WP-20: Cryptographic Copy-on-Write Delta Journaling & VSS Guard: Autonomous Pre-Encryption Ransomware Rollback

Executive Abstract

Ransomware attacks have evolved into destructive, rapid-execution operations designed to systematically blind incident responders. Modern adversary playbooks immediately target and destroy Windows Volume Shadow Copies (vssadmin delete shadows /all /quiet, wmic shadowcopy delete, PowerShell CIM invocations) before launching high-throughput multi-threaded encryption routines across local and network storage volumes. Once shadow copies are deleted and files encrypted, victims are forced into catastrophic business interruptions or multi-million-dollar extortion demands.

This white paper presents alaskarecover, an autonomous pure-Rust disaster recovery and ransomware rollback system. We formalize two core defensive capabilities: (1) Autonomous VSS Guard, which monitors shadow copy creation, defends shadow storage quotas, and intercepts unauthorized VSS deletion commands; and (2) Cryptographic Copy-on-Write (CoW) Delta Journaling, which captures pre-modification SHA-256 blocks of mission-critical files. In the event of a rapid encryption attack, alaskarecover executes an atomic rollback, restoring unencrypted file states in sub-second intervals without paying a ransom or relying on outdated offsite backups.

1. The Anatomy of Modern Ransomware Destruction


ADVERSARIAL ATTACK CHAIN:
[ Infiltrate Host ] ──► [ Execute vssadmin delete shadows ] ──► [ Rapid Multi-Threaded File Encryption ]
                                       │                                         │
                                       ▼                                         ▼
                            NO RECOVERY POINTS LEFT                    PERMANENT DATA LOSS

ALASKARECOVER AUTONOMOUS INTERCEPTION:
[ File Mutation Event ] ──► [ Copy-on-Write Delta Engine ]
                                       │
                    ┌──────────────────┴──────────────────┐
                    ▼                                     ▼
        VSS Guard Lock Active                   Pre-Write SHA-256 Journal
        • Intercepts deletion commands          • Stores original unencrypted block
        • Preserves shadow allocations          • Instant atomic rollback on breach

2. Copy-on-Write Cryptographic Delta Journaling

Rather than maintaining duplicate full-disk backups that consume immense storage overhead, alaskarecover employs a fine-grained, block-level delta journal:

1. Pre-Write Interception: Before any file modification is committed to disk by an external process, alaskarecover captures the original unencrypted byte block.

2. Cryptographic Validation: Each captured block is hashed using SHA-256 and stored in an immutable, append-only journal in isolated storage (C:\AlaskaRecover_Journal).

3. Heuristic Encryption Detection: If a rapid burst of high-entropy writes is detected across designated file directories, alaskarecover immediately freezes the suspect process via alaskacommand and triggers atomic restoration.

4. Atomic Rollback: Replaces compromised file sectors with clean pre-modification blocks in reverse chronological order, guaranteeing zero loss of transactional integrity.

3. VSS Shadow Copy Armor

Windows Volume Shadow Copy Service provides efficient snapshot capabilities, but is left completely unguarded in standard Windows deployments. alaskarecover implements active defenses:

Command Line Heuristics: Continuously monitors process creations for known VSS destruction patterns (vssadmin, wmic, diskshadow, powershell).
Access Control Hardening: Restricts write access to shadow storage volumes, preventing malicious kernel and user processes from wiping restore points.