Windows Forensics Cookbook

Introduction

Shadow copies, also known as volume shadow copies, are backup copies of Windows files that are taken during the normal course of use of a machine running on NTFS. For the average computer user, shadow copies may be familiar, as they are what make it possible to create Windows backups, or to perform system restores when something goes wrong.

These have obvious applications for digital forensic practitioners, particularly in cases where a suspect may have tried to delete evidence from a machine. By restoring the system to its previous state, or by using forensic tools to uncover files that are saved in shadow copy locations, forensic practitioners may be able to deduce information that an individual has tried to hide.

However, ...