Page 1 of 1
MFT, USN Journal, $LogFile
Posted: Fri Oct 25, 2019 4:57 am
by rwiper
R-TT Team, Please Do
Traces in MFT
Traces in USN Journal
Traces in $LogFile
_OnDiskSnapshotProp files
Posted: Sun Oct 27, 2019 5:15 pm
by rwiper
{GUID}
_OnDiskSnapshotProp files, in the \System Volume Information\SPP\OnlineMetadataCache are another file type that can provide information about shadow copies. You have pointed these out on your blog this past week. The GUID portion of the file name will match the GUID of the shadow copy set ID that you see when you run VSSadmin.exe. The file created date of the {GUID}_OnDiskSnapshotProp file will closely, but not exactly, match the date of the corresponding shadow copy. As shown below, examining the internals of a {GUID}_OnDiskSnapshotProp file will indicate the the date and time of a shadow copy within a few seconds to a minute, as well as the reason the shadow copy was created.
C:\System Volume Information\
-Syscache.hve
-Syscache.hve.LOG1
-Syscache.hve.LOG2
-tracking.log
-MountPointManagerRemoteDatabase
C:\System Volume Information\SPP\OnlineMetadataCache
*._OnDiskSnapshotProp
MORE INFO
https://www.hecfblog.com/2014/06/daily- ... inner.html
Re: MFT, USN Journal, $LogFile
Posted: Mon Oct 28, 2019 12:35 pm
by Alt
Thank you for your suggestions. I've passed them to our developers.
Re: MFT, USN Journal, $LogFile
Posted: Mon Jan 13, 2020 5:17 pm
by rwiper
rwiper wrote: ↑Fri Oct 25, 2019 4:57 am
R-TT Team, Please Do
Traces in MFT
Traces in USN Journal
Traces in $LogFile
Any news?
Re: MFT, USN Journal, $LogFile
Posted: Mon Jan 20, 2020 9:18 am
by Alt
You may clean MFT traces by cleaning free drive space. The help page
Wiping Free Disk Space explains how. You may clean either MFT traces alone or together with free disk space by selecting the What to wipe option.
We're going to implement the rest of requests in our future releases. We need some additional time to test them against possible system instability.
Re: MFT, USN Journal, $LogFile
Posted: Mon Jan 20, 2020 11:37 am
by rwiper
Alt wrote: ↑Mon Jan 20, 2020 9:18 am
You may clean MFT traces by cleaning free drive space. The help page
Wiping Free Disk Space explains how. You may clean either MFT traces alone or together with free disk space by selecting the What to wipe option.
We're going to implement the rest of requests in our future releases. We need some additional time to test them against possible system instability.
Thank you so much. I'm waiting. I love r-wipe so much.
Re: MFT, USN Journal, $LogFile
Posted: Sun Apr 19, 2020 4:24 pm
by rwiper
I just wonder. Will this feature come?