§ CONTENTS
In this guide
01 Executive summary
02 The problem in plain English: the history nobody meant to keep
03 The layers: shadow copies, snapshots and version histories
04 Volume Shadow Copies on Windows machines
05 Server, NAS and hypervisor snapshots
06 File-level version histories in cloud platforms
07 Differencing: turning states into a story
08 Source architecture: where else the evidence lives
09 Worked examples
10 Common mistakes and technical limitations
11 Questions to ask · Suggested wording
12 Checklist and red flags · When to involve a digital forensic expert
13 Frequently asked questions
14 Glossary · References · Disclaimer · How a specialist laboratory can assist
§ 01 · ORIENTATION
Executive summary
THE HEADLINE POINT: THREEHISTORYLAYERS, ONEDISCIPLINE: IDENTIFY, FREEZE,
DIFFERENCE
§ 02 · FIRST PRINCIPLES
The problem in plain English: the history nobody meant to keep
§ 03 · THEMAP
The layers: shadow copies, snapshots and version histories
LAYER WHAT IT PRESERVES, AND ITS HABITS
WHERE IT RUNS · T YPICAL
CADENCE
§ 04 · THE MACHINE ' SMEMORY
Volume Shadow Copies on Windows machines
§ 05 · THEESTATE ' SMEMORY
Server, NAS and hypervisor snapshots
§ 06 · THE PLATFORM ' SMEMORY
File-level version histories in cloud platforms
§ 07 · THE METHOD
Differencing: turning states into a story
§ 08 · THEWIDERMAP
Source architecture: where else the evidence lives
EVIDENCE COPIES BACKUPS
PLATFORM SNAPSHOTS COUNTERPART DELETED /
VERSIONS (SHARE/VM) COPIES (MAIL) RECOVERABLE
SHADOW
(END POINT S)
§ 09 · IN THE WILD
Worked examples
EXAMPLE1 · THECONSULTANCYAGREEMENTWITHAGROWINGCLAUSE
EXAMPLE2 · THELAPTOPTHATREMEMBEREDTHEREALACCOUNTS
EXAMPLE3 · THEPURGEDATEDTOTHEMAINTENANCEWINDOW
§ 10 · WHEREITGOESWRONG
Common mistakes and technical limitations
Common mistakes
Technical limitations
§ 11 · INTERROGATORIES & DRAFTING AIDS
Questions to ask · Suggested wording
Ask your client
Ask your opponent
Ask your e Discovery / forensic provider
SUGGESTED WORDING · INSTRUCTIONFORHISTORICAL- S TAT EREC OV ERY
§ 12 · QUICK CONTROL
Checklist and red flags · When to involve a digital forensic
expert
The historical-states checklist
Red flags
When to involve a digital forensic expert
§ 13 · COMMON QUESTIONS
Frequently asked questions
How far back do these layers really go? Can deleted version histories or snapshots be recovered? Is a document recovered from a shadow copy or snapshot admissible like the original? The other side's disclosure shows only final versions. What should we ask for? Do Macs and non-Windows systems have equivalents? What single habit should our team adopt from this guide?
§ 14 · REFERENCE
Glossary
Sources and authoritative references
DISCLAIMER
§ HOW A SPECIALIST LABORATORY CAN ASSIST
Working with Computer Forensics Lab
Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB
NEWENQUIRIESEMAILE - DISCOVERY
