Volume Shadow Copy
Definition
Windows' snapshot mechanism (VSS). Creates point-in-time copies of files and folders. Examiners find shadow copies particularly useful because users rarely know the mechanism exists and Windows often preserves data the user believed was overwritten.
Related terms
- File Slack
- The unused space at the tail of the last cluster of a file. It can contain remnants of whatever previously occupied that...
- Journal (File-System)
- A circular log of file-system changes that allows recovery after a crash. NTFS keeps $LogFile, ext3/ext4 keep a dedicated journal block, APFS...
- Kernel Space vs User Space
- Kernel space is the privileged execution mode where the OS schedules processes, drives hardware and enforces memory protection. User space is the...
- MAC Timestamps
- Modified, Accessed, and Changed or Created times. Different file systems use the letters differently: on POSIX it is mtime, atime, ctime (change...
- MBR vs GPT
- Master Boot Record is the legacy partition table at LBA 0, limited to 4 primary partitions and 2 TiB. GUID Partition Table...
Explained in
- Operating Systems, Boot Process and File SystemsWindows' snapshot mechanism (VSS). Creates point-in-time copies of files and folders. Examiners find shadow copies particularly useful because users rarely kno...