Shadowcopy: A Python-Based Shadow Volume Enumeration and Digest Tool

摘要

This report presents shadowcopy, tool written in Python that extracts and deduplicates files from Microsoft NTFS Shadow copies using the Microsoft Volume Shadow Service (VSS), copies the files to an external volume, and prepares a report of each extracted file's name, timestamp, original path, and MD5 hash value.