and everything inside is read-only by design.

mklink /d C:\shadow \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy3\
⚠ warningThe number comes from the vssadmin list and changes with every new copy. The trailing backslash is required.
04

Copy out what you need

The linked folder behaves like any other directory. Take the single file and leave the rest, because the link points into a snapshot that ages out of the pool.

copy C:\shadow\Users\you\Documents\file.docx C:\Users\you\Desktop\
05

Remove the link

Deleting the link removes only the shortcut. The shadow copy itself disappears when the storage area rotates it out, not when you unlink it.

rmdir C:\shadow
06

Keep the copies from vanishing

By default the storage area takes what it can and the oldest copy is discarded first. A fixed cap makes the retention predictable.

vssadmin resize shadowstorage /for=C: /on=C: /maxsize=10%
tipTen percent of the volume keeps a handful of restore points on a normal desktop. More space means more history, not more safety.
Troubleshooting

Common issues

The Previous Versions tab is empty

System Protection is off for that volume, or the copy was rotated out. Turn it on so the next mistake has a way back.

The shadow copy disappeared

The storage limit was reached and the oldest copy was deleted. That is the normal rotation, not a failure.

mklink reports access denied

The link needs an elevated command prompt, and the target directory must not exist yet.

The file is not in any copy

Check File History, the OneDrive recycle bin and Windows Backup. Shadow copies are not a backup.

FAQ

Frequently asked

Is a shadow copy a backup?

No. It lives on the same disk and is deleted under pressure. A drive failure takes it with everything else.

How long are copies kept?

Until the storage area fills. There is no fixed retention time, only the size cap.

How to undo this

Nothing to undo beyond deleting the mklink folder. Restoring a file means overwriting the current copy, so keep the broken version under another name first.

Changelog · 1 entry
  1. 2026-10-31
    First version
Interactive version: checklist, feedback, related guides →

Free · no account needed · tracks your progress