Why do shadow copies take up little space?

Question

Backup

There is a shared folder that is occupied by 1.65 TB, a 2 TB hard drive was recently connected to store shadow copies of the shared folder, according to the schedule, copying is performed once an hour, but the total amount of shadow copies is now 7 GB,
The essence of the question is: what exactly gets into shadow copies, only file changes?
If you take and delete the entire ball, the copies will not save you, there is no information about this.

Answer 1

To understand how shadow copies work, you need to understand why they are needed at all.
The main problem with regular copying is that it takes a long time, and the file cannot be changed all this time.
If you need to copy a 200GB file, it will be copied for several tens of minutes, and you cannot work with it during this time, otherwise the copy will be damaged.
This problem is solved by shadow copying, it works as follows -
At the moment of creating a shadow copy, all accesses to that volume are blocked - in general, everything.
Everything that was cached in RAM, the entire write buffer, is forcibly flushed to disk.
After that, everything - absolutely all files on the volume are locked for writing, from that moment it is impossible to change them .
That's all - the shadow copy is created.
After creating a shadow copy, only changes are written.
The shadow copy creation time is a fraction of a second.
The size of the volume and the amount of data on the volume in no way affect the timing of the shadow copy.
That is, it makes absolutely no difference to make a shadow copy of 2 megabytes or 20 terabytes - the time to create a copy will be the same.
The amount of data on the disk does not increase during shadow copy creation.
That is, in fact, the shadow copy does not copy anything.
All this is difficult to understand without understanding how the file system works.
The file system has such a concept - a cluster.
This is the minimum block of information that the FS works with.
As a rule, it is equal to 4kb.
You are writing a 1kb file to disk - it will take up 4kb on disk.
That is, a cluster.
And it will be written to the FS database that such and such a file is located in such and such a cluster.
If you write a 400kb file, it will take up 100 clusters on disk.
There will be a record in the file system database that a file such and such occupies clusters at such and such addresses - and all one hundred addresses of all clusters are listed.
After creating a shadow copy - these clusters are not touched.
All information that is recorded and changed is written to other clusters.
And information is read both from old clusters and from new ones.
That is, the files in the file system database are simply a list of cluster numbers that contain this information.

Answer 2

MS allows the VSS provider to use one of three methods ( technet ):
Complete copy - a complete read-only copy of the volume is made.
Copy-on-write - the old contents of the changed volume clusters are transferred to the shadow partition, the changes are written to the main volume. This method is used in the standard windows provider.
Redirect-on-write - cluster changes are written to the shadow partition, the main volume is not changed.