search

Invoke-IR / PowerForensics

PowerForensics provides an all in one platform for live disk forensic analysis
MIT License
1.38k stars 274 forks source link

Volume Shadow Copies #158

Open SamMaesschalck opened 6 years ago

SamMaesschalck commented 6 years ago

I was wondering if PowerForensics also parses volume shadow copies when creating a timeline, or if there are plants to include this functionality.

jaredcatkinson commented 6 years ago

Hi Sam,

PowerForensics currently does not support VSC natively, and I don't necessarily have it on the roadmap. I agree that it would certainly be awesome to include, but it would definitely be a large undertaking to implement.