Search code examples
winapintfsvolume-shadow-service

how does physical disk read work with volume shadow for ntfs?


my goal is to make a backup program reading a physical disk (with NTFS partitions) while using VSS for data consistency.

i use windows api's functions CreateFile with '\.\PhysicalDriveN' as described here (basically, it allow me to access a disk as a big file)

https://support.microsoft.com/en-us/help/100027/info-direct-drive-access-under-win32

for tests i create volume shadows with this command

wmic shadowcopy call create Volume='C:\'

this is a temporary solution, i plan on using VSS via the program itself

My question is: how are stored Volume shadows? does it stores data that have been modified since the volume shadow or does it store modification made since the last volume shadow?

in the first case: when i read the disk, will i get consistent data (including ntfs metadata files)?

in the other case: can i access a volume shadow the same way i would access a disk/partition? (in order to read hidden metadata files, etc)

-im am currenctly using windows 7 but planning on using it on differents version of windows server

-i've read a lot of microsoft doc about VSS but how it work seem really unclear for me (if you answer with one please explain a bit it meaning)

-i know that Volume shadows are stored in the folder "System Volume Information" as files with names like {3808876b-c176-4e48-b7ae-04046e6cc752}


Solution

  • So i did more test and actually Shadow Volume are made at block level not file level. it mean that by using createfile with the path \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1 it would work in a similar way than using createfile with the path \\.\C:

    So yeah you can access a shadow copy file system, it have it own boot sector, mft, etc.