All times are UTC - 5 hours [ DST ]




Post new topic Reply to topic  [ 2 posts ] 
Author Message
 Post subject: Undeleted Shadow Copies
PostPosted: Today, 6:20 
Offline

Joined: Today, 6:06
Posts: 1
Location: Reality
Hello guys,

My Windows is telling me that for a specific volume I have exactly one shadow copy. It can be found in the folder System Volume Information of the volume, in this form:

{dac4924d-3ca1-11e7-9be0-cc88a4ca0b0c}{3808876b-c176-4e48-b7ae-04046e6cc752}

But what I need desperately are the shadow copies from before. And I need them so desperately thet I restored them with an undelete program, from the folder System Volume Information. No clusters had been overwritten yet. I recovered the last 10 or so, just in case, you know. :mrgreen:

But I have absolutely no clue though if that was useful at all. :? I did some reading on mounting shadow copies, but it's always about mounting via \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy#\". I found something about mounting a .raw file in linux though.

Of course my files aren't adressable like that, since they're in the format described above in some random folder and not "in the system". And also after recovering the program said that they had only been partly recovered.

Is there any possibility somehow to still access the content of those files? Would that even get me anywhere, or is there just something in them that points to something else that maybe isn't even there anymore? I don't know anything about this!

It would be awesome if you guys could help me! :D

Many kind regards,
hhtech


Top
 Profile  
 
 Post subject: Re: Undeleted Shadow Copies
PostPosted: 44 minutes ago 
Offline
User avatar

Joined: December 4th, 2012, 1:35
Posts: 2810
Location: Adelaide, Australia
http://journeyintoir.blogspot.com.au/2012/01/ripping-volume-shadow-copies.html

http://www.forensicexplorer.com/shadow-copy.php


http://www.shadowexplorer.com/
https://www.bleepingcomputer.com/download/shadowexplorer/

You MUST listen to this if you are interested in shadow copies:
http://cyberspeak.libsyn.com/cyber-speak-may-7-2012-volume-shadow-copies

you dont mention what you did after that, or what search results you had that were/were not helpful. i would start here..


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 2 posts ] 

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: No registered users and 2 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group