Have you ever dug for deleted shadow copies during your Windows forensic examination? If not, this post will help you understand better what happens after their deletion, and it’s very important, because, as it’s noted in the post, “Volume Shadow Copy”(VSS/VSC) is important artifacts for examiners – it stores previous data as snapshots.

Load More Related Articles
Load More In Articles

Leave a Reply

Your email address will not be published. Required fields are marked *