Volume Shadow Copy
Definition
Windows' snapshot mechanism (VSS). Creates point-in-time copies of files and folders. Examiners find shadow copies particularly useful because users rarely know the mechanism exists and Windows often preserves data the user believed was overwritten.
- Platform
- Windows
- Abbreviation
- VSS
- Function
- Point-in-time snapshots of files and folders
- Investigative value
- Preserves data users believe was deleted or overwritten
Common questions
Why is Volume Shadow Copy particularly valuable in an examination?+
Most users are unaware the mechanism exists, so they take no steps to disable or clear it. As a result, a shadow copy can retain earlier versions of files, including ones later deleted, modified, or overwritten by malware or anti-forensic activity, well after the current volume state no longer shows them.
Are shadow copies always present and recoverable on a Windows system?+
No. System Restore and shadow copy creation depend on configuration, available disk space, and Windows edition, and shadow copies are periodically purged as new ones are created or space runs low, so their presence and depth of history varies by system.
Related terms
- File Slack
- The unused space at the tail of the last cluster of a file. It can contain remnants of whatever previously occupied that...
- Journal (File-System)
- A circular log of file-system changes that allows recovery after a crash. NTFS keeps $LogFile, ext3/ext4 keep a dedicated journal block, APFS...
- Kernel Space vs User Space
- Kernel space is the privileged execution mode where the OS schedules processes, drives hardware and enforces memory protection. User space is the...
- MAC Timestamps
- Modified, Accessed, and Changed or Created times. Different file systems use the letters differently: on POSIX it is mtime, atime, ctime (change...
- MBR vs GPT
- Master Boot Record is the legacy partition table at LBA 0, limited to 4 primary partitions and 2 TiB. GUID Partition Table...