zoukankan      html  css  js  c++  java
  • "System Protection" is disabled in Win10 default settings

    We could find some important clue in Restore Point because "System Protection" of volume C is enabled in Windows default settings. Lots of data in "My Documents", "Desktop", and "Favorotes". Further more lots of Windows artifacts exists in volume C, and forensic guys understand the importance of Restore Point. But Win10 is different from Win7/8 in this feature. "System Protection" becomes disabled in Win10  default settings. That means there is no any Restore Point unless you enable that feature manually.

    Everybody knows that user couldn't care less whether "System Protection" is enabled or not. But to forensic guys this feature default enabled is very important. Now I turn it on and show you how to take advantage of this feature.

    With this feature on system will create Restore Point automatically. Of course we could create Restore Point manually. Let me show you how to discover how many Restore Point in volume C.

    As you could see there is one Restore Point in volume C. We could use vss.exe to mount this Restore Point.

    The driver letter I use is "S". But where is "S:"??? I could not see this volume S in my computer??? All you have to do is to use forensic tool like FTK Imager to look for volume S.

    So volume S is the shadow of volume C. That means we got the chance to find the original content of data being modified or removed recently. Now this feature "System Protection" is disabled in default. I wonder why Microsoft change this feature. Is there any thing we could do to solve this issue? My suggestion is that IT administrators should use group policy to enable this feature so as to perserve and protect digital evidence.

    ---恢复内容结束---

  • 相关阅读:
    日区 Apple ID共享
    强大的视频跨平台视频处理软件
    百度网盘无限速
    App Store看片神器,请收好
    bootstrap 中这段代码 使bundles 失败
    C# EF中调用 存储过程并调回参数
    mvc 默认访问 Area 下控制器方法
    怎样用SQL语句查看查询的性能指标
    slice 定义和用法
    C# Regex类用法
  • 原文地址:https://www.cnblogs.com/pieces0310/p/5914525.html
Copyright © 2011-2022 走看看