Windows Volume Shadow Copy

[gfd2020]

Can IPED recover files from Volume Shadow Copies - Windows OS?
I have a real-world case where the user deleted files and emptied the Recycle Bin. IPED recovered many files but not all of them; specifically, after recovering files using a Shadow Copy snapshot, it was possible to recover additional files using third party tool.

As discussed previously #1453 , I even enabled KnownMetParser and addunallocated, but I didn't get any files from the Shadow Copy. Is there an additional configuration required, or is this simply a limitation?

[lfcnassif]

Hi @gfd2020. Currently, IPED is not able to decode Volume Shadow Copies using the ideal approach, it would be necessary to implement this support in the underlying Sleuthkit library.

But, we run data carving on volume shadow files to try to recover file types supported by the carving module, if they are contiguous. For that, you should use the forensic profile, or enable data carving and also add file slacks to the case, since volume shadow files content is obtained from their slack files by sleuthkit, see sleuthkit/sleuthkit#466 for an explanation about this.

[gfd2020]

Hi @gfd2020. Currently, IPED is not able to decode Volume Shadow Copies using the ideal approach, it would be necessary to implement this support in the underlying Sleuthkit library.

Hi @lfcnassif . Thank you very much for the quick and detailed response.

But, we run data carving on volume shadow files to try to recover file types supported by the carving module, if they are contiguous. For that, you should use the forensic profile, or enable data carving and also add file slacks to the case, since volume shadow files content is obtained from their slack files by sleuthkit, see sleuthkit/sleuthkit#466 for an explanation about this.

I used the forensic profile, but I still couldn't recover the missing files.

I am looking into an easier way to add this to IPED.
I found the Python program below, but I ran a test and it failed to list the VSS from my hard drive image.

https://github.com/sujayadkesar/vscexplorer

[gfd2020]

I found this program that works for recovering VSC data from disk images (E01 or dd).

https://github.com/jupyterj0nes/vshadow-rs

It is written in Rust. I considered three possible ways to use it (since modifying Sleuthkit is complicated):

1. Use the binary directly.
2. Build a library (a DLL or something similar).
3. Port it to Java (which would be difficult due to dependencies).

However, although I was able to retrieve various files using this tool, I could not obtain exactly the same data as a native export from the "Shadow Explorer" program (which runs within the Windows OS).

[patrickdalla]

I sometimes use commands from https://github.com/libyal/libvshadow/, like vshadowinfo and vshadowmount to mount each snapshot version, and I pass these mount points to IPED as additional evidences (-d parameter), but with this method every non changed file will be processed twice. (I mainly use linux)

As some https://github.com/libyal are already deployed with IPED, like libagdb and libscca, it would be more consistent with project dependencies to use it.

One idea to make a more generic workflow integrated with IPED:

1. execute vshadowinfo to detect vshadow snapshots
2. Mount each snapshot
3. Create a task that would check a different version of each item in any of the snapshots
4. If existent, add the different prior version as child

For this idea IPED execution must have permission to mount the shadow copies.

I have not compiled and tested vshadowinfo or vshadowmount in Windows.

[patrickdalla]

For a fully deleted file that appears in Vss snapshot mount, the container folder will have its metadata last modified date property changed, so checking this difference for folder items can trigger method to traverse its snapshit file list and check the changes (file deletion, rename).

[gfd2020]

Hi @patrickdalla . Thanks a lot for the tips; I'll give them a try later.