AI, Data Science & Cloud Certificates from Google, IBM & Meta — 40% Off
One plan covers every Professional Certificate on Coursera. 40% off Coursera Plus Annual.
Unlock All Certificates
Explore the intricacies of Volume Shadow Copy Service (VSS) snapshots and learn techniques to manipulate them in this 25-minute conference talk from BSidesLV 2017. Delve into the basics of VSS, its importance in forensic analysis, and the on-disk format including NTFS headers and data block lists. Discover methods for writing data to snapshots, understanding block descriptors, and modifying timestamps. Gain insights on detecting snapshot modifications and the challenges involved in uncovering such alterations. Conclude with a live demonstration and a Q&A session to enhance your understanding of VSS snapshot manipulation and its implications for forensic analysts.
