Особливості використання служби тіньового копіювання операційної системи Windows в інтересах цифрової криміналістики

Abstract

The study analyzes the possibilities of using information from the shadow copy service for digital forensics tasks. The purpose of the shadow copy service, its functioning when creating copies of disks and files, and the processes by which such copies are created are analyzed. The study presents the possibilities for conducting forensic analysis of shadow copies, and presents the tools with which a digital forensics expert can analyze shadow copies.