Volume Shadow Copy (VSS)
Definition
Block-level snapshots of NTFS volumes maintained by the Volume Shadow Copy Service for System Restore and backup. Recoverable with vss-tools, ShadowExplorer, KAPE, or the libvshadow library.
- Snapshot level
- Block-level, on NTFS volumes
- Maintained by
- Volume Shadow Copy Service
- Native uses
- System Restore, Windows backup
- Recovery tools
- vss-tools, ShadowExplorer, KAPE, libvshadow
Common questions
How does block-level snapshotting differ practically from a simple file backup?+
VSS tracks changed disk blocks copy-on-write, so a shadow copy represents the volume's full state at a point in time, including files a user never explicitly backed up, rather than only the specific files a backup job was configured to copy.
Why would an examiner use a tool like libvshadow instead of Windows' own Previous Versions interface?+
The Previous Versions interface only exposes shadow copies through the live, running OS and requires interacting with the file system in a way that can alter metadata. Tools like libvshadow parse the shadow copy structures directly from a forensic image, giving read-only, forensically sound access without booting the original system.
Related terms
- Alternate Data Stream (ADS)
- An NTFS feature that lets a file carry one or more named streams in addition to its default stream, accessed as filename.txt:streamname....
- File Slack
- The unused space at the tail of the last cluster of a file. It can contain remnants of whatever previously occupied that...
- Hiberfil.sys
- The compressed RAM snapshot Windows writes to C:\ when the system hibernates. Recoverable as a memory image with Hibr2Bin or Volatility, often...
- LNK File
- A Windows shortcut that records the target path, target MAC times, the source volume serial number, and the MAC address of the...
- ShellBags
- Registry keys under Software\Microsoft\Windows\Shell\BagMRU and \Bags in UsrClass.dat and NTUSER.DAT that record every folder the user opened in Explorer, including folders on...