[RP]: Ripping Volume Shadow Copies
Corey Harrell started a series of posts about VSC at the “Journey Into Incident Response” blog:
- Part 1: Ripping Volume Shadow Copies – Introduction
- Part 2: Ripping VSCs – Practitioner Method
- Part 3: Ripping VSCs – Practitioner Examples
- Part 4: Ripping VSCs – Developer Method
- Part 5: Ripping VSCs – Developer Example
- Part 6: Examing VSCs with GUI Tools
- Ripping VSCs – Tracking User Activity
- Volume Shadow Copy Timeline