Blog Feed

TrueCrypt is a great open source encryption solution to protect data, but it can lock horns with the Windows Volume Shadow Copy Service. Learn how to untangle the two products.

A large part of working in IT involves figuring out how to prevent bad things from happening — or if they do occur, how to ensure they don’t happen again. While some might term this “closing the barn door after the horse has escaped,” I prefer to think of it as “building the habit of closing the barn door so he won’t get out again.”  Of course, that’s often when you find out the barn door might not look too pretty when you’re trying to keep it shut.

This was recently exemplified by an episode I experienced at a client site that involved a critical folder accidentally deleted from a Windows 2008 file server. It was a fairly typical scenario where the folder had somehow gotten lost through user mishap one afternoon. No problem. Just restore last night’s backup, right? Well, no dice to that idea since the files had all been created that day, after the previous backup finished.

But the game wasn’t quite over, because the client uses the Volume Shadow Copy Service on the server and it was set to take a snapshot of the data volume (H: drive) twice per day – at 10 am and 2 pm. We looked at the 2 pm snapshot using the Previous Versions function in Windows (whereby you right-click a network folder, choose Properties, click the Previous Versions tab, browse to the data you want, then copy it to the live location).  We managed to obtain three files from it, but the remaining dozen or so were still gone because they had been created after 2.

Figuring it couldn’t hurt to gamble with free utilities, we tried the undelete programs Recuva and FreeUndelete but did not find any files to recover. I have only had middling at best luck with these types of programs, but they can still be worth a shot — though for some reason they always seem capable of recovering unimportant files rather than important ones.

Cutting losses and preparing for next time

That brought us to the end of the road. The user had to re-create the missing files, which wasn’t the end of the world, but we figured rather than taking volume snapshots of the server H: drive twice per day, perhaps a better idea would be to do so hourly during business operations.

Configuring the Volume Shadow Copy Service snapshot schedule is easy. You just log onto the Windows server, right-click the volume in question, choose Properties, and then choose the Shadow Copies”tab. However, when we did this we got the error shown in Figure A.

Figure A

Uh, what?

This error seemed to indicate a problem with the Volume Shadow Copy Service. The service seemed to be running okay, and as previously stated we were able to access the data it protected, but some vague errors appeared in the Application Logs:

“Volume Shadow Copy Service error: Error calling a routine on a Shadow Copy Provider {b5946137-7b9f-4925-af80-51abd60b20d5}. Routine details Cannot ask provider {b5946137-7b9f-4925-af80-51abd60b20d5} if volume is supported. [0x8000ffff] [hr = 0x8000ffff].”

Research indicated that the issue was caused by TrueCrypt running on the server. TrueCrypt is an open source encryption solution that allows you to encrypt entire disks, partitions, or special volumes (called containers) to securely store data. I use it for my personal documents and it provides great peace of mind.

In my client’s case, they have an encrypted TrueCrypt 7.1a volume on this server mounted as its own drive (I:), which has folders that are shared and secured via the normal Windows server methods. This volume exists to safeguard extra-sensitive confidential data. When the server boots up and is logged in, a command runs automatically, which mounts the TrueCrypt volume after prompting for the password:

“c:\program files\truecrypt\truecrypt” /q /m /l i h:\Security.TC

This performs the following functions:

c:\program files\truecrypt\truecrypt calls the TrueCrypt executable

/q tells the TrueCrypt program to prompt for the volume password

/m tells the TrueCrypt program to mount a volume

/l i tells the TrueCrypt program to mount the encrypted volume as the I: drive

h:\Security.TC is the actual TrueCrypt encrypted container object

We decided to try dismounting the TrueCrypt volume to see if that Volume Shadow Copy Service error went away (Figure B).

Figure B

This was as simple as launching TrueCrypt then selecting the I: drive and clicking Dismount. Once this was done, the Shadow Copies tab appeared as normal (Figure C).

Figure C

We were then able to set hourly shadow copies of the H: drive, as shown. What would happen when we remounted the TrueCrypt volume, though?

As it turned out, the same error showed on the Shadow Copies tab, but it did not interfere with the actual Shadow Copy operation — nor were backups affected. As you can see in Figure D, the hourly snapshots were being faithfully generated (and we made sure to test this).

Figure D

It seems this is a known issue, which TrueCrypt has acknowledged. There are lots of references to the issue on the TrueCrypt forums, and it’s clear this situation has existed for some time. The site states that:

“The Windows Volume Shadow Copy Service is currently supported only for partitions within the key scope of active system encryption (e.g., a system partition encrypted by TrueCrypt, or a non-system partition located on a system drive encrypted by TrueCrypt, mounted when the encrypted operating system is running). Note: For other types of volumes, the Volume Shadow Copy Service is not supported because the documentation for the necessary API is not available.”

It should be pointed out that this essentially says that we’re using TrueCrypt in a non-supported fashion, but that’s an acceptable scenario since it’s performing per our needs and has been for some time.

I got curious to see if I could circumvent the error via other methods. I didn’t want to make any changes to the system drive, but I did want to see whether encrypting an entire test volume with TrueCrypt (as opposed to the container method I described) might change the situation. Unfortunately, it did not. I also tried this on another server, making sure to keep the encrypted file container on a separate volume from the one for which I was trying to configure shadow copies, but the same error resulted.

Learning to live with things

In the end, some barn doors may get slammed shut and still look crooked, but at least they’re shut. It’s not a big deal for us to have to dismount the TrueCrypt volume to make changes to the Shadow Copy options on this server. In fact, we probably won’t have to make any changes again anyway. So long as the Volume Shadow Copy Service is working as expected, we’re satisfied with the results.

However, it’s interesting to see how these kinds of problems might arise and how to handle them. If I were younger and more impetuous I probably would have slogged on, stubbornly searching for some kind of solution — perhaps backing up, reformatting, and then restoring the volume, for instance. Nowadays, though, the fear of losing valuable business hours to a cosmetic issue (as opposed to something that is actually broken) outweighs the lure of finding a solution that may not exist, like a treacherous will o’ the wisp. You have to pick and choose your battles in the IT realm and decide where your priorities lie, just as you do everywhere else.

Justin Parrott (Abu Amina Elias)

In the name of Allah, the Gracious, the Merciful

Advocating violent conquest or terrorism is one of the most common accusations against Islam, but it is also deeply uninformed of Islamic teachings, history, and theology. Muslims can point to many, many verses in the Qur’an to debunk the myth, like the verse, “If they incline to peace, then incline to it as well and put your trust in God.” The early Muslims fought a defensive war of survival against an enemy determined to exterminate the new religion, but even then, God commanded them to make peace if possible. The Prophet (peace be upon him) himself said, “Verily, after me, there will be conflicts or affairs, so if you are able to end them in peace, then do so.”¹ If Islam is a religion of peace, how is it misrepresented?

A key concept in Qur’anic exegesis is called “abrogation”. It refers to the phenomena of a later verse altering or replacing the rule of a previous verse. The clearest example is the gradual prohibition of alcohol, which was permissible at first, then it was discouraged (2:219), then it was prohibited to come to prayer intoxicated (4:43), and finally it was completely prohibited (5:90). The wisdom in this sequence is that, since most people cannot quit “cold turkey,” alcohol needs to be tapered off. Hence, the final ruling of alcohol prohibition “abrogated” the previous rules. Have the rules of war in the Qur’an been abrogated in the same way?

Anti-Muslim writers, and some extremist Muslims, make the far-fetched claim that all verses in the Qur’an encouraging peace, mercy, and fairness with non-Muslims have been abrogated by the so-called “verse of the sword”. The verse reads, “When the sacred months have passed, kill the idolaters wherever you find them,” (9:5) but rarely do they finish the verse, “If they repent, perform prayer, and give charity, let them go their way, for God is forgiving and merciful.” The entire passage discusses the hostile Arab tribes who “broke their treaty” and “attacked you first” (9:13). It also offers immunity to any enemy who “seeks your protection” and, regardless of whether they accept Islam or not, to “deliver him to his place of safety” (9:6). To think one sentence from a verse cancels hundreds of verses before it, as well as around it, is quite a stretch. Qur’anic scholar M.A.S. Abdul Haleem states, “The whole of this context to verse 9:5, with all its restrictions, is ignored by those who simply isolate one part of a sentence to build on it their theory of violence in Islam.”²

Some scholars of the classical period did say the verse of the sword abrogates many verses before it, but what did they mean by that? Abrogation itself is a very nuanced topic, as the word has been used to mean everything from a complete repeal to a narrowly limited exception. Types of partial abrogation came to be known as ‘specification’ (takhsis), ‘restriction’ (taqyid), ‘explanation’ (tafsir), ‘clarification’ (tabyin), ‘exceptional’ (istithna’), and ‘conditional’ (shart).³ The previous rule was changed or “abrogated” to account for a new situation, but it was not nullified, invalidated, or canceled entirely. Scholars who said a verse was abrogated did not mean it was cancelled. Even then, many classical scholars such as Abu Ja’far al-Nahhas (d. 949), Ibn al-Jawzi (d. 1201), and Al-Suyuti (d. 1505) only accepted about twenty cases of genuine abrogation in the Qur’an, none of which involved the verse or verses of the sword.⁴

The primary verse laying down the rules of war states, “Fight in the way of God against those who fight you, but do not transgress. Verily, God does not love transgressors.”⁵ Was this verse abrogated? Ibn Abbas (d. 687), the cousin of Prophet Muhammad (peace be upon him), did not think so. He stated that the verse outlaws killing “women, children, old men, or whoever comes to you with peace and he restrains his hand [from fighting],”⁶ or in other words, it means it is unlawful to harm civilians and non-combatants. In fact, most Muslim scholars throughout history agreed with him. The classical scholar Ibn Taymiyyah (d. 1328) wrote at length to rebut the claim that this verse had been nullified, “This opinion [that the verse 2:190 is not abrogated] is the opinion of the majority of scholars… Indeed, to claim abrogation requires proof and there is nothing in the Qur’an to contradict this verse. Rather, what is in the Qur’an is consistent with it, so where is the abrogating verse?”⁷

Ibn Taymiyyah’s view is supported by the statement of the Prophet (peace be upon him), “Verily, the most tyrannical of people to God Almighty is one who kills those who did not fight him.”⁸ There has never been any justification in Islam, from its inception until today, to kill or harm people because of their religion. Islam only allows violence as a self-defensive response to aggression or to put an end to the persecution of innocent people, Muslims and non-Muslims alike.

Wahbah al-Zuhayli (d. 2015), a leading modern scholar on Islamic international law, summarizes the majority view in his commentary on the Qur’an:

The lesson derived from this verse 2:190 and others related to the legislated conditions of warfare and the permissible rulings in jihad are as follows:

1) Warfare is legislated in the cause of Allah to repel aggression, protect preaching Islam, and freedom of divine religion.

2) This legislation is characterized by justice and truth, in which there is no transgression against anyone, nor overlooking what is necessary in war. The aim is not to demolish and tear down, nor merely to terrorize. Thus, non-combatants are not killed, nor are women, children, and those like them among monks, the disabled, the sick, and the elderly. Crops and fruits are not razed, nor are animals slaughtered except for food, as has come in the prophetic instructions and those of the righteous Caliphs.

3) Warfare is not for compelling people to embrace Islam, as that would defeat the principal ruling of the Qur’an in many verses.⁹

The claim that the Qur’an commands Muslims to murder non-believers is simply false. Warfare, or jihad, can only be conducted under strict circumstances and for a just cause, as has been detailed by scholars. Rather, Islam teaches us to be kind, fair, and compassionate to all people, as God said in the Qur’an, “We have not sent you, O Muhammad, but as mercy for the worlds.” (21:107)

Success comes from Allah, and Allah knows best.

1. Aḥmad Ibn Ḥanbal, Al-Musnad (al-Qāhirah: Dār al-Ḥadīth, 1995), 1:469 #695; declared authentic (ṣaḥīḥ) by Aḥmad Shākir in the commentary.
2. Muhammad A. S. Abdel Haleem, The Qur’an: English Translation with Parallel Arabic Text (Oxford: Oxford University Press, 2010), p. xxiii.
3. Ibn Qayyim al-Jawzīyah, Iʻlām al-Muwaqqiʻīn ’an Rabb al-‘Ālamīn (Dar al-Kutub al-ʻIlmiyah, 1991), 1:29.
4. Khalid Yahya Blankinship, “Sword Verses,” in The Oxford Encyclopedia of the Islamic World. Oxford Islamic Studies Online.
5. The Qur’an, Sūrat al-Baqarah 2:190.
6. Ṭabarī, Tafsīr al-Ṭabarī min kitābihi Jāmi’ al-Bayān ‘an Ta’wīl Āy al-Qur’ān (Bayrūt: Mu’assasat al-Risālah, 1994), 3:563.
7. Ibn Taymīyah, Qāʻidah Mukhtaṣarah fī Qitāl al-Kuffār wa Muhādanatuhum wa Taḥrīm Qatlahum li Mujarrad Kufrihim (al-Riyād: ʻAbd al-ʻAzīz ibn ʻAbd Allāh ibn Ibrāhīm al-Zayr Āl Ḥamad, 2004), 101.
8. Aḥmad Ibn Ḥanbal, Al-Musnad, 6:233-234 #6681; declared authentic (ṣaḥīḥ) by Aḥmad Shākir in the commentary.
9. Wahbah al-Zuḥaylī, Al-Tafsīr al-Munīr, 2nd ed. (Bayrūt: Dār al-Fikr al-Mu’āṣir, 1997), 2:183.