Expand description
§vsc-core — Windows Volume Shadow Copy (VSS) reader
A panic-free decoder for the on-disk structures of Windows Volume Shadow Copy
(VSS), the [P^H] disk-history substrate of the forensic fleet. Given a
positioned Read + Seek over an NTFS volume (offset 0 = the NTFS boot
sector), VssVolume::open reads the VSS volume header at byte offset
0x1E00, walks the catalog of shadow-copy stores, and exposes each store’s
StoreInfo on demand.
The reader stays pure: it decodes bytes into typed records and makes no
forensic judgments (those live in the sibling vsc-forensic analyzer). It
never loads the whole volume into memory — the real volumes are hundreds of
gigabytes — and every multi-byte read is bounds-checked, so malformed input
yields safe defaults or a typed VssError, never a panic.
It enumerates stores and decodes store information plus the typed diff-area
records (BlockDescriptor, StoreBlockRange), and reconstructs a
snapshot’s copy-on-write view of the volume via VssVolume::snapshot →
Snapshot::read_block / Snapshot::read_at.
Re-exports§
pub use block::BlockDescriptor;pub use block::BlockDescriptorFlags;pub use block::StoreBlockRange;pub use catalog::StoreDescriptor;pub use catalog::VolumeHeader;pub use error::VssError;pub use guid::format_guid;pub use guid::VSS_IDENTIFIER;pub use reconstruct::Snapshot;pub use store::AttributeFlags;pub use store::StoreBlockHeader;pub use store::StoreInfo;
Modules§
- block
- Typed diff-area records: the block descriptor and store block range.
- catalog
- VSS volume header (offset 0x1E00) and catalog block / entry decoding.
- error
- Error type for the VSS reader.
- guid
- VSS identifier GUID and canonical GUID formatting.
- reconstruct
- Phase-2 copy-on-write snapshot reconstruction.
- store
- Store block header, store information, and store attribute flags.
Structs§
- VssVolume
- A read-only view over the Volume Shadow Copy metadata of an NTFS volume.