Ripping Volume Shadow Copies - Tracking User Activity - Corey Harrell
14 Mar 2012
Harlan introduced how to process VSC's in December now Corey looks at exactly how we can get the most value from this valuable resource. If you do not follow Correy's blog (Journey into Incident Response, http://journeyintoir.blogspot.com/ ) you should add it to your RSS feed. He writes some great guides and is a deep thinker when it comes to processes and methods.