What is volsnap?

Volsnap.sys is a Windows driver. A driver is a small software program that allows your computer to communicate with hardware or connected devices. This means that a driver has direct access to the internals of the operating system, hardware etc. The free file information forum can help you determine if volsnap.sys is a Windows system file or if it belongs to an application that you can trust.

Run a free scan to check for volsnap drivers in need of updating

Volsnap.sys file information

The process known as Volume Shadow Copy Driver or VolSnap belongs to software Microsoft Windows Operating System by Microsoft (

Description: The original volsnap.sys is an important part of Windows and rarely causes problems. Volsnap.sys is located in the C:\Windows\System32\drivers folder. Known file sizes on Windows 10/8/7/XP are 52,352 bytes (60% of all occurrences), 53,760 bytes and 5 more variants. 
The driver can be started or stopped from Services in the Control Panel or by other programs. The volsnap.sys file is a Windows system file. The program is not visible. The service has no detailed description. The volsnap.sys file is a Microsoft signed file. volsnap.sys appears to be a compressed file. Therefore the technical security rating is 2% dangerous, however you should also read the user reviews.

Uninstalling this variant: If you have any problems with volsnap.sys, you can do the following:

Recommended: Identify volsnap.sys related errors

Important: Some malware camouflages itself as volsnap.sys, for example TROJ_TDSS.BLZ (detected by TrendMicro), and Virus:Win32/Alureon.K (detected by Microsoft). Therefore, you should check the volsnap.sys process on your PC to see if it is a threat. We recommend Security Task Manager for verifying your computer's security. This was one of the Top Download Picks of The Washington Post and PC World.


User Comments

Its Shadow volume copy, required for NT backup procedure
  Egor Shokurov  
came on in blue screen
Once it is corrupted, this no booting into windows.
  kevin   (further information)
It's when you use a portable hard drive that attaches to your USB port. ie Sage 30 gigabyte. Iam using one now.
  David Hunt  
Volume Shadow Copy driver, an important part of Windows NT based systems (NT, 2000, XP, Server 2000, Server 2003). Sometimes comes up on BSOD's, copying the file from another computer usually solves this.
it was listed as a driver for opening a card reader i plugged into the USB
  mike rae  
Volsnap.sys is an essential part of Windows O/S Volsnapp.sys otoh, is NOT! Volsnapp.sys is a Rootkit.DLL file and should be removed/disabled.
  M. Louis Moore   (further information)
keeps showing up as a rootkit, is a binary file. going to try adding a digit to the file to make it harmless I hope
it can corrupt one of the partitions on dell computers
  terry peterson  
startup repair said "Root cause found: Boot critical file d:\windows\system32\drivers\volsnap.sys is corrupt" Repair action:File repair Result:Completed successfully. Error code=0x0 for Windows 7
laptop would get 0x0000007f (0x00000000...) error on boot right as the GUI screen started up. Copied VolSnap.sys from an XP Sp3 machine to an XP Sp2 machine, rebooted, and all is good
Boot intot he system using OS disk, do a repair and replace the file from the OS disk i386 Directory...Problem fixed
This popped up in a blue screen on Win 7 64 when I was transferring from USB card reader and from USB Hard Drive simultaneously, onto my computer's hard drive.
Volsnap is a key part of Windows backup and restore facility. It is certainly NOT a rootkit.
  Jeff   (further information)
Combofix found with rootkit virus
  Doug B  
kept on rebooting
System File needed for booting
VolSnap.sys is indeed important to Windows. However, it is also a target for viruses. If it is corrupted by a virus, you will have to replace it. If you have Windows installation disks, you can copy it from that. But many computers come with Windows preinstalled and the installation stuff is stored in a partition on the hard disk. In this case you are screwed, since any virus that corrupted Volsnap.sys on the hard drive will likely do it to the restore partition. You can try copying it from another computer. Sometimes this works, sometimes it doesn't.
It is a system vital process, but the TDSS 3-4 rootkits corrupt this file, which causes many things. It it not anything bad. It's bad, in a way, when it's corrupted by TLD3 and 4. See for instances of this; TDSS Killer is helpful for removing this rootkit causing corruption to VolSnap.sys
  Ellie   (further information)
volsnap on vista is NOT 52k is 227,896 erroroccurs on boot and identifies volsnap replacement of file works rename your current bad volsnap 1st just in case
  Edward Austin  
A virus
  Jim Bob  

Rating chart

Summary: Average user rating of volsnap.sys: based on 22 votes with 21 user comments. 15 users think volsnap.sys is essential for Windows or an installed application. 3 users think it's probably harmless. 3 users suspect danger. One user thinks volsnap.sys is dangerous and recommends removing it. 2 users don't grade volsnap.sys ("not sure about it").

Do you have additional information?
What do you know about volsnap.sys:
How would you rate it:
Link for more info:
Your Name:

Best practices for resolving volsnap issues

A clean and tidy computer is the key requirement for avoiding problems with volsnap. This means running a scan for malware, cleaning your hard drive using 1cleanmgr and 2sfc /scannow, 3uninstalling programs that you no longer need, checking for Autostart programs (using 4msconfig) and enabling Windows' 5Automatic Update. Always remember to perform periodic backups, or at least to set restore points.

Should you experience an actual problem, try to recall the last thing you did, or the last thing you installed before the problem appeared for the first time. Use the 6resmon command to identify the processes that are causing your problem. Even for serious problems, rather than reinstalling Windows, you are better off repairing of your installation or, for Windows 8 and later versions, executing the 7DISM.exe /Online /Cleanup-image /Restorehealth command. This allows you to repair the operating system without losing data.

To help you analyze the volsnap.sys process on your computer, the following programs have proven to be helpful: ASecurity Task Manager displays all running Windows tasks, including embedded hidden processes, such as keyboard and browser monitoring or Autostart entries. A unique security risk rating indicates the likelihood of the process being potential spyware, malware or a Trojan. BMalwarebytes Anti-Malware detects and removes sleeping spyware, adware, Trojans, keyloggers, malware and trackers from your hard drive.

Other processes

volsnap.sys [all]