Tuesday, May 15, 2012

VSC Toolset Update: Browsing Shadow Copies

I don't plan to regularly post about tool updates, but I figured there's enough in the most recent update to VSC Toolset that I might want to write a bit about it.  As indicated by the title of this post, the biggest change incorporates the ability to browse shadow copies using an Explorer-like interface.  Although you can easily write a batch file to list the directory contents of each shadow copy, it's nice to be able to see the directory structure.  The "Browse Selected VSCs" button will open all selected linked VSCs.  This allows you to open a directory view of two (or more) shadow copies and view them side by side to visually see the differences between them.  If you find it easier to view the directory contents in another view mode other than "Details", you can right-click on the list view pane and select a different view mode.

I've also tweaked how the VSCs are listed in the main interface.  For example, when you're viewing a list of the shadow copies on a drive, you will no longer see "ShadowCopy1", "ShadowCopy2", etc..  Instead, you should see something like "VSC1: 4/24/2012", "VSC2: 5/12/2012", etc.. Including the date right beside the listing makes it quicker to determine which VSC(s) you may be interested in, based on the creation date.

Other minor updates include:
  • Removed the "List Shadows" button - shadow copies are now automatically listed upon selecting the drive letter
  • Logging is now in local time instead of UTC
  • Added an "Open Output Folder" button that...well, opens the output folder
  • Added another parameter input box, allowing for up to three additional parameters that can be specified at run time to execute against one or more shadow copies using a simple batch script
  • As noted in the release notes of another recent update, jump lists and custom RegRipper plugin files now have built-in functionality with VSC Toolset (see here for more details).

You can download the latest version of VSC Toolset here.

For tips on setting up and using VSC Toolset, check out this blog post. To get the most out of the program, you'll need the accompanying tools below. Also, keep in mind that with the exception of RegRipper, all accompanying executable files and scripts should be stored in the same directory as the VSC Toolset executable in order for the program to see them.

Feedback, suggestions, and bug reports are always welcome.
Posted by at
Labels: ,

10 comments:

  1. I don't think you want the jl.pl script...just sayin'...

    ReplyDelete
    Replies

    1. Hi Harlan, any particular reason why? Granted it doesn't parse the complete file structure, but it still gives you a nice overview of what's contained in the jumplist before diving in deeper, IMO.

      Delete

  2. well, that's the one I wrote so that it wouldn't work...it was a social experiment, to compare the number of downloads to the number of folks who say anything about it not working. So far, only 2 people have said anything about issues with the script...

    ReplyDelete
    Replies

    1. Really? It seems to be working on my end, both running against the AutomaticDestinations directory and a single *.automaticDestinations-ms file. The output is also consistent with another tool that parses jumplists. Am I missing something?

      Delete

  3. maybe you're running jl2.pl, or maybe you're running a fixed version...

    ReplyDelete
    Replies

    1. I'm definitely using jl.pl, it's the same one that's included in the link to your google code site that I posted. I must be using a fixed version. That's an interesting experiment though...

      Delete

  4. Yeah, and it was very revealing...particularly after one person told me that they'd downloaded the scripts and modules to 40 systems within their organization, but never once ran them...

    ReplyDelete

  5. Hey Jason, I wanted to thank you for VSC Toolset, it has been quite useful in retrieving extra data easily. I just wanted to let you know about an issue I was having as I attempted to use it recently to retrieve MRU data. The user name had a space in it and each time I attempted to export information from the VSC's the export was 0kb.

    I had already successfully extracted USB data and I attempted to recover MRU data with Harlan's regripper and that worked, so I was thinking it could be the username field of VSC Toolset not handling usernames with a space. I'm available if you need more info, duplicating the error, and testing. Thanks again for a great tool.

    ReplyDelete
    Replies

    1. Dan,

      I'm glad you've found some use in VSC Toolset, and I appreciate the feedback. You were correct in that the issue was with the space in the user name field, or more precisely, the user name parameter being passed into the batch file. This bug should now be resolved.

      I had to modify the batch files to accommodate the potential for spaces in the user name. Normally this would simply involve adding double quotes around the path to the file, but since parts of the path are being passed in as parameters to the batch file, I had to add a couple of lines of code to the batch files for everything to work properly. It also turns out that the link file and jump list batch files suffered from this same issue; both have been corrected.

      Thanks again for the feedback and pointing out this bug. The updated version is now available for download from the VSC Toolset page.

      Jason

      Delete

    2. Thanks Jason, I used the updated version today and it worked perfectly. Many thanks.

      Dan

      Delete

Subscribe to: Post Comments (Atom)