Hi All,
Have never posted asking a question on here before, so please, be gentle.
I'm looking at Volume Shadow Copies. I have managed to view the live VSC, however, I can see on the image that there a couple, 2/3, which have been deleted. I can export these files in full but I can't read them in anyway. I am guessing that they cannot be added directly to the Volume System Folder and there is no pointer in the log files for them.
I have also googled this, however, only get references to recovering files within VSC themselves. I have placed the VSC in the correct folder on the local machine and this was unable to detect them.
I was wondering if anyone knew a way, or had any ideas, of how to view these deleted Volume Shadow Copies?
Thank you in advance.
J
Try Reconnoitre - depending on what has happened to the VSC's since deletion you may get some dtaa back. Like all deleted data YMMV.
http//
Hi Paul,
Thanks for the reply.
Have had a look at the software and doesn't look as though its interpreting the deleted shadow copies in any way.
Theres no real urgency surrounding the matter, as its to do with a University project. Think i'll have another look at alternative software to see if these can be viewed or reconstructed in any way.
Thanks
not sure if this is of help, i've used this guide before to image out these for further work/examinations etc..
http//