Recipe Difficulty: Hard
Python Version: 2.7
Operating System: Linux
Volume shadow copies can contain data from files that are no longer present on the active system. This can give an examiner some historical information about how the system changed over time and what files used to exist on the computer. In this recipe, we will use the pvyshadow library to enumerate and access any volume shadow copies present in the forensic image.