Connect your flash drive to the target system. In our case, it's Windows 7 x64, so we will use the 64-bit version of ShadowCopyView. The tool detects available VSCs automatically. In our case we have three VSCs available, as you can see in the following figure:
The main window of the tool consists of two panes. The first pane displays information about detected shadow copies, including name, Explorer path, Volume path, Created Time, and so on. The Explorer path means you can browse shadow copies in Windows Explorer.
- Right-click on the VSC you want to browse in Explorer and choose Open In Windows Explorer, or just press F2. Now it's open in Windows Explorer, as you can see in the following figure:
Now, let's get back to ShadowCopyView. The second pane enables you to browse available shadow copies. Using this pane, you can export both files and folders.
- All you need to do is to right-click a file or a folder, and select the Copy Selected Files To... option or just press F8.
- There are some other useful options you can use. For example, if you prefer timestamps in the UTC (Coordinated Universal Time) time standard, you can use the GMT (Greenwich Mean Time) time zone. To do this, go to the Options menu and select Show Time In GMT.
- Also, if you want to see the whole properties list of a shadow copy, you can right-click it and choose the Properties option, or just press Alt + Enter. Now you see all the properties in one window, as in the following figure:
And the last very useful feature we want to tell you about is keyword searching.
- Go to Edit - Find, or just press Ctrl + F, and you will see the Find window, as in the following figure:
- As you can see, you also have two options to tick. Tick the first one if hits must include the whole word only, tick the second if it is important that results are returned in uppercase or lowercase letters.