Volume Shadow Copy Part 4

File History Windows 8 and 8.1

 

As mentioned in our second blog, the Volume Shadow Copy Service is still available on Windows 8. However, we have since discovered that on Windows 8.1 the service was removed, leaving File History to perform a similar function. Here is a brief overview of File History:

 

What is File History?

File History is Microsoft’s replacement to Windows Backup and Restore. File History replaced Windows System Restore and Backup after the older feature was discovered to be unpopular and difficult to use. File History was made with ease of use and automation in mind, so every user could backup and restore old/lost/damaged files.

To work file history, first you have to set up an external drive so that it has a place to save the files to. The rest is done by Windows. Every hour by default, Windows will scan your primary documents folder (on the C: drive) and check for any changes that have been made to any and all files. It then copies that newly saved or changed file to the external drive.

 

Also with File History, Windows creates a timeline of the files that it saves. For example, if you save a file accidentally after making unwanted changes, you can browse to that specific file and restore it from a point before you made that save. File History can also be configured to save backups from any major folder on the C: drive, including Pictures, Music, and Desktop.

To read the last Volume Shadow Copy blog, go here.

-Ryan Montelbano

 

More Research Projects
CyberRange Team: Creating The Perfect Sandbox Environment
The Internet of Things Team: An Inside Look
CyberTech: Creating a Safer Internet Through Education