Systems and methods for shadow copy access prevention
A method is described. The method includes monitoring a request to access one or more files via a shadow copy on a computing device. The method also includes preventing unauthorized access to the shadow copy based on a shadow copy access policy. Monitoring the request to access a shadow copy may include using a filter driver to intercept a request for a previously created shadow copy or a request to create a shadow copy.
1. A method, comprising:
monitoring a request to create a shadow copy on a computing device, wherein monitoring the request to create the shadow copy comprises invoking a filter driver to intercept the request to create the shadow copy, wherein upon receiving the request to create the shadow copy, the filter driver:
determines a user account that is making the request;
determines what volume the shadow copy is for; and
determines whether the user account has authorization to create the shadow copy based on a shadow copy access policy; and
preventing unauthorized access to the shadow copy based on the shadow copy access policy.
2. The method of claim 1 , wherein preventing unauthorized access to the shadow copy comprises:
denying the request to create the shadow copy based on a specific user, group membership, file path and/or time of day.
3. The method of claim 1 , wherein preventing unauthorized access to the shadow copy further comprises:
determining whether a user account associated with the request is authorized to create the shadow copy on the computing device.
4. The method of claim 1 , wherein preventing unauthorized access to the shadow copy comprises:
determining that a user account is not authorized to create the shadow copy according to the shadow copy access policy.
5. The method of claim 1 , further comprising designating one or more protected files with restricted shadow copy access.
6. The method of claim 1 , wherein a volume shadow copy service monitor accesses a current executing thread to determine the invoker of the request.
7. The method of claim 1 , wherein if a request to create a shadow copy is not authorized by the shadow copy access policy, the filter driver prevents the shadow copy from being made.
8. The method of claim 1 , further comprising configuring the filter driver to perform copy monitoring via region access.
9. The method of claim 8 , wherein copy monitoring via region access comprises:
mapping regions in a sensitive file or shadow copy with bits of a bit array;
observing seeks to read the sensitive file or shadow copy;
marking bits associated with the seeks as dirty;
determining that all of the bits are dirty before the sensitive file or shadow copy is closed; and
generating a flag indicating a copy.
10. A computing device, comprising:
a processor;
a memory in electronic communication with the processor; and
instructions stored in the memory, the instructions being executable to:
monitor a request to create a shadow copy on the computing device, wherein monitoring the request to create the shadow copy comprises invoking a filter driver to intercept the request to create the shadow copy, wherein upon receiving the request to create the shadow copy, the filter driver:
determines a user account that is making the request;
determines what volume the shadow copy is for; and
determines whether the user account has authorization to create the shadow copy based on a shadow copy access policy; and
prevent unauthorized access to the shadow copy based on the shadow copy access policy.
11. The computing device of claim 10 , wherein the instructions executable to prevent unauthorized access to the shadow copy comprise instructions executable to:
deny the request to create the shadow copy based on a specific user, group membership, file path and/or time of day.
12. The computing device of claim 10 , wherein the instructions executable to prevent unauthorized access to the shadow copy comprise instructions executable to:
determine whether a user account associated with the request is authorized to create the shadow copy on the computing device.
13. The computing device of claim 10 , wherein the instructions executable to prevent unauthorized access to the shadow copy comprise instructions executable to:
determine that a user account is not authorized to create the shadow copy according to the shadow copy access policy.
14. The computing device of claim 10 , wherein the instructions are further executable to designate one or more protected files with restricted shadow copy access.
15. The computing device of claim 10 , wherein a volume shadow copy service monitor accesses a current executing thread to determine the invoker of the request.
16. The computing device of claim 10 , wherein if a request to create a shadow copy is not authorized by the shadow copy access policy, the filter driver prevents the shadow copy from being made.
17. The computing device of claim 10 , wherein the instructions are further executable to configure the filter driver to perform copy monitoring via region access.
18. The computing device of claim 17 , wherein copy monitoring via region access comprises:
mapping regions in a sensitive file or shadow copy with bits of a bit array;
observing seeks to read the sensitive file or shadow copy;
marking bits associated with the seeks as dirty;
determining that all of the bits are dirty before the sensitive file or shadow copy is closed; and
generating a flag indicating a copy.