ł́AJSACCFPƂč]fڂĂ܂BCFPTv́Aȉ̓_ō]܂B - ܂NĂȂZpŐVK - c[J - TvAEgCڂĂAc[̎v[e[V̗mFł ȂACFPTv͖{l̏𓾂JSACr[A[IWi̓eɉMACĂ܂B * u^Cg 폜ςVSSXibvVbg̕ * uҖ * u҂̏ ЃC^[lbgCjVAeBu ZLeB񓝊 * uTvi2,000ȓj Volume Shadow Copy Service (VSS)ƂWindows Vista/Windows Server2003ȍ~ɓڂĂobNAbv@\łBVSS gpƃXg[W̃{[PʂŃXibvVbg쐬邱ƂłB[U̓XibvVbgQƂ邱ƂŃX ibvVbg쐬̃fBXÑRecɃANZX邱Ƃł邽߁A폜ꂽt@C񂪍sÕt@C ɂANZX邱Ƃ”\ƂȂB 폜t@C̕PhotoRecȂǂ̃t@CJ[rOc[łsƂł邪AXibvVbg̓t@CJ[rO ƔrāAt@Ct@CȂǂ̃^𕜌ł_ƃtOgt@C𐳂ł_ ȃbgƂȂB̂悤ȓXibvVbg̓fBXNtHWbNɂāAU҂쐬t@CiUc [ꎞIȃA[JCut@CȂǁj𕜌E͂邽߂̏dvȃf[^ƂȂB AߔNł͍U҂}EFA쐬҂̏dvFĂAN⊴ɂׂẴXibvVbg폜 ܂ႪĂBʏAXibvVbg͍폜ƃANZXpȂȂĂ܂A֘Af[^𕜌܂ č\z邱ƂŃXibvVbg̃f[^ɃANZXł”\BA폜ꂽXibvVbgɃANZXł ΁A܂ŗpłȂf[^Lpȏ񌹂ƂĊp邱ƂłB XibvVbg̓J^O(Catalog)ƃXgA(Store)ƌĂ΂t@C\ĂA̓{[[g uSystem Volume InformationvtH_ɕۑBJ^O̓XibvVbg̃^iXibvVbgXg AGUIDȂǁjL^ĂAe^̓J^OGgƌĂ΂BXgAɂ͍f[^iXibvVbg쐬ƌ݂ {[̃f[^̍jL^BXibvVbgƂɃXgÃt@C͍At@Cɂ̓J^OGg ̃XgAGUID܂܂ĂB vssadmin.exeȂǂgpăXibvVbg폜ƃJ^ÕGg̃^Cvugpv\l(0x01)ɕύX B܂Ȃׂ̏͂Null(0x00)ɏBAXgA͓16oCĝݏ邪Af[^ ύXꂸɃt@C폜BXgA̍f[^͕ύXȂ߃XgÃt@C𕜌΃XibvVbg̃f[ ^ɂ_Iɂ̓ANZXłB܂AJ^ÕXibvVbgGUIDXgA$MFTt@C畜łB ̂悤ɍ폜ɂĎꂽf[^⊮邱Ƃ͂ł邪ȀԂXibvVbg̃f[^փANZX@\ Windowsɂ݂͑ȂB̂߁A͂ŃXibvVbg̉͂sKv邪AKȂƂvshadowmountƂXibv VbgɃANZX邽߂̃I[v\[X̃c[JĂBvshadowmount̃J^OƃXgẢ͏JX^ }CY邱ƂŁA폜ꂽXibvVbgɃANZX邱ƂłB uł͎ɊւĂڍׂȉƍ쐬c[̃fs\łB܂AuIA쐬c[̓I[v\ [XŌJ\łB * uẽAEgCiuAuɊւQlȂǂꍇ́AYtĂj 1. Introduction ߂ɁAȂ̂悤ȌsÃc[낤Ǝv̂Ãc[̖_Ãc[ɂĉ”\ƂȂ邱 ƂȂǂqׂBႦ΁A{̖ړIƂĂ͈ȉ̓_BLc[܂ފ̃c[͍폜ςVSS𕜌@ \Ă炸AႦ΃TEFAɂVSS폜Ă܂ꍇ͂ȂpȂBŁA{c[ɂVSS 𕜌łꍇAtHWbN͒邱Ƃł邽߂łB 2. VSS̊Tv ̃ZNVł́AVSSƂ͉HAVSSǂ̂悤ȃt@Cō\Ă邩AVSS̓TvAȃt@C̍\ɂ ďqׂBVSSCatalogt@CStoret@CƂQ‚̃t@CŎɍ\ĂAStore͊̃{[Ƃ̍ f[^ǗACatalog͊eStoret@C̃ItZbgȂǂ̃^f[^ǗĂBVSS폜ꂽꍇACatalogt@C ̓Rec㏑Ă폜Ă܂̂ɑ΂AStoret@C̃Rec͂قږ̏Ԃō폜Bm̂ ANTFS̓t@C폜ɃRecAYMFTGgɍ폜σtOݒ肵č폜Ƃɂ邽߁AR ec̈悪㏑Ȃ΁AStoret@C𕜌邱Ƃ͉”\łƌB 3. 폜ꂽVSS Snapshotւ̃f[^ANZX@̌Ǝ ł́Aǂ̂悤ɖ{c[Aɂ‚Ă̏ڍׂqׂB܂ÃeXgʂɂ‚ĂqׂBOq ̂ƂAStoret@CVSSNTFS̎dl폜Ăł”\邱Ƃ킩ĂBŁACatalogt@C ̓Rec㏑Ă܂ߕłȂACatalogt@CStoret@C̃^f[^ǗpłAStoret @Cł΁ACatalogt@CČ邱Ƃ͉”\łB̂ƂAȉ̂悤ȕjō폜ςVSS𕜌A 炪ǗĂt@CQɃANZX@B܂vss_carver.pyƂAVɍ쐬c[gAHDDC[ WStoret@C̃VOl`邱ƂŁA폜ςVSSf[^񋓂AStoret@C̊Ǘ̈敔CarvingB Storef[^yъStoref[^ɁACatalogt@CČBOpen Source Softwarełlibvshadowvshad owmountR}hÃt@CnƂł悤Ɋg邱ƂŁA폜ςVSS̊Ǘf[^ɃANZX 悤ɂBɃeXg@ɂ‚ẮAeXgp̃eLXgt@CPDFt@CpӂAVSSɊǗƂŁAYt @CVSS폜ƂeXgsƂÃc[Qׂ͂đΉłȂ̂ɑ΂A{c[͐t@ C𕜌邱ƂłB 4. c[fF폜XibvVbg̃t@C {\ł͈ȉ̂Q‚̃fs\łB - VSS̊Ǘ̈撴߂ɂ莩RłVSSXibvVbgf[^Ǘt@C̕ - TEFAɂč폜ꂽVSSXibvVbgƂ炪Ǘt@C̕ 5. ܂Ƃ Ōɂ܂Ƃ߂ƂĂǂ̂悤ȂƂ{qׂB܂feature workAʓrӓ_ƂWindows 8ȍ~ŃftHg LꂽScopeSnapshots@\ɂ‚ĂyB * uue[}vɋLڂꂽڂueɋ߂I [B] tHWbN֘A (@A̓c[Ȃ) * łɌJς݂͎OɌJ\̓e JSACȑOɌJ̗\͂܂B * u҂ɂ̔\`|Cg (̓I3’xグĂ) 1. VSS ɊւA[eBt@Ng 2. 폜ꂽVSS Snapshot𕜌@ 3. VSS Snapshot𕜌邱Ƃ̗Lƕc[̎gp@ * ȗS܂͈ꕔJ”\ (J/ꕔJ/J) J * c[IoCȂǂ̃CVfgɊpł̌JL(ꍇ͋̓IɋL) 폜ꂽVSS Snapshot𕜌c[J\