Restore a File from a Shadow Copy Without a Backup

TL;DR

Run **vssadmin list shadows** to see the available points, then open **Properties > Previous Versions** on the file or use **mklink /d** to browse a shadow copy directly.

Before you start

Requirements

Admin rights
System Protection enabled on the volume
10 minutes

Step by step

Instructions

Check whether shadow copies exist

Without System Protection there are no copies and nothing to restore. **vssadmin list shadows** prints the creation time and the volume for each one.

vssadmin list shadows
vssadmin list shadowstorage
Get-CimInstance Win32_ShadowCopy | Select-Object InstallDate,VolumeName,ID

Enable protection if it is off

**Enable-ComputerRestore** turns on the service for a volume. New copies appear only after changes, so this fixes the future, not the past.

Enable-ComputerRestore -Drive "C:\"
vssadmin resize shadowstorage /for=C: /on=C: /maxsize=10%
vssadmin list shadowstorage
Get-ComputerRestorePoint | Select-Object CreationTime,Description

Use Previous Versions on the file

The Properties dialog lists the copies that contain the file. **Restore** replaces the current file; **Copy** puts the old version next to it, which is the safer choice.

# right-click the file > Properties > Previous Versions
# select the timestamp > Open or Copy
Get-ChildItem 'C:\Users\me\Documents\report.docx' -Force | Select-Object Name,Length,LastWriteTime

Browse a shadow copy directly

A symbolic link to the shadow copy's DeviceObject path exposes the whole volume at that point in time. That is the only way to reach deleted files that no longer have a Properties dialog.

$s = (Get-CimInstance Win32_ShadowCopy | Sort-Object InstallDate -Descending | Select-Object -First 1).DeviceObject
$s
cmd /c mklink /d C:\shadow "$s\"
Get-ChildItem C:\shadow\Users\me\Documents | Select-Object -First 10 Name,LastWriteTime

Copy the old version out

Work on a copy, never in the shadow path. **Copy-Item** from the shadow link to a normal folder keeps the old content while the live file stays untouched.

Copy-Item 'C:\shadow\Users\me\Documents\report.docx' 'C:\Users\me\Desktop\report-old.docx'
Get-Item 'C:\Users\me\Desktop\report-old.docx' | Select-Object Name,Length,LastWriteTime
cmd /c rmdir C:\shadow

Verify the restored content and keep a real backup

Open the copied file and compare it against what you expected. Shadow copies live on the same disk, so the next step is file history or an external copy.

Start-Process 'C:\Users\me\Desktop\report-old.docx'
vssadmin list shadows
# set up File History or an external copy for the next incident

Troubleshooting

Common issues

vssadmin returns no items

System Protection is off or the volume has no restore points. Enable it now; existing files cannot be recovered retroactively.

Previous Versions is empty for a folder that exists

The copy predates the folder, or the volume is not protected. Browse the shadow copy directly to look for it.

mklink fails with access denied

The shell is not elevated, or the target path already exists. Delete C:\shadow first and retry as administrator.

The shadow copy no longer exists

Storage pressure removed the oldest copies. Restore from a real backup; VSS keeps only what fits in the reserved space.

FAQ

Frequently asked

Is a shadow copy a backup?

No. It shares the disk with the original, so a disk failure takes both. It protects against overwrites and deletions only.

Does it work on an external drive?

Only if System Protection is enabled for that volume, and only while it is connected.

Can I recover a file from months ago?

Only if a copy from that time still exists. Shadow storage is a ring buffer and old points are deleted first.

How to undo this

Delete the copy you made and, if you enabled it only for this, turn System Protection off with Disable-ComputerRestore -Drive "C:\".

Changelog · 1 entry

2026-11-01
First version

Interactive version: checklist, feedback, related guides →

Free · no account needed · tracks your progress