Volume Shadow Copy
A Windows snapshot mechanism that can preserve earlier versions of files and filesystem state for backup, recovery, or forensic analysis.
Digital-Forensics Context
Windows Volume Shadow Copy can preserve earlier filesystem states that are useful for comparing modified or deleted files, registry hives, and historical system configuration. A snapshot may provide evidence that is no longer present in the current live view.
Evidence Boundary
A shadow copy is not a guaranteed independent backup. Retention limits, storage pressure, administrative actions, and policy can remove snapshots, and the snapshot reflects only the state captured at its creation time.
Related Digital-Forensics Concepts
- Disk Image
- Forensic Timeline
- Registry Hive
- File System