Home Articles Deleted Shadow Copies

Deleted Shadow Copies


Have you ever dug for deleted shadow copies during your Windows forensic examination? If not, this post will help you understand better what happens after their deletion, and it’s very important, because, as it’s noted in the post, “Volume Shadow Copy”(VSS/VSC) is important artifacts for examiners – it stores previous data as snapshots.

Load More Related Articles
Load More In Articles
Comments are closed.