Shadowcopy: A Python-Based Shadow Volume Enumeration and Digest Tool
Mike Hom · Calhoun: The Naval Postgraduate School Institutional Archive (Naval Postgraduate School) · 2011
This report presents shadowcopy, tool written in Python that extracts and deduplicates files from Microsoft NTFS Shadow copies using the Microsoft Volume Shadow Service (VSS), copies the files to an external volume, and prepares a report of each extracted file's name, timestamp, original path, and MD5 hash value.