Windows Volume Shadow Copy keeps a record or copy of changes. These state changes are stored in blocks of data that are compared daily, and changed blocks are copied to Volume Shadow. The Volume Shadow Copy service runs once per day and uses 16-KB blocks of data. In differential copies of VSS, only the changes are backed up, on a cluster-by-cluster basis. For a full copy or clone, entire files are backed up. This can be an excellent place to seek evidence that the suspect may not even be aware is available.