IEF v6.3 now supports native shadow copy mounting and analysis
Since becoming available in Windows Vista, volume shadow copies have been a valuable resource for forensic investigators when examining a Windows PC. Volume shadow copy runs as a service (volume shadow service) that creates and maintains multiple historical snapshots of