Notifications
Clear all

Shadow volume exams

4 Posts
3 Users
0 Likes
226 Views
(@jimmyw)
Posts: 64
Trusted Member
Topic starter
 

I created a blog to discuss virtual machines and shadow volumes http//JustAskWeg.com/. I started with creating a VMware virtual machine from a dd image. I've progressed through shadow volume exams and preserving the evidence. I hope to post some more tutorials as time permits. I’m going to emphasize X-Ways Forensics, but will include some other tools, like Dan Mares’ VSS (free). Dan also produces some very handy, free tools for use with XWF. http//www.maresware.com/. Comments are welcome.

 
Posted : 31/07/2012 7:01 am
(@jonathan)
Posts: 878
Prominent Member
 

Great blog Jimmy, really informative. Thanks for sharing your findings.

 
Posted : 31/07/2012 2:52 pm
keydet89
(@keydet89)
Posts: 3568
Famed Member
 

From the MaresWare page

"As of January 2010 Mares and Company will no longer be selling the Maresware software.

There will be minimal availability to selected individuals."

 
Posted : 31/07/2012 4:02 pm
(@jimmyw)
Posts: 64
Trusted Member
Topic starter
 

I think that Dan isn't "selling" software, but the free tools on his site are available. Perhaps the message should be changed, and I'll suggest that to Dan. VSS is, however, available near the botton of the right column.

Edit A modification of the site intro is in the works.

 
Posted : 31/07/2012 8:08 pm
Share: