Quantcast
Channel: DFIR Training - Recently Added Listings
Viewing all articles
Browse latest Browse all 888

Eric Zimmerman VSCMount

$
0
0

A simple way to mount Volume Shadow Copies from the command line without having to do much of anything except provide the drive letter to where the VSCs are and where you want the VSCs to be mounted to.

The first requirement is having a source drive that has VSCs on it. This can be something like a fixed disk in your own system, a write blocked hard drive, or an image file mounted with Arsenal Image mounter (as it emulates a physical disk which we need to get to VSCs).


Category: Eric Zimmerman
Category URL: http://www.dfir.training/component/mtree/by-developer/eric-zimmerman?Itemid=

Viewing all articles
Browse latest Browse all 888

Trending Articles