shadow copy creation disable and suppression detector — free browser tool | fatcousin

home

drop registry export and system evtx csv · detect volume shadow copy service disabled or shadow copy creation suppressed · identify configuration changes preventing future shadow copy creation · surface vss service manipulation · runs locally

artifacts

drop registry export · system / security evtx csv (multi-file)

or click

Select file

VSS/swprv Start=4 · FilesNotToSnapshot · 7036 · 7040 · 8193/8194 · vssadmin resize shadowstorage · wmic shadowcopy create · scheduled shadow-delete tasks

drop registry export · system evtx csv · security evtx csv (4688)