THE VOLUME SHADOW SERVICE

Running head: VOLUME SHADOW SERVICE 1
Volume Shadow Service Forensic Analysis in Legal Matters
Student’s Name
Professor’s Name
Affiliation
Date

VOLUME SHADOW SERVICE 2
Volume Shadow Service Forensic Analysis in Legal Matters
Introduction
Data security is one of the most sensitive areas in any organization especially for firms
that keep client payment records in closed network servers. As such, there is need for data
protection protocols that protect client information and prevent employees from accessing
unauthorized data. There are however situations when data security is compromised by employee
seeking to use client information for personal gain (Koyame-Marsh & Marsh, 2014). In such
cases there are several techniques employed by firms like Iridium Electronics LTD to investigate
the performance of data breach and theft crime within the organization. One of the most
prominent used technique is the assessment of Volume Shadow Service (VSS) to examine data
editing, copying, and deletion (Sreeja & Balan, 2016). VSS is employed because it allows for the
retrieval/recovery of data that was encrypted, deleted or wipe for given server or computer hard
disk.
Procedure
The performance of VSS investigation is dependent on the type of computer hardware
being handled and the quantity of information that needs to be recovered. For example, in the
case where Robertson is suspected of having committed data theft it is possible to employ VSS
to examine the type of documents that where handled and deleted on his laptop. The imaging
done to Robertson laptop should allow investigators to gain insight on which data was wipe and
encrypted on a specific date (Day, 2014). Moreover, VSS will allow investigators to determine
whether or not any of the data handled on Robertson’s laptop was related to sensitive company
records. There are two ways through which investigators can assess VSS copies found in a given
laptop. These techniques are command prompt queries, and VSS assess toolkits/software. In the