Volume Shadow Copies

Location & availability

Existing VSS snapshots of the relevant Windows volume

Snapshots may be absent or outside the needed period. Application consistency and acquisition method matter.

Fields to examine

• Snapshot identity, source volume and snapshot time.
• The exact path and bytes recovered from that snapshot.
• Comparison with current files or a second snapshot.

What it can establish

• Support the state of an acquired item within the examined snapshot.

What it cannot prove

• Precisely date every change between two snapshots.
• Claim completeness for files or transactions not consistently captured.

Use it in a screenshare

1. Inventory existing snapshots without creating or deleting them on the player’s machine.
2. Acquire only scoped files through a trusted read-only collection method and record snapshot provenance.
3. Compare hashes and metadata with current sources. Describe an interval when a change falls between snapshots, rather than inventing a single action time.

Worked example

An earlier snapshot contains a configuration missing from the current instance. This supports a difference between captured states. Correlate journal and log records to narrow when and why the difference occurred.

Cross-check the finding

• $MFT →Support the presence and recorded metadata of a particular file record.
• USN Journal / $UsnJrnl →Support recorded file/directory changes and a sequence within retained journal coverage.
• Registry transaction logs →Help reconstruct a supported recoverable hive state.

Sources

• Microsoft — Volume Shadow Copy Service ↗