Volume Shadow Copy (VSS)
| Format | Volume Shadow Copy (VSS) |
|---|---|
| Short name | VSS |
| Category | filesystem |
| Platforms | Windows |
| Crush support | Not yet supported |
| Status | Reviewed |
| Last reviewed | 2026-10-04 |
Forensic relevance
Copy-on-write snapshots of an NTFS volume (System Restore, backups, previous versions). Changed 16 KiB blocks are kept in store files named {GUID}{3808876B-C176-4E48-B7AE-04046E6CC752} under System Volume Information and catalogued from a header at offset 0x1E00 of the volume. Each snapshot presents the volume as it was at its creation time, including files since deleted or changed.
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset 7680 (0x1E00) | 6B 87 08 38 76 C1 48 4E B7 AE 04 04 6E 6C C7 52 | k..8v.HN....nl.R | VSS identifier {3808876B-C176-4E48-B7AE-04046E6CC752} at volume offset 0x1E00 |
Known extensions
None recorded
References
- Volume Shadow Snapshot (VSS) format (libyal/libvshadow) https://github.com/libyal/libvshadow/blob/main/documentation/Volume%20Shadow%20Snapshot%20(VSS)%20format.asciidoc
- ForensicsWiki — Windows shadow volumes https://forensics.wiki/windows_shadow_volumes/
Cite this entry
Crush Format Reference, “Volume Shadow Copy (VSS)”. https://kalink0.github.io/crush-forensics/formats/vss/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction