Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

NTFS shadow copies in differential mode work by copying the original data in a data block to a backup area before new writes are committed. If ntfs-3g doesn't do this copying, it could corrupt existing shadow copies by writing to a data block shared by the 'current' filesystem and a shadow copy filesystem. Does ntfs-3g do the necessary pre-write copies needed to keep shadow copy data intact?

share|improve this question

1 Answer 1

This page seems to suggest that ntfs-3g does not create VSS (Volume Shadow Service) shadow copies as a particular forensic method that would work on a Vista/Win7 native NTFS volume would not be possible on a volume created in any of the open-source NTFS clones:

Important: Currently, you can only examine shadow copy volumes if you have the original device the shadow copy volumes are on. You cannot examine or recover shadow copy volumes from a disk image file mounted on your workstation via ntfs-3g, Encase, vdk, or mount image pro.However, you can examine a volume image duplicated from the Shadow Copy Volume. More on this shortly...

This does not rule out ntfs-3g being able to understand shadow copies, but if they are not created to begin with then it would seem to imply that the functionality to understand them at all is not implemented.

Volume shadow copies are actually housed in proper "fully-fledged" NTFS files held in C:\System Volume Information and whenever data is overwritten it appears that they get merged into these files by the shadow volume service.

So it does seem possible that ntfs-3g could write to the drive and not actually be overwriting (and thus invalidating) the Shadow Copies, the writes would simply not caught and stored by shadow copies.

It is also possible that any writes with ntfs-3g will completely invalidate the VSS store and therefore completely destroy all your system restore points.

I honestly can't find anything on NTFS-3g supporting system restore or shadow copies at all, past some vague, "is it possible?" mailing list threads...

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.