In the Windows Server 2003 Resource Kit, you'll find a command-line tool for working with shadow copies called VolRest. You can use VolRest to search for a file on a server and list the available versions and to locate previous versions of a file and restore those versions to a specific folder.
The easiest way to work with VolRest is to use the Universal Naming Convention (UNC) path of the server and shared folder you want to examine. The UNC path has the following syntax:
\ServerNameSharedFolderName
where ServerName is the domain name or Internet Protocol (IP) address of the server and SharedFolderName is the name of the shared folder. If you know the server and folder name,
you can search for files within the shared folder by adding the name or part of the name to the UNC pathname. Consider the following examples:
volrest \CorpSvr02EngDataQuarterlyReport.doc
Here, you are looking for previous versions of the QuarterlyReport.doc file in the EngData share on CORPSVR02.
If you know only part of the name, you could use wildcards as well, such as follows:
volrest \CorpSvr02EngData*Report.doc
Here, VolRest would return any files whose names end in Report.doc. It is important to note that VolRest searches aren't case-sensitive. This means you could type volrest \CorpSvr02 EngData*report.doc or even volrest \CorpSvr02EngData*REPORT.DOC.
The output from VolRest shows each available version of the file according to the timestamp of the snapshot, such as follows:
10/01/2004 09:05 AM 65,203,203 \[email protected] 12.05.09quarterlyreport.doc 10/02/2004 03:42 PM 65,224,896 \[email protected] 07.12.34quarterlyreport.doc 10/03/2004 08:35 AM 64,123,083 \[email protected] 12.20.12quarterlyreport.doc 10/04/2004 12:35 PM 67,965,072 \[email protected] 07.30.23quarterlyreport.doc
Here several versions of the file are available. The first was last modified on 10/01/2004 at 09:05 A.M., the second was last modified on 10/02/2004 at 03:42 P.M., and so on. The large number following the last modified time stamp is the size of the file in bytes. Finally, the file path includes the date and time stamp of the snapshot. This is the time when the snapshot of a particular file version was made.
Additionally, if you mapped a network drive to a share, you can use the drive designator instead of the UNC server and file share name. For example, if you mapped \Eng08EngData to the X drive, you could search for versions of QuarterlyReport.doc by typing volrest x:quarterlyreport.doc or volrest x:*report.doc.
If you want to restore these versions of the file to another location, you can use the /R parameter to specify the folder to which the files should be restored. The syntax is as follows:
volrest \ServerNameSharedFolderNameFileName /r:RestorePath
where RestorePath is the local or network path to the folder to which you want to restore the file's versions. Consider the following example:
volrest \CorpSvr02EngDataQuarterlyReport.doc /r:c:data
Here, you restore previous versions of QuarterlyReport.doc to the C:Data folder. By default, each version of the file after the first is sequentially numbered. In this example, that means the files would be named as follows:
QuarterlyReport(Friday, October 1, 2004, 12.05.09).doc
QuarterlyReport(Saturday, October 2, 2004, 07.12.34).doc
QuarterlyReport(Sunday, October 3, 2004, 12.20.12).doc
QuarterlyReport(Tuesday, October 5, 2004, 07.30.23).doc