The Fourth Amendment site has posted an interesting result for a search and seizure suit, related to digital forensics.

United States v. Stewart, 2010 U.S. Dist. LEXIS 50876 (E.D. Mich. May 24, 2010)

A laptop searched at the border turned up illegal data. A second laptop had no power and no adapter so it was instead seized and taken away to a lab where further investigation could be performed. This provoked a lawsuit claiming Fourth Amendment rights were violated.

The US District Court just ruled that law enforcement needs to show “a particularized and objective basis for suspicion” to be allowed to move data/devices to forensic labs.

Microsoft has published a utility called disk2vhd.exe that is meant to make it easy to convert a physical Windows system into a virtual disk.

Disk2vhd is a utility that creates VHD (Virtual Hard Disk – Microsoft’s Virtual Machine disk format) versions of physical disks for use in Microsoft Virtual PC or Microsoft Hyper-V virtual machines (VMs). The difference between Disk2vhd and other physical-to-virtual tools is that you can run Disk2vhd on a system that is online. Disk2vhd uses Windows’ Volume Snapshot capability, introduced in Windows XP, to create consistent point-in-time snapshots of the volumes you want to include in a conversion.

A customer asked for help tracking down errors when they tried to use the utility. They were unable to get a snapshot started because it immediately posted a non-descriptive error. With a little sleuth work I found that disk2vhd.exe has quite a bit of trouble as a result of its dependency on the Volume Shadow Copy Service (VSS). Here is how I located and resolved the VSS errors.

First, the Event Viewer is essential to unlocking problems on Windows. Open it up and review the Application event lists. Look for a VSS error. Open the Services control (run services.msc) and restart “Volume Shadow Copy” service. You may see something like this:

Ignore that link for more help. It actually is no help. Instead, note Event ID 12302 and go to Microsoft knowledgebase article 907574:

You receive a “Volume Shadow Copy Service” error message and event 5013 or event 12302 is logged when you use the Backup feature in Windows XP or in Windows XP Tablet PC Edition 2005…

This problem occurs because the Location registry entry in the following registry subkey is incorrect or missing:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ContentIndex\Catalogs
This problem occurs when you uninstall a program that is listed in this registry subkey, but only the location information is removed from the registry subkey.

Follow the instructions for fixing or removing the bad subkeys. That worked on one system.

Another method to find errors is to check VSS operations with vssadmin.

Type “vssadmin list writers” at a command prompt and you may see this:

This brought me to the same Event ID but Microsoft proposed a different solution. Knowledgebase article 940184 covers how to clear and reset a failure in COM and VSS:

This problem may occur if the following registry key is corrupted: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EventSystem\{26c409cc-ae86-11d1-b616-00805fc79216}\Subscriptions

Their solution is a bit lengthy, so here is a quick batch file version that should make it easy.

Copy and paste the following commands into a file named VSSrepair.bat, then run it to execute the commands from 940184:

@echo off
REM
REM https://www.flyingpenguin.com
REM
REM Batch file to repair a Volume Shadow Copy (VSS) installation
REM based on https://support.microsoft.com/kb/940184
REM
echo --- !! WARNING !! WARNING !! WARNING !! WARNING
echo.
echo --- Run this with Administrator privileges only
echo.
echo --- NOT for use with Windows Vista, Windows Server 2008,
echo --- or later versions of Windows. Windows Vista and
echo --- Server 2008 use manifest-based component installation;
echo --- manual registration of components can cause serious failure
echo --- and require Windows reinstall to resolve.
echo.
echo --- !! WARNING !! WARNING !! WARNING !! WARNING
REM
pause
cd /d %windir%\system32
echo.
net stop vss
net stop swprv
regsvr32 ole32.dll
regsvr32 oleaut32.dll
regsvr32 /i eventcls.dll
regsvr32 vss_ps.dll
vssvc /register
regsvr32 /i swprv.dll
regsvr32 es.dll
regsvr32 stdprov.dll
echo --- vssui.dll is only for Windows 2003. Ignore this error on XP
regsvr32 vssui.dll
regsvr32 msxml.dll
regsvr32 msxml3.dll
echo --- msxml4.dll is optional and thus may fail. Ignore this error
regsvr32 msxml4.dll
pause

The knowledge base article then recommends you type “vssadmin list writers” from the command prompt. Success means you will see a list like this one:

Hope that helps save some time. There could be more issues to VSS, but these two methods worked for me.

Updated to add: if you have Visio installed you may have to remove the following registry entry

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ContentIndex\Catalogs\Visio