Completed
How to tell if a snapshot has been modified
Class Central Classrooms beta
YouTube videos curated by Class Central.
Classroom Contents
Messing with Forensic Analysts - Modifying VSS Snapshots
Automatically move to the next video in the Classroom when playback concludes
- 1 Introduction
- 2 What is VSS
- 3 Basics of VSS
- 4 Why should you care
- 5 Examples
- 6 Documentation
- 7 On Disk Format
- 8 NTFS Header
- 9 What is in a Store
- 10 Data Block List
- 11 Example Snapshot
- 12 Writing Data to a Snapshot
- 13 Block Descriptors
- 14 The Really Good Stuff
- 15 Demo
- 16 How to tell if a snapshot has been modified
- 17 Hardest way to find out
- 18 Modify timestamps
- 19 Questions
