{"success":true,"data":{"ext":"vsc","name":"Windows Volume Shadow Copy index block","description":"Windows Volume Shadow Copy index block is a data structure used by Microsoft Windows within the Volume Shadow Copy Service (VSS) to track snapshot metadata. It supports backup utilities, system restore features, and forensic or recovery tools that inspect shadow copies on NTFS volumes. The format is generally safe and remains part of Windows storage and backup infrastructure, with no notable standalone security concerns beyond handling untrusted disk images.","mime":[],"risk_level":"Safe","signatures":[{"hex":"68 87 08 38 76 C1 48 4E B7 AE 04 04 6E 6C C7 52 01 00","offset":0,"sources":[{"name":"Gary Kessler","url":"https://www.garykessler.net/library/file_sigs_GCK_latest.html"}]}],"related":[],"usage":{"python":"def is_vsc(file_path: str) -> bool:\n    \"\"\"Check if file is a valid VSC by magic bytes.\"\"\"\n    signature = bytes([0x68, 0x87, 0x08, 0x38, 0x76, 0xC1, 0x48, 0x4E, 0xB7, 0xAE, 0x04, 0x04, 0x6E, 0x6C, 0xC7, 0x52, 0x01, 0x00])\n    with open(file_path, \"rb\") as f:\n        return f.read(18) == signature","node":"function isVSC(buffer: Buffer): boolean {\n  const signature = Buffer.from([0x68, 0x87, 0x08, 0x38, 0x76, 0xC1, 0x48, 0x4E, 0xB7, 0xAE, 0x04, 0x04, 0x6E, 0x6C, 0xC7, 0x52, 0x01, 0x00]);\n  return buffer.subarray(0, 18).equals(signature);\n}","go":"func IsVSC(data []byte) bool {\n    signature := []byte{0x68, 0x87, 0x08, 0x38, 0x76, 0xC1, 0x48, 0x4E, 0xB7, 0xAE, 0x04, 0x04, 0x6E, 0x6C, 0xC7, 0x52, 0x01, 0x00}\n    if len(data) < 18 {\n        return false\n    }\n    return bytes.Equal(data[:18], signature)\n}"}}}