Tag Archives: VSC

Volume Shadow Copy

Volume Shadow Copy Part 4

File History Windows 8 and 8.1   As mentioned in our second blog, the Volume Shadow Copy Service is still available on Windows 8. However, we have since discovered that on Windows 8.1 the service was removed, leaving File History to perform a similar function. Here is a brief overview of File History:   What […]

Continue reading
Volume Shadow Copy

Volume Shadow Copy Part 3

What we found in the Volume Shadow Copy for Windows 7 After creating a raw image of the Volume Shadow Copy, we were able to view it in both FTK and Encase. We most often used Encase to examine the raw image file and received positive results. We cross referenced the log of what was […]

Continue reading
Volume Shadow Copy

Volume Shadow Copy Part 2

Where is Volume Shadow Copy on your system? In part two of our blog series on Volume Shadow Copies, we clear up the common misconception that VSC has been removed from Windows 8 and briefly describe how to find the VSC files. We are again looking at Windows XP, Windows 7, and Windows 8.1. Volume […]

Continue reading