Deleted Volume Shad...
 
Notifications
Clear all

Deleted Volume Shadow Copies

4 Posts
3 Users
0 Likes
422 Views
(@jjh2320)
Posts: 21
Eminent Member
Topic starter
 

Hi All,

Have never posted asking a question on here before, so please, be gentle.

I'm looking at Volume Shadow Copies. I have managed to view the live VSC, however, I can see on the image that there a couple, 2/3, which have been deleted. I can export these files in full but I can't read them in anyway. I am guessing that they cannot be added directly to the Volume System Folder and there is no pointer in the log files for them.

I have also googled this, however, only get references to recovering files within VSC themselves. I have placed the VSC in the correct folder on the local machine and this was unable to detect them.

I was wondering if anyone knew a way, or had any ideas, of how to view these deleted Volume Shadow Copies?

Thank you in advance.

J

 
Posted : 27/01/2015 12:21 am
PaulSanderson
(@paulsanderson)
Posts: 651
Honorable Member
 

Try Reconnoitre - depending on what has happened to the VSC's since deletion you may get some dtaa back. Like all deleted data YMMV.

http//sandersonforensics.com/forum/content.php?113-Software&tabid=38

 
Posted : 27/01/2015 1:26 pm
(@jjh2320)
Posts: 21
Eminent Member
Topic starter
 

Hi Paul,

Thanks for the reply.

Have had a look at the software and doesn't look as though its interpreting the deleted shadow copies in any way.

Theres no real urgency surrounding the matter, as its to do with a University project. Think i'll have another look at alternative software to see if these can be viewed or reconstructed in any way.

Thanks

 
Posted : 10/02/2015 5:16 pm
(@fuzed)
Posts: 93
Trusted Member
 

not sure if this is of help, i've used this guide before to image out these for further work/examinations etc..

http//journeyintoir.blogspot.co.uk/2012/01/ripping-volume-shadow-copies.html

 
Posted : 10/02/2015 5:40 pm
Share: