Skip to main content
SpringerLink
Log in

Damaged backup data recovery method for Windows mobile

  • Published:
The Journal of Supercomputing Aims and scope Submit manuscript

Abstract

Recent developments in grid and cloud computing technologies have enhanced the performance and scale of storage media. Data management and backup are becoming increasingly important in these environments. Backup systems constitute an important component of operating system security. However, it is difficult to recover backup data from an environment where the operating system does not work because the storage hardware has been damaged. This study analyzes the Volume Shadow Copy Service (VSS) used by the Windows operating system. Windows 8 has been implemented for mobile environments; hence, it could be used for data recovery from damaged mobile devices. VSS is a backup infrastructure provided by Windows that creates point-in-time copies of a volume (known as volume shadow copies). Windows Vista and later versions use this service instead of the restore point feature used in earlier versions of the operating system. The restore point feature logically copied and stored specified files, whereas VSS copies and stores only data that have changed in the volume. In a live system, volume shadow copies can be checked and recovered using built-in system commands. However, it is difficult to analyze the files stored in the volume shadow copies of a nonfunctioning system, such as a disk image, because only the changed data are stored. Therefore, this study analyzes the structure of Volume Shadow Copy (VSC) files that were logically stored. This analysis confirms the locations of the changed data and original copies by identifying a structure that stores the file data stream to file system metadata. On the basis of our research, we propose a practical application to develop tools for the recovery of snapshot data stored within the VSC files. We also present results of our successful performance test.

This is a preview of subscription content, log in via an institution to check access.

Access this article

Log in via an institution

Price excludes VAT (USA)
Tax calculation will be finalised during checkout.

Instant access to the full article PDF.

Institutional subscriptions

Fig. 1
Fig. 2
Fig. 3
Fig. 4
Fig. 5
Fig. 6
Fig. 7
Fig. 8
Fig. 9
Fig. 10
Fig. 11
Fig. 12
Fig. 13
Fig. 14
Fig. 15
Fig. 16

Similar content being viewed by others

References

  1. Microsoft Corporation (2010) MSDN: volume shadow copy service. Microsoft Corporation. Available online at: http://msdn.microsoft.com/en-us/library/bb968832(v=VS.85).aspx

  2. Russinovich M, Solomon D (2009) Microsoft Windows internals, 5th edn. Microsoft Press, Redmond

    Google Scholar 

  3. Carrier B (2005) File system forensic analysis. Addison-Wesley, Reading

    Google Scholar 

  4. Carvey H (2007) Windows forensic analysis. Syngress, Norwell

    Google Scholar 

  5. Rentz D OpenOffice.org’s documentation of the Microsoft compound document, the spreadsheet project. Available online at: http://OpenOffice.org

Download references

Acknowledgements

This research was supported by the MKE (The Ministry of Knowledge Economy), Korea, under the ITRC (Information Technology Research Center) support program (NIPA-2012-H0301-12-3007) supervised by the NIPA (National IT Industry Promotion Agency).

Author information

Authors and Affiliations

  1. Center for Information Security Technologies, Korea University, Seoul, Republic of Korea

    Jewan Bang, Sangjin Lee & Kyungho Lee

  2. Seoul National University of Science and Technology, Seoul, Republic of Korea

    Changhoon Lee

Authors
  1. Jewan Bang
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Changhoon Lee
    View author publications

    You can also search for this author in PubMed Google Scholar

  3. Sangjin Lee
    View author publications

    You can also search for this author in PubMed Google Scholar

  4. Kyungho Lee
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Kyungho Lee.

Rights and permissions

Reprints and permissions

About this article

Cite this article

Bang, J., Lee, C., Lee, S. et al. Damaged backup data recovery method for Windows mobile. J Supercomput 66, 875–887 (2013). https://doi.org/10.1007/s11227-013-0919-6

Download citation

  • Published:

  • Issue Date:

  • DOI: https://doi.org/10.1007/s11227-013-0919-6

Keywords

Search

Navigation