Refine Volume Snapshot
Abstract
The Refine Volume Snapshot (RVS) is one of the most powerful and configurable features of X-Ways Forensics. It is with the RVS that additional items are added to a case including carved files of almost every type, file metadata, the contents of compressed files, hash value computations and comparisons against hash sets, and a number of other forensic artifacts.
Although the default settings of the RVS will be more than sufficient for almost every analysis, the RVS process allows for the examiner to specify the exact steps to take for a given examination and, in doing so, avoid unnecessary processing of evidence.
Keywords
Refine Volume Snapshot; RVS; Data carve; Compressed; Encrypted; E-mail; Hash; File ...
Get X-Ways Forensics Practitioner’s Guide now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.
