Digital Forensics and Incident Response website
Home News Reconnoitre

Reconnoitre

Possibly the biggest source of difficulty on an investigation of a modern Windows based computer is Volume Shadow Copies (VSC's). VSC's add a considerable burden on the investigator in both time and disk space such that often data in these shadowed backup files is ignored due to the complexity and cost to the investigation. 

 

With the release of Reconnoitre this additional burden has been removed and the process involved in examining ALL shadow copies is essentially the same as investigating any Windows image. 

 

More information and a number of short support videos is available on website:

http://sandersonforensics.com/forum/content.php?168-Reconnoitre

Go to news list