Reconstruct the World from Vanished Shadow - Recovering Deleted VSS Snapshots

Explore the intricacies of recovering deleted Volume Shadow Copy Service (VSS) snapshots in this 48-minute Black Hat conference talk. Delve into the importance of VSS as a backup feature for recent Windows operating systems and its crucial role in computer forensics. Learn about storage snapshot creation, content recovery, and the significance of VSS in restoring deleted files, including those created by attackers. Discover snapshot management files, data structures, and the inner workings of VSS snapshots. Gain insights into VSS access methods, snapshot duration, and support status. Examine the main issues surrounding VSS snapshot recovery and witness a demonstration of the process. Cover topics such as introduction, motivation, scope, and various aspects of VSS snapshots to enhance your understanding of this vital forensic technique.

Introduction
Motivation
Snapshot Management Files
Data Structure
How VSS Snapshots Work
VSS Access
Snapshot Duration
Support Status
Main Issue
Demonstration
Scope Snapshots