Windows registry artifactVSS
Displays files to be deleted from newly created shadow copies
- Volume Shadow Copies
- 4 keys
SYSTEM
Registry keys
4 keys that RECmd reads for this artifact
SYSTEMrecursiveControlSet*\Control\BackupRestore\FilesNotToSnapshotDisplays files to be deleted from newly created shadow copies
SYSTEMrecursiveControlSet*\Control\BackupRestore\FilesNotToSnapshotSaveDisplays files to be deleted from newly created shadow copies
SYSTEMrecursiveControlSet*\Control\BackupRestore\KeysNotToRestoreDisplays the names of the Registry subkeys and values that backup applications should not restore
SYSTEMrecursiveControlSet*\Control\BackupRestore\FilesNotToBackupDisplays the names of the files and directories that backup applications should not backup or restore
References
5 links
- medium.com/@bromiley/windows-wednesday-volume-shadow-copies-d20b60997c22(opens in new tab)
- docs.microsoft.com/en-us/windows/win32/backup/registry-keys-for-backup-and-restore(opens in new tab)
- docs.microsoft.com/en-us/windows/win32/backup/registry-keys-for-backup-and-restore(opens in new tab)
- docs.microsoft.com/en-us/windows/win32/backup/registry-keys-for-backup-and-restore(opens in new tab)
- docs.microsoft.com/en-us/windows/win32/backup/registry-keys-for-backup-and-restore(opens in new tab)
Source: RECmd/BatchExamples/DFIRBatch.reb(opens in new tab) v2.22 by Andrew Rathbun and contributors(opens in new tab), MIT License(opens in new tab)