Results for “volume-shadow-copy”

3 skills

hunting-for-shadow-copy-deletion

Hunt for Volume Shadow Copy deletion activity that indicates ransomware preparation or anti-forensics by monitoring vssadmin, wmic, and PowerShell shadow copy commands.

24.6k · bundle

More results

acquiring-disk-image-with-dd-and-dcfldd

Create forensically sound bit-for-bit disk images using dd and dcfldd while preserving evidence integrity through hash verification.

24.6k · bundle

triaging-windows-with-kape

Collect and parse forensic artifacts from Windows systems using KAPE for rapid DFIR triage.

24.6k · bundle