What is vssvc.exe and Why is it Running?

In Windows, if you check the task manager at different intervals, you may notice a process “vssvc.exe” running with a fair amount of CPU or Hard disk usage. By moving the mouse pointer over to the process, it displays “Windows Volume Shadow Copy Service”.

This process is not always running and is triggered by predefined events in order to make a copy of your hard drive depending on the number of disks plugged into your computer. According to Microsoft:

VSS is a set of COM interfaces that implements a framework to allow volume backups to be performed while the applications on a system continue to write on volumes.

To talk in simple terms, this service constantly keeps backing up your data even if you are using the hard drive.

What is the Difference between Hard Disk Backup and Hard Disk Image?

Most of you reading this article might have a very good idea what a backup is. We regularly backup our data (files, photos, videos, documents etc.) using different utilities with the intention of creating and retaining the latest possible copies of important files and folders. Hard Disk Backup is directly associated with backing up files and data present on your computer.

On the other hand, we create an image of your system drive (or another hard disk) so we can use it in an event of a corrupt operating system. But why is this service even implemented? Think of a scenario where your operating system crashed and along with it, you have to configure and install all the other applications which you were using on your computer. It will take days and even weeks for you to get your PC back to the state when it crashed.

Furthermore, you would even have a problem with entering all the License keys and the hassle of downloading all the software all over again. Now if you have an image of your hard drive, you would only boot using the image and restore the system drive back to the state when it was last imaged. Thus, disk imaging is more about backing up system files rather than user data.

To summarize, if you back up your data, you would be creating an image of them (pictures, videos, documents etc.). When you restore your data, it means you will retrieve all the items which were saved in the backed up data. If you create an image of the system, you are storing all your user configurations, installed programs, the registry values etc. When you restore the image, it means you will retrieve the last state of the system when the image was created.

What are the mechanics of Volume Shadow Copy in Windows?

When you open a folder’s properties, you might notice a tab “Previous Versions”. You may have used this option in the past to restore folder settings or even restore the contents present inside it. Similarly, you might have heard of System Restore which is used restore your computer to a previous state. Of course, some settings will be lost which are made after you made a recent restore point on your computer.

The VSS service is also used by third-party programs. On its own, VSS service only starts by some predefined triggers to create an image of the system drive and also other drives present on your system. If all your drives are of the same type i.e. NTFS, the service will take a single snapshot. If they are of different models or types, several different snapshots are taken. They stored in a protected location on your system with a header file consisting of the time stamp and the unique ID assigned to it.

How does VSS create a Snapshot?

There are three important functions which VSS uses to produce a snapshot.

Freeze: For a moment, the Hard Drive which is being backed up goes into a read-only state. This is done so nothing can be written while the backup is in process.

Snap: The drive is imaged with parameters necessary to reconstruct the snap in the future.

Unfreeze: The Hard Drive is released so data can be written into it once again. But since VSS states that you can continue using the hard drive while the backup is being produced, the data may be stored in some buffer until the drive is ready to be written on again.

The entire process is very fast and it only takes a minute according to Microsoft.

What are the main Features of VSS?

Volume Shadow Copy Service in Windows has two main features:

1. It operates side by side with existing applications and doesn’t interfere with them when it is creating a backup image.
2. It provides an API (Application Programming Interface) for third-party programs to create an image and restore a volume, if needed, from the snapshots saved in the near past.

This implies that many third-party programs use this service for imaging hard drives and readily employ it in their operation.

The Verdict: Should you Disable VSS?

The answer is no. According to official statements and real-time monitoring, it seems that VSS doesn’t consume that much CPU and is indeed beneficial for the end user. It backs up your system drive and is a lifeline if anything goes wrong with your PC. Disabling VSS also means that you will be stripping some applications of the functionality to restore their data from a previous restore point if something unexpected occurs.