Systems and methods for shadow copy access prevention

1. A method, comprising:

designating one or more files within a shadow copy with restricted shadow copy access based on a shadow copy access policy comprising a protected file list that indicates which files are to be monitored to prevent unauthorized shadow copy access, wherein the shadow copy access policy supplements default file access policies that are configured in an operating system of a computing device;

monitoring a request to access the one or more files via the shadow copy on the computing device, wherein monitoring the request to access the shadow copy comprises using a filter driver to intercept a request for a previously created shadow copy, wherein upon receiving a request for a shadow copy, the filter driver:

determines a user account that is making the request;

determines what volume the shadow copy is for; and

determines whether the user account has authorization to access a requested file or folder on the shadow copy based on the shadow copy access policy; and

preventing unauthorized access to the shadow copy based on the shadow copy access policy.

2. The method of claim 1 , wherein the request to access the shadow copy comprises a request to create a shadow copy of one or more volumes or a request to access a previously created shadow copy.

3. The method of claim 1 , wherein preventing unauthorized access to the shadow copy comprises:

preventing access to the one or more files on the shadow copy based on a specific user, group membership, file path and time of day.

4. The method of claim 1 , wherein preventing unauthorized access to the shadow copy further comprises:

determining whether a user account associated with the request is authorized to access the shadow copy on the computing device.

5. The method of claim 1 , wherein preventing unauthorized access to the shadow copy comprises:

determining that a user account is not authorized to access the shadow copy according to the shadow copy access policy.

6. The method of claim 1 , further comprising designating one or more protected files with restricted shadow copy access.

7. The method of claim 1 , wherein the filter driver comprises a file system filter or minifilter driver.

8. The method of claim 1 , further comprising:

loading the filter driver in a kernel of the computing device;

attaching the filter driver to a volume that is being monitored; and

receiving the request for a previously created shadow copy in a stack of callers.

9. The method of claim 1 , wherein monitoring a request to access a shadow copy comprises invoking a filter driver to intercept a request to create a shadow copy.

10. The method of claim 9 , wherein a volume shadow copy service monitor accesses a current executing thread to determine the invoker of the request.

11. The method of claim 9 , wherein if a request to create a shadow copy is not authorized by the shadow copy access policy, the filter driver prevents the shadow copy from being made.

12. The method of claim 1 , further comprising configuring a filter driver to perform copy monitoring via region access.

13. The method of claim 12 , wherein copy monitoring via region access comprises:

mapping regions in a sensitive file or shadow copy with bits of a bit array;

observing seeks to read the sensitive file or shadow copy;

marking bits associated with the seeks as dirty;

determining that all of the bits are dirty before the sensitive file or shadow copy is closed; and

generating a flag indicating a copy.

14. A computing device, comprising:

a processor;

a memory in electronic communication with the processor; and

instructions stored in the memory, the instructions being executable to:

designate one or more files within a shadow copy with restricted shadow copy access based on a shadow copy access policy comprising a protected file list that indicates which files are to be monitored to prevent unauthorized shadow copy access, wherein the shadow copy access policy supplements default file access policies that are configured in an operating system of the computing device;

monitor a request to access the one or more files via the shadow copy on the computing device, wherein the instructions executable to monitor a request to access a shadow copy comprise instructions executable to use a filter driver to intercept a request for a previously created shadow copy, wherein upon receiving a request for a shadow copy, the filter driver:

determines a user account that is making the request;

determines what volume the shadow copy is for; and

determines whether the user account has authorization to access a requested file or folder on the shadow copy based on the shadow copy access policy; and

prevent unauthorized access to the shadow copy based on the shadow copy access policy.

15. The computing device of claim 14 , wherein the instructions executable to prevent unauthorized access to the shadow copy comprise instructions executable to:

prevent access to the one or more files on the shadow copy based on a specific user, group membership, file path and time of day.

16. The computing device of claim 14 , wherein the instructions executable to monitor a request to access a shadow copy comprise instructions executable to invoke a filter driver to intercept a request to create a shadow copy.

17. The computing device of claim 16 , wherein if a request to create a shadow copy is made by a user account that is not authorized by the shadow copy access policy, the filter driver prevents the shadow copy from being made.