VSS

Volume Shadow Copy as an aid to forensic investigations

While conducting forensics examinations I have come across several instances where past activity record on the system had proved helpful. Volume Shadow copy forensics is one of them. What is Volume shadow copy service (VSS):  Also known as volume snapshot service; the feature was introduced with Windows XP. The Idea was to create a backup […]

Read More »