Daily Blog #357: Sunday Funday 6/15/14 - Windows 7 Shadow Copies Challenge

Windows 7 Shadow Copies Challenge by David Cowen - Hacking Exposed Computer Forensics Blog

Hello Reader,
              If  you watched the Forensic Lunch Friday you would have heard me talking about what we discovering about the behavior of Volume Shadow Copies. Let's see what you can do in this weeks Sunday Funday challenge.

The Prize:
$200 Amazon Giftcard

The Rules:

  1. You must post your answer before Monday 6/16/14 3PM CST (GMT -5)
  2. The most complete answer wins
  3. You are allowed to edit your answer after posting
  4. If two answers are too similar for one to win, the one with the earlier posting time wins
  5. Be specific and be thoughtful 
  6. Anonymous entries are allowed, please email them to dcowen@g-cpartners.com. Please state in your email if you would like to be anonymous or not if you win.
  7. In order for an anonymous winner to receive a prize they must give their name to me, but i will not release it in a blog post

The Challenge:
For a Windows 7 system, list out all sources of data regarding volume shadow copies that are stored and can be accessed from a forensic image, without booting it.

Also Read: Daily Blog #356

Post a Comment