A computer I am working on had most of the files on it encrypted by the TeslaCrypt ransomware program. I found that it did not delete the shadow copies and there may be a number of backups available.
I tried mounting several of the shadow copies prior to infection using vssadmin list shadows
and mklink /D C:\restore \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy8\
and am able to see most of the files we are interested in recovering.
The problem is most of the files I look at partially contain the correct data but have large blocks of zeroes (\x00
) either at the end or the middle of the files.
The files are all the original sizes except that they are missing large chunks. Are those missing portions of the files lost or is there some issue with these shadow copies?
System: Windows 8.1 64-bit.
EDIT:
Maybe this is happening because Windows 8 is phasing out volume shadow copy and instead using block level backup?