Samba and MS Shadow Copy

Ken Cross kcross at
Tue Aug 5 17:27:09 GMT 2003

It's data about Shadow Copy volumes, so it could be any of them.  How 'bout

Attached is a capture of a Win XP client ( getting Shadow Copy
data from a Windows 2003 Server (  Filter on SMB packets.  Look
at packets 399-402 and 431-440.

Restoring a file (or directory) isn't a special operation.  When your VFS
module converts the name sent from the client from:




it acts just like a regular file operation.  Renaming the file is the key.
It's made easier by the fact that all Shadow Copies (snapshots) are


Ken Cross

Network Storage Solutions
Phone 865.675.4070 ext 31
kcross at 

> -----Original Message-----
> From: Stefan (metze) Metzmacher [mailto:metze at] 
> Sent: Tuesday, August 05, 2003 1:05 PM
> To: Ken Cross; 'Multiple recipients of list SAMBA-TECHNICAL'
> Subject: RE: Samba and MS Shadow Copy
> At 12:53 05.08.2003 -0400, Ken Cross wrote:
> >No problem -- all sounds very reasonable.
> >
> >I couldn't find any name from MS for this FSCTL function, so I just 
> >made one up.  If anyone know a better one, please feel free 
> to use it.
> Ok, should I use
> BTW: can you send me a trace of all possible calls and maybe 
> restoring a file
> metze
> --------------------------------------------------------------
> ---------------
> Stefan "metze" Metzmacher <metze at> 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: WIN6 3 Snaps.cap
Type: application/octet-stream
Size: 109677 bytes
Desc: not available
Url :

More information about the samba-technical mailing list