Vista Forensics

“When is a deleted file really deleted? With Windows Vista, that answer gets complicated.
Microsoft recently revealed that Windows Vista would inherit ‘volume shadow copy’ technology from Windows XP and Windows Server 2003. In those older operating systems, volume shadow copy is used to take periodic snapshots of key system files, though the service can also be instructed to monitor any kind of data for the purposes of creating a system ‘restore point.’
With Windows Vista, the operating system will make ’shadow’ (that is, backup) copies of files and folders for users who have ‘System Protection’ enabled (the default setting). The feature will be called Previous Versions, and will be accessible via the right-click properties menu as ‘Restore previous versions.’”
[read full article]

Original post by info@liveammo.com (http://www.liveammo.com) and powered by Img Fly

Related posts:

1. Hackers crack Vista Activation Server
2. Podcast: Digital Forensics and Hacking Investigations, Part 1
3. Windows Vista Resource Kit Released
4. Podcast: Digital Forensics and Hacking Investigations, Part 4
5. Vista beta prepares for self-destruction
6. Registry errors in computer

Related posts brought to you by Yet Another Related Posts Plugin.