AuthorAndrew Case

Total time: 10 minutes

The Volume Shadow Service (VSS) provides block-level differential backups for volumes which it is active on. Accessing these backups, known as copies, during a forensics investigation can let investigators recover files, metadata, and other forensics artifacts going back far in time. In this module we discuss the Volume Shadow Service, how to access the copies it creates, and some of the pitfalls investigators face when first dealing with the VSS.

More Modules In This Lesson
New Modules

Want to be the first to know about new modules?

Notify Me