How to do it...

Connect your flash drive to the target system. In our case, it's Windows 7 x64, so we will use the 64-bit version of ShadowCopyView. The tool detects available VSCs automatically. In our case we have three VSCs available, as you can see in the following figure:

Figure 5.1. Volume Shadow Copies detected by ShadowCopyView

The main window of the tool consists of two panes. The first pane displays information about detected shadow copies, including name, Explorer path, Volume path, Created Time, and so on. The Explorer path means you can browse shadow copies in Windows Explorer.

  1. Right-click on the VSC you want to browse in Explorer and choose Open In Windows Explorer, or just press F2. Now it's open in Windows Explorer, as you can see in the following figure:
Figure 5.2. A Volume Shadow Copy opened in Windows Explorer

Now, let's get back to ShadowCopyView. The second pane enables you to browse available shadow copies. Using this pane, you can export both files and folders.

  1. All you need to do is to right-click a file or a folder, and select the Copy Selected Files To... option or just press F8.
  2. There are some other useful options you can use. For example, if you prefer timestamps in the UTC (Coordinated Universal Time) time standard, you can use the GMT (Greenwich Mean Time) time zone. To do this, go to the Options menu and select Show Time In GMT.
UTC or Coordinated Universal Time is the primary standard by which the world regulates clocks and time. For example, most parts of European Russia use UTC +3 hours.
  1. Also, if you want to see the whole properties list of a shadow copy, you can right-click it and choose the Properties option, or just press Alt + Enter. Now you see all the properties in one window, as in the following figure:
Figure 5.3. A Volume Shadow Copy's properties

And the last very useful feature we want to tell you about is keyword searching.

  1. Go to Edit - Find, or just press Ctrl + F, and you will see the Find window, as in the following figure:
Figure 5.4. ShadowCopyView Find window
  1. As you can see, you also have two options to tick. Tick the first one if hits must include the whole word only, tick the second if it is important that results are returned in uppercase or lowercase letters.

 

..................Content has been hidden....................

You can't read the all page of ebook, please click here login for view all page.
Reset
3.17.6.75