Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is it possible to determine whether a restore has been carried out on a file or folder from a Volume Shadow Copy snapshot?

share|improve this question
up vote 1 down vote accepted

If you mean can you tell if a file has been replaced by an older version copied from a shadow copy, then the answer is no. I suppose you could compare it's timestamp with versions in all the older shadow copies to see if one matched, but there's no system audit of retrieving a file from a shadow copy.


share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.