Ripping Volume Shadow Copies - Tracking User Activity - Corey Harrell

14 Mar 2012

Harlan introduced how to process VSC's in December now Corey looks at exactly how we can get the most value from this valuable resource. If you do not follow Correy's blog (Journey into Incident Response, ) you should add it to your RSS feed. He writes some great guides and is a deep thinker when it comes to processes and methods.