VSC Toolset

This page is dedicated to updates and general information for VSC Toolset, a GUI developed for executing batch files against one or more volume shadow copies.  

Download VSC Toolset

VSC Toolset Main Window

VSC Toolset File System View

VSC Toolset Requirements for Full Functionality
  • RegRipper: rip.exe, plugins folder, and other RR requirements must be in the root of the "regripper" directory, which is located in the same directory as the VSC Toolset executable
  • Diff: included in the UnxUtils download, diff.exe should be in the same directory as the VSC Toolset executable
  • ActivePerl: required for running jump list and LNK parsing Perl scripts, ActivePerl should be installed on the machine on which VSC Toolset is executed
  • LogParser: required for event log-related functionality, LogParser.exe and LogParser.dll should be in the same directory as the VSC Toolset executable
  • jl.pl: included in the wfa3e files, should be in the same directory as the VSC Toolset executable
  • lslnk-directory-parse2.pl: available from the Win4n6 group under Files\Tools, should be in the same directory as the VSC Toolset executable
  • auto_rip: auto_rip.exe should be in the root of the "regripper" directory
02/16/2014: VSC Toolset updated (added built-in functionality for running auto_rip)
02/06/2014: VSC Toolset updated (read about it here)
09/18/2012: VSC Toolset updated (read about it here)
07/01/2012: VSC Toolset updated (bug fix for spaces in user name)
06/18/2012: VSC Toolset updated
  • Added functionality for parsing event logs via Log Parser
  • Added functionality for viewing the date range of event logs via Log Parser
  • Options menu added
    • Allows for saving output files to custom location
    • "Save All Results" option moved here
  • Case Name text box removed (only purpose was in saving output to case name folder, which is now much more flexible using a custom saving location)
  • Minor UI enhancements
06/05/2012: VSC Toolset updated (minor UI enhancement)
05/21/2012: VSC Toolset updated (bug fix for listing 2-digit VSCs)
05/15/2012: VSC Toolset updated (read about it here)
05/10/2012: VSC Toolset updated
  • Added built in functionality for running Harlan's jl.pl (available in ch7 from the wfa3e files) script against jump lists
  • Added built in functionality for running custom RegRipper plugin files (make sure they're stored in the plugins directory)
  • Simplified RegRipper command selection
  • Minor UI enhancements
04/03/2012: VSC Toolset updated (minor UI enhancements)
03/28/2012: VSC Toolset updated (read about it here)
03/16/2012: VSC Toolset released (read about it here)


  1. The download link is not working.

    1. Hi,

      I'm not sure if the hosting site was down temporarily, but the link seems to be working now.

  2. This is a great tool. Really helping the analyst get to the heart of the matter quickly. A thought, have you considered integrating Corey Harrell's auto_rip into your GUI. Corey has done a great job categorizing the RR plugins into auto _rip.

    1. Hi, thanks for the feedback. I hadn't considered integrating auto_rip, but I can see how it would be a nice addition. I'll look into integrating this with the GUI, but you should be able use auto_rip with VSC Toolset in the meantime by changing auto_rip's input variables accordingly and saving it in VSC Toolset's "batch" directory. Once VSC Toolset recognizes the batch script in the directory, it will display text boxes for three additional parameters that can be passed to the batch script.

    2. Auto_rip is now integrated with VSC Toolset. Just make sure auto_rip.exe is in the root of the "regripper" directory and you should be good to go. Let me know if you run into any problems with it.

  3. Thank you for the consideration. On another note...I am mounting an image in FTK Imager, and E01 image, however, I can't seem to get the VSC Toolset to identify the VSC's on that mounted image. Any suggestions?

  4. You'll need to use another mounting tool that gives you access to the VSCs. Try Arsenal Imager Mounter - https://github.com/ArsenalRecon/Arsenal-Image-Mounter.

  5. I was having a similar problem to M. Orinoco with regard to being unable to view VSC's in a mounted image. If you have an EnCase 7 dongle, the built in PDE worked for me.