Home

Awesome

<img src="pic/PY-removebg-preview-crop.png" />

Python ShadowCopy Analyzer for Cyber Security Researchers!

Disclaimer

<p>The information provided in this blog post is intended for informational purposes only. It is not intended to encourage or promote any illegal or unethical activities, including hacking, cyberattacks, or any form of unauthorized access to computer systems, networks or data.</p>

What is the ShadowCopy

<p>ShadowCopy is a technology that allows you to create backup snapshots or copies of computer volumes or files, even if they are in use. It is also known as Volume Shadow Copy Service, Volume Snapshot Service or VSS. You can use ShadowCopy to restore lost files, recover from ransomware or cryptolocker attacks, or revert your system to a previous state using a system restore point. <br><br> ShadowCopy is available in Windows 7, 8 and 10, but you need to enable it first.</p>

Important

<p>Run CMD with Administrator (need Administrator grant)!</p>

Abilities

<ul> <li> Recover deleted files from ShadowCopies</li> <li> Create Pipe / Symlinks to ShadowCopies</li> <li> List all ShadowCopies</li> <li> Create ShadowCopy</li> <li> Delete ShadowCopy</li> </ul>

Working On

<ul> <li> Export ShadowCopy to VHD file</li> </ul>

Installation

<p>PyPi : <a href="https://pypi.org/project/reshadow/">PyShadowCopy</a></p>

Example Code

<pre> # List all ShadowCopy ''' Example Result ID : {e9a894be-dae7-49cb-9196-b5a22148210b} Creation Date : 6.11.2022 19:58:20 Shadow Copy Location : \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy7 ''' list = ReShadowCode.VSS_ListShadows() for shadowlist in list: print("ID : " + shadowlist["id"] + "\nCreation Date : " + shadowlist["creation_time"] + "\nShadow Copy Location : " + shadowlist["shadowcopy"] + "\n") # Create a ShadowCopy ReShadowCode.VSS_Create() # Create a pipe/symlink with ShadowCopy() (Ex. \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy<b>id</b>) ReShadowCode.VSS_Create_Pipe("C:\\Shadow1", "id") # Get file list from ShadowCopy ''' Example Result Ali Ali Can Gönüllü Ali_000_vcRuntimeMinimum_x64.log Ali_000_vcRuntimeMinimum_x86.log Ali_001_vcRuntimeAdditional_x64.log Ali_001_vcRuntimeAdditional_x86.log All Users Default Default User desktop.ini Public TEMP ''' list = ReShadowCode.VSS_Get_FileList("C:\\Shadow1\\Users") for files in list: print(files) </pre>

Images

<img src="pic/pic2.png" /> <img src="pic/Shadow copy creation process.jpg" /> <img src="pic/Architectural diagram of Volume Shadow Copy Service.jpg" />