Windows Shadow Volumes
- 1 Volume Shadow Copy Service
- 2 History
- 3 Shadow Volume Copies in Digital Forensics
- 4 Also see
- 5 External Links
- 6 Tools
- 
Windows Shadow Volumes
- 1 Volume Shadow Copy Service
- 2 History
- 3 Shadow Volume Copies in Digital Forensics
- 4 Also see
- 5 External Links
- 6 Tools
- 7 Sources
Volume Shadow Copy Service
Windows has included the Volume Shadow Copy Service in it's releases since Windows XP. The Shadow Copy Service creates differential backups periodically to create restore points for the user. Windows 7 Professional and Ultimate editions include tools to work with and manage the Volume Shadow Copy Service, including the ability to mount shadow volumes on disk images. In Windows 8 the shadow volumes seem to have been superseded by File History. For now it looks like it uses similar structures as its predecessors.
Windows Shadow Copy is a service that either manually or automatically creates backup copies of disk volumes. These backups are automatically created when Windows performs either a scheduled backup or a system restore point. This happens before Windows Updates are installed, or when Windows determines that it is time to create a new system restore point, which is determined by both system idle time and the time since a previous system restore point was created. In Windows Vista, this is one day. On Windows 7 and newer, this is seven days. Windows XP creates them every 24 hours regardless of system activity.
Shadow copies are initially created as block-level clones of entire drives. From there, only the changes to the drive are tracked. This means that in a forensic investigation, not all relevant information may be in the same Shadow Copy.
Shadow copies were first available in the Windows XP and Server 2003 operating systems, and are still present in each subsequent Windows and Server operating systems, including the present day Windows 10.
Although all present Windows and Server operating systems contain shadow volume capability, the process in which each operating system creates and accesses them varies, and is explained below.
Windows XP and Server 2003
Windows first added Volume Snapshot Service to windows XP, which is used by NTBackup. The creation of persistent s