For example, the file in question is:
"\\svr2003\serverdata\sales\2013\Sales report sep 2013.doc"
Open a command prompt and type:
volrest “\\svr2003\serverdata\sales\2013\sales report sep 2013.doc”
This gives us a list of the shadow copies available for that document. Wildcards can also be used.
EG: we could also have used:
volrest “\\svr2003\serverdata\sales\2013\*report sep 2013.doc”
volrest “\\svr2003\serverdata\sales\2013\*report*”
volrest “\\svr2003\serverdata\sales\2013\*”
The switch /s searches subfolders as well. The command below will list all shadow copy files for the share serverdata.
volrest /s “\\svr2003\serverdata\*”
We can see the date time the file was modified, size, and the time the shadow copy was created.
To restore, use the command:
volrest “\\svr2003\serverdata\sales\2013\sales report sep 2013.doc” /r:\\svr2003\serverdata\sales\2013\restored”
This will restore all the sales report sep 2013.doc copies available to a subfolder called restored. If the restored folder doesn’t exist, it will be created.
The files are restored in reverse time order. Eg: the newest files are created first, and subsequent files are renamed (1), (2), etc.
In the example above, the 287Kb file is called Sales report sep 2013.doc, and the 6Kb file is called Sales report sep 2013(1).doc
Reference: http://technet.microsoft.com/en-us/library/cc780410(v=ws.10).aspx
http://www.windowsdevcenter.com/pub/a/windows/2004/07/20/shadow_copies.html
