01Location
- <volume>\System Volume Information\{3808876b-c176-4e48-b7ae-04046e6cc752} (catalog)
- <volume>\System Volume Information\{GUID}{3808876b-c176-4e48-b7ae-04046e6cc752} (store)
- VSS volume header at volume offset 0x1e00
- SYSTEM hive: ControlSet00n\Control\BackupRestore\FilesNotToSnapshot
02Questions it answers
- What did a file, hive or event log look like at snapshot time?
- Can deleted or overwritten content be recovered from an earlier state?
- When were snapshots created?
- Were specific files excluded through FilesNotToSnapshot?
03Format and versions
| Format | Microsoft Software Shadow Copy provider 1.0 (b5946137-7b9f-4925-af80-51abd60b20d5) stores copies on the local volume in 16 KiB blocks. The catalog lists stores and shadow-copy creation times; each store holds block lists, bitmaps and the preserved data blocks. Little-endian; FILETIME in UTC. |
|---|---|
| Applies to | Persistent shadow copies on the local NTFS volume from Windows Vista; VSS header version 1 (Vista, 7) and 2 (Windows 8). Up to 512 software shadow copies per volume. |
04Key fields
| Field | What it tells you |
|---|---|
| VSS volume header | VSS identifier, version, catalog offset and maximum size (0 if unbounded). |
| Catalog entries | Per-store information including shadow-copy creation time and store offsets. |
| Store block list / bitmap | Map original volume offsets to preserved 16 KiB blocks. |
| FilesNotToSnapshot | REG_MULTI_SZ values with paths (wildcards allowed) that applications ask VSS to exclude. |
05Timestamps
| Field | Encoding | Note |
|---|---|---|
| Shadow copy creation time | FILETIME (UTC) | Time the snapshot was taken; artifacts inside reflect the volume at that point. |
Decode raw values with the Timestamp decoder and convert local wall-clock times with the Local time to UTC.
06Examination workflow
- Detect shadow copies from the VSS header and catalog on the acquired volume.
- Expose each snapshot read-only and record its creation time.
- Run the same artifact parsers against every snapshot (several tools offer a VSS option) and deduplicate results.
- Compare snapshot and live states to identify deletions and modifications.
07Interpretation pitfalls
- Copy-on-write preserves only blocks changed after the snapshot; reconstruction depends on both the store and the current volume.
- FilesNotToSnapshot exclusions are best-effort and do not apply to every snapshot type (e.g. not to those created with Vssadmin).
- libvshadow's test coverage does not yet list Windows 10; verify parser behaviour on newer systems.
09Sources
- Volume Shadow Snapshot (VSS) format libyal / libvshadow (J. Metz) · checked 2026-10-14
- Volume Shadow Copy Service Microsoft Learn · checked 2026-10-14
- Excluding Files from Shadow Copies Microsoft Learn · checked 2026-10-14
- PECmd README Eric Zimmerman (GitHub) · checked 2026-10-14
- MFTECmd README Eric Zimmerman (GitHub) · checked 2026-10-14