Hello Readers,
I think a lot of us are still using the old tool Shadowcopy to explore shadowcopies from forensic images mounted. While we know how to mount volume shadow copies to mount points within our system, I personally always liked the interface shadowcopy provided me to jump between restore points and browser their contents. Since Shadowcopy hasn't been updated in over a year one I was happy to new someone else pick up the guantlet of a GUI based VSS explorer.
The entrant? Shadowkit which is currently available for free on the website www.shadowkit.com. I've tested the tool on my own systems it's quick and has some nice features that I've been wanting from Shadowexplorer such as:
1. File list exporting.
I think a lot of us are still using the old tool Shadowcopy to explore shadowcopies from forensic images mounted. While we know how to mount volume shadow copies to mount points within our system, I personally always liked the interface shadowcopy provided me to jump between restore points and browser their contents. Since Shadowcopy hasn't been updated in over a year one I was happy to new someone else pick up the guantlet of a GUI based VSS explorer.
The entrant? Shadowkit which is currently available for free on the website www.shadowkit.com. I've tested the tool on my own systems it's quick and has some nice features that I've been wanting from Shadowexplorer such as:
1. File list exporting.
2. Filtering shadow copies of your local system versus shadow copies from mounted images.
3. drop downs for machine names as well as individual volumes backed up, preventing confusion with imported shadow copies.
4. MAC and attributes displayed within the interface for each file.
5. The ability to open files within the tool without having to export them, it places them in a temp directory for viewing.
6. Extension filtering.
In talking to the author he has more features planned with an eye towards the needs of the DFIR community so I'm expecting good things.
Also Read: NCCDC 2012 Wrap up post
Post a Comment