Lab 4.3: Windows Shadow Copies

Learning Objectives

By the end of this lab, you will be able to:

• Understand how Shadow Copies work
• Create and manage restore points
• Access previous versions of files
• Understand security implications (recovery of sensitive data)

Estimated Duration

40 minutes

Prerequisites

• Windows 10/11 VM
• Administrator rights
• Available disk space (~2 GB minimum)

Professional Context

Shadow Copies are used for:

• Recovery of deleted/modified files
• Backup without service interruption
• Forensics: Recovery of historical data
• Security: Attackers may find sensitive information there

---

Part 1: Understanding Shadow Copies

Step 1.1: What is Shadow Copy?

Shadow Copy (or VSS - Volume Shadow Copy Service) is a Windows service that creates "snapshots" of the file system at a given point in time.

Features:

• Block-level backup
• Works even with open files
• Used for System Restore and Windows backups
• Stored in a reserved space on the volume

Step 1.2: Check the VSS service

# Service status
Get-Service VSS

# Start if necessary
Start-Service VSS

Step 1.3: List existing Shadow Copies

# Method 1: vssadmin
vssadmin list shadows

# Method 2: WMI
Get-WmiObject Win32_ShadowCopy | Select-Object ID, InstallDate, VolumeName

Question 1: How many Shadow Copies exist on your system?

---

Part 2: Creating Shadow Copies

Step 2.1: Enable system protection

# Check if protection is enabled for C:
Get-ComputerRestorePoint -ErrorAction SilentlyContinue

# Enable via GUI
# Control Panel > System > System Protection

Via PowerShell (requires elevation):

# Enable protection on C:
Enable-ComputerRestore -Drive "C:\"

# Verify
vssadmin list shadowstorage

Step 2.2: Create a restore point

# Create a restore point
Checkpoint-Computer -Description "Lab Shadow Copy Test" -RestorePointType MODIFY_SETTINGS

# Verify
Get-ComputerRestorePoint | Select-Object -Last 3

Step 2.3: Create a Shadow Copy directly

# Create a Shadow Copy via WMI
$class = [WMICLASS]"root\cimv2:Win32_ShadowCopy"
$shadow = $class.Create("C:\", "ClientAccessible")

if ($shadow.ReturnValue -eq 0) {
    Write-Host "Shadow Copy created successfully" -ForegroundColor Green
    Write-Host "ID: $($shadow.ShadowID)"
} else {
    Write-Host "Error: $($shadow.ReturnValue)" -ForegroundColor Red
}

# List to verify
vssadmin list shadows

---

Part 3: Accessing Shadow Copies

Step 3.1: GUI Method - Previous Versions

1. Right-click on a file or folder
2. Properties
3. "Previous Versions" tab
4. Select a version and "Restore" or "Open"

Step 3.2: Command line method

# List Shadow Copies with their paths
$shadows = Get-WmiObject Win32_ShadowCopy
foreach ($shadow in $shadows) {
    Write-Host "Date: $($shadow.InstallDate)" -ForegroundColor Yellow
    Write-Host "Path: $($shadow.DeviceObject)"
    Write-Host ""
}

Step 3.3: Mount a Shadow Copy

# Get the shadow copy path
$shadow = Get-WmiObject Win32_ShadowCopy | Select-Object -Last 1
$shadowPath = $shadow.DeviceObject

# Create a symbolic link
$linkPath = "C:\ShadowMount"
cmd /c mklink /d $linkPath "$shadowPath\"

# Explore the shadow copy
Get-ChildItem $linkPath

# Access files
Get-ChildItem "$linkPath\Users" -ErrorAction SilentlyContinue

Step 3.4: Explore via UNC path

Shadow Copies are accessible via a special path:

# Format: \\localhost\C$\@GMT-YYYY.MM.DD-HH.MM.SS\
# But easier via the DeviceObject

# List a specific folder in the shadow
$shadowPath = (Get-WmiObject Win32_ShadowCopy | Select-Object -Last 1).DeviceObject
cmd /c dir "$shadowPath\Windows\System32\config\" 2>$null

---

Part 4: Security Implications

Step 4.1: Security risks

Sensitive data in Shadow Copies:

• Configuration files with passwords
• Databases
• "Permanently" deleted files
• Modification history

Step 4.2: Demonstration - Recover a deleted file

# 1. Create a "sensitive" file
$testFile = "C:\Temp\secret_file.txt"
New-Item -Path "C:\Temp" -ItemType Directory -Force | Out-Null
"Password: SuperSecret123!" | Out-File $testFile
Write-Host "File created: $testFile" -ForegroundColor Green

# 2. Create a Shadow Copy
$class = [WMICLASS]"root\cimv2:Win32_ShadowCopy"
$shadow = $class.Create("C:\", "ClientAccessible")
Start-Sleep -Seconds 2
Write-Host "Shadow Copy created" -ForegroundColor Green

# 3. Delete the file
Remove-Item $testFile -Force
Write-Host "File deleted" -ForegroundColor Yellow

# 4. Verify it is really deleted
if (-not (Test-Path $testFile)) {
    Write-Host "File confirmed deleted" -ForegroundColor Yellow
}

# 5. Recover from the Shadow Copy
$latestShadow = Get-WmiObject Win32_ShadowCopy | Select-Object -Last 1
$shadowPath = $latestShadow.DeviceObject

# Access the file in the shadow
$recoveredPath = "$shadowPath\Temp\secret_file.txt"
$content = cmd /c type "$recoveredPath" 2>$null

if ($content) {
    Write-Host "`nFile RECOVERED from Shadow Copy:" -ForegroundColor Red
    Write-Host $content -ForegroundColor Red
} else {
    Write-Host "Note: The file must have been created BEFORE the shadow copy"
}

Question 2: Why is this a security risk?

Step 4.3: Implications for attackers

Attackers can use Shadow Copies to:

1. Recover deleted files (credentials, configs)
2. Bypass protections (locked files)
3. Extract historical data (old file versions)

Step 4.4: Access to sensitive system files

# SAM/SYSTEM files are normally locked
# But accessible via Shadow Copy!

$shadow = (Get-WmiObject Win32_ShadowCopy | Select-Object -Last 1).DeviceObject

# Check if we can list config files
$configPath = "$shadow\Windows\System32\config"
Write-Host "Files in the Shadow Copy:" -ForegroundColor Yellow
cmd /c dir "$configPath" 2>$null

# Note: Copying these files would allow extracting hashes
# This is used by tools like secretsdump

---

Part 5: Protection and Cleanup

Step 5.1: Delete Shadow Copies

Warning: Use with caution in production!

# Delete ALL shadow copies (DANGEROUS!)
# vssadmin delete shadows /all /quiet

# Delete the oldest
# vssadmin delete shadows /for=C: /oldest /quiet

# Delete by ID
$shadowId = (Get-WmiObject Win32_ShadowCopy | Select-Object -First 1).ID
# Get-WmiObject Win32_ShadowCopy | Where-Object {$_.ID -eq $shadowId} | Remove-WmiObject

Step 5.2: Limit Shadow Copies space

# See used space
vssadmin list shadowstorage

# Limit space (e.g., 10% of the volume)
# vssadmin resize shadowstorage /for=C: /maxsize=10%

Step 5.3: Security script

# Shadow Copies audit script
Write-Host "=== AUDIT SHADOW COPIES ===" -ForegroundColor Cyan

# Count shadow copies
$shadows = Get-WmiObject Win32_ShadowCopy
Write-Host "`nNumber of Shadow Copies: $($shadows.Count)"

# Used space
Write-Host "`nShadow Storage Space:" -ForegroundColor Yellow
vssadmin list shadowstorage 2>$null

# List dates
if ($shadows) {
    Write-Host "`nAvailable Shadow Copies:" -ForegroundColor Yellow
    foreach ($s in $shadows) {
        $date = [Management.ManagementDateTimeConverter]::ToDateTime($s.InstallDate)
        Write-Host "  - $date"
    }
}

# Recommendations
Write-Host "`n=== RECOMMENDATIONS ===" -ForegroundColor Cyan
Write-Host "1. Limit VSS storage space"
Write-Host "2. Regularly delete old copies"
Write-Host "3. Do not store sensitive data in plain text"
Write-Host "4. Monitor access to Shadow Copies"

Step 5.4: Lab cleanup

# Delete the symbolic link
if (Test-Path "C:\ShadowMount") {
    cmd /c rmdir "C:\ShadowMount"
}

# Delete test files
Remove-Item "C:\Temp\secret_file.txt" -Force -ErrorAction SilentlyContinue

Write-Host "Cleanup completed" -ForegroundColor Green

---

Deliverables

1. Answers to the 2 questions

2. Screenshots:

   • List of Shadow Copies
   • Access to previous versions
   • Recovery demonstration

3. Report (1 page):

   • How Shadow Copies work
   • Identified security risks
   • Protection recommendations

---

Evaluation Criteria

Criteria	Points
Shadow Copy creation	25%
Data access	30%
Security understanding	25%
Recommendations	20%

---

Reference Commands

# Service
Get-Service VSS
Start-Service VSS

# List
vssadmin list shadows
Get-WmiObject Win32_ShadowCopy

# Create
Checkpoint-Computer -Description "Test"
([WMICLASS]"root\cimv2:Win32_ShadowCopy").Create("C:\", "ClientAccessible")

# Delete
vssadmin delete shadows /for=C: /oldest

# Space
vssadmin list shadowstorage
vssadmin resize shadowstorage /for=C: /maxsize=10%

---

Resources

• Microsoft: Volume Shadow Copy Service
• MITRE ATT&CK: Data from Local System

---

Lab developed as part of the Operating Systems course - MODULE 4