Access Shadow Copies (VSS) Natively

This is a first glance at accessing Shadow Copies (VSS) natively in Windows 7.

Did you know that you can access Shadows from the Previous Versions tab from the drive letter (root) in Windows 7? That's right, ding ding. This came as a surprise to me as well. I stumbled across this unintentionally.

When on Previous Versions you see the versions per date. I have always thought the Previous Versions tab was for individual files only...Wow was I wrong!!

For this test case I mounted my test VHD using a method I documented in a previous post (ShadowKit – Working with Disk Images).

I am not going to go in to too much detail as it is very simple. I'll stick to two steps.

First, I am showing you an example of my C: drive and H: drive. The H: drive is a mounted vhd I like to use for testing.

Steps

Right click on the date you are interested in and select "Open" from the context menu.

Below:  Now you see that Windows Explorer has exposed a view of the snapshot you selected. Blow is my H: drive snapshot from Feb 24th.
*I will show you C: in a forensic imaging tool in the next section.

I can now copy the files I wish to recover!

Forensic tools

It's very nice being able to access Shadows natively in this way. Navigating to the UNC path "\\localhost\H$\@GMT-2012.02.24-22.51.29" is doable with imaging and DIR tools such as FTK Imager or reg ripper. I was able to navigate to \Windows\System32\config and recover registry hive files to my hearts content.

Example using FTK Imager:






Conclusion

As you can see Windows 7 will expose both my C: and H: (vhd) shadow copies through explorer....I did not need to run ShadowKit or any third party VSS tools to get access to the VSS files.
*Check out the Cons below for the issues you are going to run in to.

Cons
This method is simple and convenient however there are issues with permissions. Some files and directories are not going to be available such as System Volume Information and ProgramData or folders from another system that you do not have permissions to access. For these and other issues and for a few additional features you will want to fire up ShadowKit to get the needed access!

Disk wiping with DISKPART

I had a case settle recently and needed to wipe some scratch disks with oem partitions. In the process of trying to use DISKPART to remove partitions I came across CLEAN. It states it will zero every sector on the disk..

From technet:
DiskPart Command-Line Options
"Removes any and all partition or volume formatting from the disk with focus. On master boot record (MBR) disks, only the MBR partitioning information and hidden sector information are overwritten. On GUID partition table (GPT) disks, the GPT partitioning information, including the Protective MBR, is overwritten; there is no hidden sector information. - all - Specifies that each and every sector on the disk is zeroed, which completely deletes all data contained on the disk."

Has anyone else used this feature for disk wiping? If so does DISKPART leave anything behind on the system being used for wiping such as prefetch or user assist that could be forensically useful?

ShadowKit - a tool to recover Windows 7 Shadow Copies. Version 1.1 released! Major improvements and bug-fixes!

Download