1

I have a Windows 10 WAMP server running, and Windows by default has a hidden folder in every partition called "System Volume Information". I can't access it because Windows denies it, but I noticed something strange.

If I have Apache running with directory listing enabled, I can see the contents of the folder by typing in the URL http://mydomain.com/system volume information. I can open the files inside this folder but they're all encoded, so it looks like gibberish. (They're .log and .dat files) If everyone can view this data, is anything compromised? Can people view the entire contents of my partition or something?

If I want this hidden I would have to go to each of my many webserver partitions and put a .htaccess file in all of them.

Am I at risk by leaving it open?

Improve this question
1
  • yes, there are (could be) all sorts of things you don't want the world to know: content indexes, system restore checkpoints, even bits of whole volumes (if using shadow copy)...
    – dandavis
    Jul 28, 2016 at 17:31

3 Answers 3

Reset to default
3

This is an old question, but a few points have been left out of the other answers.

First, to directly answer the question, yes, the System Volume Information folder can contain sensitive data. As Sorcha described, DFS in particular will store files there by default, but so will many other system services and applications. VSS, System Restore, etc as mentioned by dandavis. Most of these applications and services store their data on the System volume (C) or on the volume being backed up by VSS, so your exposure from the System Volume Information folder on volume G is limited to the data on volume G, though most of this can be configured away from the defaults.

However, there's more going on here than just the potential security risk of the System Volume Information folder.

  1. Having Directory Listing enabled on Apache is a security risk.
  2. Pointing Apache to the root of your volume is a security risk.

From this perspective, you're essentially expressing concern that someone might snoop around the contents of your closet when you've left your front door open. You can put a lock on the closet, but maybe you should just shut and lock the front door?

On a side note, I'm going to add that it sounds like you're using typical *nix practices, like splitting your website into multiple partitions, in a Windows environment. Windows is great if you need your server to do more than one thing, to integrate with other servers that do more than one thing, or to host a .NET website. If all you're running is Apache web server, you'll find nearly any flavor of *nix to be more secure and better performing.

Improve this answer
0

A lot of services from Windows put their system files in this directory (DFS, FSRM,etc...). For example, DFS (Distributed File System) put their entire configuration, all the files will be replicated and all the files with a replication problem. So it can be problematic if one of these files is important.

Improve this answer
0

System Volume Information does present a risk and access to it can be gained by the usual means of access & ownership.

Best practice I found is not using it at all. Practically, windows does respawn an empty one but that's as far as it goes, since there will never be data stored in it.

If you have to use VSS, the folder will have to be left alive.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .