RESTORE POINTS vs. VOLUME SHADOW COPY
•History of Restore Points & Volume Shadow Copy
•Benefits for Windows operating system
•Client vs. Server side of Windows operating systems
•Location of Restore Points & Volume Shadow Copy
RESTORE POINTS vs. VOLUME SHADOW
COPY
• History of Restore Points & Volume Shadow Copy
RESTORE POINTS (Windows XP)
RESTORE POINTS (Windows 7)
RESTORE POINTS (Windows XP)
HKLM\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\SystemRestore
VOLUME SHADOW COPY
•Shadow Explorer ver.0.9
•vssadmin
–vssadmin list shadows /for=C:
–mklink /d c:\sc1 \\?\GLOBALROOT\Device\ HarddiskVolumeShadowCopy7\
•PDE – Physical Disk Emulator in EnCase v.7
USER PROFILES
•Contains user configuration settings / files on a Windows XP\Vista\7 system.
|
|
Location Found |
Windows Version |
SystemRoot |
Note: XP systems upgrade |
|
from NT may have profile |
|
located here |
|
|
Documents and Settings\Username |
XP |
|
|
\Users |
Vista, 7, 8 |
|
|
Which Version ?
Windows 7 / 8
Windows
XP
Application Data
• Contains application specific data of the user
|
|
Location |
Windows Version |
Documents and Settings\Username |
XP |
|
|
Documents and Settings\Username\Local |
XP – Non Roaming |
Settings |
|
|
|
Users\User\AppData |
Vista, 7, 8 |
|
|
Application Data (subfolders)
• Local
• LocalLow
• Roaming