What's New at DFIR Training

June 20, 2020. Regularly updated, never outdone, check out the latest additions to keep up on your DFIR training! Website updates. DFIR Subcontractor listings, Forensic Artifacts and more.

 Enter for a chance to win a Guardonix Write Blocker!

Enter your name/email address here: I WANT TO WIN!

Eric Zimmerman VSCMount


DFIR Tools

License Type
Forensic Utilities - Windows
Volume Shadow Copies
A simple way to mount Volume Shadow Copies from the command line without having to do much of anything except provide the drive letter to where the VSCs are and where you want the VSCs to be mounted to.

The first requirement is having a source drive that has VSCs on it. This can be something like a fixed disk in your own system, a write blocked hard drive, or an image file mounted with Arsenal Image mounter (as it emulates a physical disk which we need to get to VSCs).

User comments

There are no user comments for this listing.