Reading shadow copies
With -shadow, Signal also reads the host's existing shadow copies - for what the live system no longer holds: cleared logs, deleted Prefetch files and history lines, removed registry entries.
signal live -all -shadow newest -o .\Value | Reads |
|---|---|
| The newest copy of the system drive. |
| Every copy of the system drive. |
a copy's ID | That copy only. |
What is read from a copy
Event logs: only records older than the live log's oldest, less those the live log still holds - so a cleared log's records come back, and nothing is counted twice.
Program runs: Prefetch files and other run traces since deleted.
Registry: the copy's hives - auto-start entries and services as they were.
Scheduled task files, browser profiles, web servers' configuration and folders.
Files a copy's record names are checked as the copy holds them: times, hashes, signature.
How copy evidence is marked
Every signal from a copy says so: its source names the copy and when it was made, and a state read from a copy is dated "when the shadow copy was made", not "now". A signal carries shadow_copy_matches: how many of its matches came from a copy only - things the host no longer holds.
When to use it
LogIntegrity reports a log cleared.
The Security log's window is short, and the incident is older.
You suspect files or entries were removed after the activity.