Mounting VSCs from disk images with VSSADMIN and MKLINK
VSSADMIN is a built-in Windows command-line tool capable of displaying Volume Shadow Copies. You can use it not only on a running Windows system, but also on disk images. In this recipe, we will show you how to do it.
Getting ready
As the tool we are going to use is built-in, there is no need for installation: if you are using Windows, you already have it. So all you need is to mount a forensic image, and you already know how to do this from Chapter 3, Windows Drive Acquisition. As soon as the image is mounted, you are ready to go.
How to do it...
The steps to mount VSCs from disk images using VSSADMIN and MKLINK are as follows:
- Start Windows Command Prompt (don't forget to run it as Administrator). In our case, the boot partition is mounted as
G:\ drive, so we use the following command:
vssadmin list shadows /for=G:\
Figure 5.5. vssadmin list shadows /for=G:\ command output
As you can see in the preceding figure, our forensic image contains...
