>

List Shadow Copies (Restore Points) with vssadmin

Check which volume shadow copies exist on a drive from the command line — know if Previous Versions can bring a file back before you give up.

Windowsbackupcmdsystem-restoreMedium risk
Run vssadmin list shadows /for=C: in an admin Command Prompt; each entry shows a creation time you can recover files from.

01Command

Command
$ vssadmin list shadows /for=C:

02What it does

Windows' System Restore and the 'Previous Versions' right-click option both run on volume shadow copies — hidden snapshots of files at points in time. vssadmin list shadows /for=<drive> shows every snapshot on that volume with its creation time and the device path it lives at. If a shadow exists from before you overwrote a file, you can browse it in Explorer via Properties > Previous Versions or mount it. This is also the honest way to learn that System Protection was never enabled and nothing can be restored.

03Risk

RiskMedium risk
RequirementsRun Command Prompt as administrator. Shadow copies need System Protection enabled on the drive.
!Warning: Shadow copies are not backups — they're sparse snapshots that old age and disk pressure erase automatically. vssadmin delete shadows removes them permanently; don't confuse it with list.

04Undo

✓No undo needed — this command does not change persistent state.

05Sources

  • vssadmin
    Microsoft Learn · vendor-doc · 2026-09-17
    Evidence: vssadmin list shadows /for=<volume> enumerates existing shadow copies, which back System Restore points and 'Previous Versions' file recovery.
  • vssadmin - SS64
    SS64 · technical · 2026-09-17
    Evidence: Reference for vssadmin subcommands including list shadows and delete shadows, and their admin-privilege requirement.

Last verified: 2026-09-18 · Category: Files & Folders

06Related solutions

Get a Full System Summary with systeminfo
WindowshardwarecmdDiagnostics

One command that shows OS version, install date, boot time, memory, network adapters and installed hotfixes.

Low risk ✓ 2026-09-17
Verify File Hashes with certutil -hashfile
Windowshashcmdsecurity

Built-in Windows command to compute MD5, SHA1 or SHA-256 hashes of any file.

Low risk ✓ 2026-09-17
Clear Stubborn File Attributes with attrib
Windowscmdhiddenattributes

Remove hidden, system and read-only flags from files or whole directory trees.

Medium risk ✓ 2026-09-17