• Skip to primary navigation
  • Skip to main content
  • Skip to primary sidebar
  • Skip to footer navigation

The Geek Diary

  • OS
    • Linux
    • CentOS/RHEL
    • Solaris
    • Oracle Linux
    • VCS
  • Interview Questions
  • Database
    • oracle
    • oracle 12c
    • ASM
    • mysql
    • MariaDB
  • DevOps
    • Docker
    • Shell Scripting
  • Big Data
    • Hadoop
    • Cloudera
    • Hortonworks HDP

vshadowmount: command not found

by admin

The Windows Volume Shadow Copy Service (VSS) allows for backups of files, even protected system files, to be made while the operating system is running. Windows uses VSS to make periodic differential backups of the blocks of data on NTFS volumes. These backups are called volume shadow copies and are stored in the System Volume Information folder at the root of the volume. Analyzing these backups allows forensic tools to provide snapshots of what the system (including user data) looked like at various points in time, allowing for recovery of deleted or overwritten files, snapshots of the registry and log files from previous points in time, and comparisons of how files may have changed over time. On a live system, the vssadmin command can be used to list the available volume shadow copies.

Open‐source tools can also be used to access volume shadow copy data from an imaged drive. One popular project for this purpose is libvshadow, located at https://github.com/libyal/libvshadow. libvshadow is also included in the SIFT forensics workstation. Once installed, libvshadow provides two command‐line tools to access volume shadow copy data. The vshadowinfo utility shows the volume shadow copies present, and vshadowmount allows you to mount a specific volume shadow copy for further analysis.

If you encounter the below error:

vshadowmount: command not found

you may try installing the below package as per your choice of distribution.

Distribution Command
Debian apt-get install libvshadow-utils
Ubuntu apt-get install libvshadow-utils
Kali Linux apt-get install libvshadow-utils
Raspbian apt-get install libvshadow-utils

Filed Under: Linux

Some more articles you might also be interested in …

  1. How to Move Swap From Disk Partition to LVM Volume in Linux
  2. Understanding Linux SCSI Reservation
  3. “No space left on device” – kdump generation issue (CentOS/RHEL)
  4. ispell: command not found
  5. How to Re-generate initramfs and vmlinuz for Rescue Kernel with Current Kernel in CentOS/RHEL 7
  6. kscreen-doctor : command not found
  7. colrm : command not found
  8. How to install and Configure VNC (TigerVNC) server in CentOS / RHEL 7
  9. aws history: Print the command-line history for AWS CLI commands (Command Examples)
  10. nsenter: command not found

You May Also Like

Primary Sidebar

Recent Posts

  • “az storage blob” Command Examples (Manage blob storage containers and objects in Azure)
  • “az storage account” Command Examples (Manage storage accounts in Azure)
  • “az sshkey” Command Examples (Manage ssh public keys with virtual machines)
  • “az redis” Command Examples

© 2023 · The Geek Diary

  • Archives
  • Contact Us
  • Copyright