3
NTFS shadow copies in differential mode work by copying the original data in a data block to a backup area before new writes are committed. If ntfs-3g doesn't do this copying, it could corrupt existing shadow copies by writing to a data block shared by the 'current' filesystem and a shadow copy filesystem. Does ntfs-3g do the necessary pre-write copies needed to keep shadow copy data intact?
bdonlan
Posted 2011-06-21T21:38:53.770
Reputation: 1 463
3
This page seems to suggest that ntfs-3g does not create VSS (Volume Shadow Service) shadow copies as a particular forensic method that would work on a Vista/Win7 native NTFS volume would not be possible on a volume created in any of the open-source NTFS clones:
Important: Currently, you can only examine shadow copy volumes if you have the original device the shadow copy volumes are on. You cannot examine or recover shadow copy volumes from a disk image file mounted on your workstation via ntfs-3g, Encase, vdk, or mount image pro.However, you can examine a volume image duplicated from the Shadow Copy Volume. More on this shortly...
This does not rule out ntfs-3g being able to understand shadow copies, but if they are not created to begin with then it would seem to imply that the functionality to understand them at all is not implemented.
Volume shadow copies are actually housed in proper "fully-fledged" NTFS files held in C:\System Volume Information and whenever data is overwritten it appears that they get merged into these files by the shadow volume service.
So it does seem possible that ntfs-3g could write to the drive and not actually be overwriting (and thus invalidating) the Shadow Copies, the writes would simply not caught and stored by shadow copies.
It is also possible that any writes with ntfs-3g will completely invalidate the VSS store and therefore completely destroy all your system restore points.
I honestly can't find anything on NTFS-3g supporting system restore or shadow copies at all, past some vague, "is it possible?" mailing list threads...
Mokubai
Posted 2011-06-21T21:38:53.770
Reputation: 64 434
Interesting that you cite a forensic site also. This forensic site makes the point (surrounding the 2nd graphic on that page) that the NTFS files held in C:\System Volume Information should not be thought of as a location into which files and folders are put. These files basically contain data and pointers to the location of the data, whether that is in the original location or in a "differences area."
– GlennFromIowa – 2015-09-22T21:40:24.570