Windows OSVolume Shadow Copy
application/octet-stream
Magic Bytes
Offset: 0
69 63 6E 73
The Windows OS Volume Shadow Copy (VSC) format is a technology developed by Microsoft Corporation for creating point-in-time snapshots of disk volumes. It is primarily used to facilitate system backups, file restoration, and data preservation without interrupting active disk operations. While classified as safe, this format is frequently leveraged in digital forensics to recover deleted information and is often targeted by ransomware to prevent data recovery.
Validation Code
How to validate .vsc files in Python
Python
def is_vsc(file_path: str) -> bool:
"""Check if file is a valid VSC by magic bytes."""
signature = bytes([0x69, 0x63, 0x6E, 0x73])
with open(file_path, "rb") as f:
return f.read(4) == signatureHow to validate .vsc files in Node.js
Node.js
function isVSC(buffer: Buffer): boolean {
const signature = Buffer.from([0x69, 0x63, 0x6E, 0x73]);
return buffer.subarray(0, 4).equals(signature);
}
Go
func IsVSC(data []byte) bool {
signature := []byte{0x69, 0x63, 0x6E, 0x73}
if len(data) < 4 {
return false
}
return bytes.Equal(data[:4], signature)
}API Endpoint
GET
/api/v1/vsc
curl https://filesignature.org/api/v1/vsc