Carves and recreates VSS catalog and store from Windows disk image.
- Python 3.6+ or Python 2.7+
- Carves and creates VSS catalog and store
vss_carver.py -o <volume_offset> -i <path_to_disk_image> -c <catalog_file> -s <store_file>
- (Optional) Manipulates VSS catalog entries
vss_catalog_manipulator.py {list,move,remove,enable,disable} (see more details with "-h")
- Mounts VSS Snapshot with the use of extended vshadowmount (You can get extended vshadowmount from here)
vshadowmount -o <volume_offset> -c <catalog_file> -s <store_file> <path_to_disk_image> <mount_point>
$ git clone https://github.com/mnrkbys/vss_carver