Windows Shadow Volumes

From ForensicsWiki
Revision as of 20:06, 29 August 2012 by Joachim Metz (Talk | contribs) (Volume Shadow Copy Service)

Jump to: navigation, search

Volume Shadow Copy Service

Windows has included the Volume Shadow Copy Service in it's releases since Windows XP. The Shadow Copy Service creates differential backups periodically to create restore points for the user. Windows 7 Professional and Ultimate editions include tools to work with and manage the Volume Shadow Copy Service, including the ability to mount shadow volumes on disk images.

In Windows 8 the shadow volumes seem to have been superseded by File History. For now it looks like it uses similar structures as it's predecessors.

Also see

External Links

Tools