Glossary
Volume Shadow Copy (VSS)
A Windows service that creates point-in-time snapshots of a volume, letting investigators recover earlier file and registry states.
The Volume Shadow Copy Service (VSS) creates point-in-time snapshots of an NTFS volume while the system keeps running. Each snapshot captures the state of the volume at the moment it was taken, and Windows stores only the blocks that change afterwards, so older versions of files remain accessible.
For forensics, shadow copies are invaluable. A file that an attacker deleted or modified may still exist intact inside an earlier snapshot, and registry hives or logs can be compared across snapshots to see how a system changed over time. Restore points and the "Previous Versions" feature are both built on VSS.
The vssadmin list shadows command enumerates existing snapshots, and tooling can mount them to expose their contents as a separate file system. Because snapshots predate an intrusion, they can hold evidence the live volume no longer shows.