OrcCommand: NtfsInfo: fix volstat incomplete output for vss

DFIR-ORC · Jun 4, 2024 · 6996912 · 6996912
1 parent ff4f7e4
commit 6996912
Showing 1 changed file with 19 additions and 4 deletions.
diff --git a/src/OrcCommand/Command/NTFSInfo/NTFSInfo_Run.cpp b/src/OrcCommand/Command/NTFSInfo/NTFSInfo_Run.cpp
@@ -695,20 +695,36 @@ HRESULT Main::WriteVolStats(
             outputPaths = it->second;
         }
 
-        auto reader = loc->GetReader();
+        auto ntfsReader = loc->GetReader();
 
-        if (reader == nullptr)
+        if (ntfsReader == nullptr)
         {
             return E_FAIL;
         }
 
+        if (ntfsReader->VolumeSerialNumber() == 0)
+        {
+            int debug = 0;
+        }
+
+        std::shared_ptr<VolumeReader> reader;
+        auto shadow = loc->GetShadow();
+        if (shadow && shadow->parentVolume)
+        {
+            reader = shadow->parentVolume;
+        }
+        else
+        {
+            reader = ntfsReader;
+        }
+
         SystemDetails::WriteComputerName(volStatOutput);
         volStatOutput.WriteInteger(reader->VolumeSerialNumber());
         volStatOutput.WriteString(reader->GetLocation());
         volStatOutput.WriteString(FSVBR::GetFSName(reader->GetFSType()).c_str());
         volStatOutput.WriteBool(loc->GetParse());
         volStatOutput.WriteString(fmt::format(L"{}", fmt::join(loc->GetPaths(), L";")));
-        volStatOutput.WriteString(loc->GetShadow() ? ToStringW(loc->GetShadow()->guid).c_str() : L"");
+        volStatOutput.WriteString(shadow ? ToStringW(shadow->guid).c_str() : L"{00000000-0000-0000-0000-000000000000}");
 
         if (!outputPaths)
         {
@@ -823,7 +839,6 @@ HRESULT Main::RunThroughMFT()
             Log::Error("Failed to create writers for NTFSInfo [{}]", SystemError(hr));
             return hr;
         }
-
     }
 
     auto fileinfoIterator = begin(m_FileInfoOutput.Outputs());