6

When a Restore Point is created, Windows starts monitoring the volume and any changes are recorded in a proprietory diff file inside System Volume Information folder.

Thorough VSS-SDK api, we can expose the volume, but it shows us the whole volume and all the files/folders which have or have-not been modified since snapshot creation, and on access to any file, a filter-driver applies the diff, if required, and shows us the file.

My Question: Is it possible to list all the modified files, with respect to a restore point (except the brute-force method to compare each file inside the shadow-volume and the main-volume)?

How does Windows do it when we click on the previous versions tab in a file's Properties?

lalli
  • 6,083
  • 7
  • 42
  • 55

4 Answers4

3

Make use of the NTFS Change Journal. Windows logs all changes to all files on an NTFS volume in a journal database (if the journal is on). This can be queried to return all changes from a specific start USN number (your restore point)

Here is an article about the journal that helped me a lot while implementing change journal functionality

Hannes de Jager
  • 2,903
  • 6
  • 37
  • 57
  • thanks for the link, would you know how to get the USN number for the restore point? I"m struggling to get this info and have a unanswered question if you have a second? http://stackoverflow.com/questions/10544433/how-to-get-the-nextusn-journal-entry-for-a-vss-snapshot – stuck Jul 23 '12 at 08:26
  • I've added an answer to your question... Although it may not be exactly what you are looking for ;-) – Hannes de Jager Aug 18 '12 at 22:58
1

To detect changes in the current file system vs a shadow copy, you can use a third party software like WinMerge with the shadow copy UNC paths http://winmerge.org/. This will provide a GUI for comparisons

For example, use "C:\", vs "\localhost\C$\@GMT-2017.08.24-18.07.46"

Of course, enter a valid UNC path to coincide with the date and time of a shadow copy.

Jim Lutz
  • 139
  • 6
0

I guess the best way IS brute-force, coupled with USN number-comparison For reference, the link to a similar question is here

Community
  • 1
  • 1
lalli
  • 6,083
  • 7
  • 42
  • 55
-1

Windows know from the attributes date modified. It compares the the two file and checks the modified date.

Krish
  • 137
  • 1
  • 3
  • 12
  • The date attributes (all three- creation,modified and access) can be easily modified programatically, so I don't think that's the case. – lalli Sep 03 '10 at 03:18