Recovering Historical Documents From Snapshots And Volume Shadow Copies

SNAPSHOTS & SHADOWCOPIES · AGUIDEFORUKLAWYERS Recovering Historical Documents from Snapshots and Volume Shadow Copies The Time Machine Already Running on Your Client's Systems: and How to Read It Before It Prunes COMPUTERFORENSICSLAB § ABOUTTHEAUTHOR PRE PA REDBYCOMPUTERFORENSICSLABE - DISCOVERYTEAM § CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the history nobody meant to keep 03 The layers: shadow copies, snapshots and version histories 04 Volume Shadow Copies on Windows machines 05 Server, NAS and hypervisor snapshots 06 File-level version histories in cloud platforms 07 Differencing: turning states into a story 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist § 0 1 · ORIENTATION Executive summary THEHEADLINEPOINT : THREEHISTORYLAYERS , ONEDISCIPLINE : IDENTIFY , FREEZE , DIFFERENCE § 0 2 · FIRSTPRINCIPLES The problem in plain English: the history nobody meant to keep § 0 3 · THEMAP The layers: shadow copies, snapshots and version histories LAYER WHAT IT PRESERVES, AND ITS HABITS WHERE IT RUNS · T YPICAL CADENCE § 0 4 · THEMACHINE ' SMEMORY Volume Shadow Copies on Windows machines § 0 5 · THEESTATE ' SMEMORY Server, NAS and hypervisor snapshots § 0 6 · THEPLATFORM ' SMEMORY File-level version histories in cloud platforms § 0 7 · THEMETHOD Differencing: turning states into a story § 0 8 · THEWIDERMAP Source architecture: where else the evidence lives EVIDENCE COPIES BACKUPS PLATFORM SNAPSHOTS COUNTERPART DELETED / VERSIONS (SHARE/VM) COPIES (MAIL) RECOVERABLE SHADOW (ENDPOINTS) § 0 9 · INTHEWILD Worked examples EXAMPLE1 · THECONSULTANCYAGREEMENTWITHAGROWINGCLAUSE EXAMPLE2 · THELAPTOPTHATREMEMBEREDTHEREALACCOUNTS EXAMPLE3 · THEPURGEDATEDTOTHEMAINTENANCEWINDOW § 1 0 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations § 1 1 · INTERROGATORIES & DRAFTINGAIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your eDiscovery / forensic provider SUGGESTEDWORDING · INSTRUCTIONFORHISTORICAL- S TAT EREC OV ERY § 1 2 · QUICKCONTROL Checklist and red flags · When to involve a digital forensic expert The historical-states checklist Red flags When to involve a digital forensic expert § 1 3 · COMMONQUESTIONS Frequently asked questions How far back do these layers really go? Can deleted version histories or snapshots be recovered? Is a document recovered from a shadow copy or snapshot admissible like the original? The other side's disclosure shows only final versions. What should we ask for? Do Macs and non-Windows systems have equivalents? What single habit should our team adopt from this guide? § 1 4 · REFERENCE Glossary Sources and authoritative references DISCLAIMER § HOWASPECIALISTLABORATORYCANASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY