Training Objective: Train analysts in maintaining systems shadow copies to use them in case of malicious activity.
Pre-Requisites: Experience with Windows, Knowledge of Live Backups to Mitigate Encryption
Course Description: Windows uses Shadow Copies to create backup file copies or snapshots of machine files or volumes, even when in use. These copies could be the answer to your ransomware problem, allowing you to recover encrypted or corrupted data from a machine or your network. In this lab you will gain a master level understanding of shadow copies and learn how to use shadow copies in response to malicious activity.