ShadowExplorer Hands-on Labs¶

Choose coached browser practice or complete the Full Lab in an authorised VM containing supplied Volume Shadow Copies.

Hands-on snapshot-recovery proof of concept

Select it. Export it. Defend it.

Recover one historical file version while preserving its snapshot, source path, export integrity and evidential limitations.

⏱ Setup: 20–30 min · Exercise: 35–55 min◆ Guided beginner✓ Evidence required

Start the Full Lab

Interactive Lab¶

Full Lab¶

Isolated Windows VM · Setup: 20–30 min · Exercise: 35–55 min

ShadowExplorer Full Lab

Administrator access, supplied snapshots and separate export storage required

Use an authorised training system

Browsing and exporting are live collection actions. Do not overwrite original paths; preserve case output separately.

Objective¶

For case SUSA-SE-026, determine whether C:\Users\Avery\Documents\handover.docx existed in the supplied 28 April snapshot, export that version to X:\SUSA-SE-026\recovered, verify it, and state what the result supports.

01

Activity 1: Establish the boundary¶

Record authority, host, system time and time zone.
Record ShadowExplorer version and executable path.
Identify available volumes and snapshot times without exporting content.
Prepare an empty case directory on separate storage.

Milestone 1Recovery boundary recordedHost, tool, snapshots and destination are reviewable.

02

Activity 2: Locate and export¶

Select C: and snapshot 28/04/2026 08:00:14.
Browse to Users\Avery\Documents and locate handover.docx.
Record displayed name, path, size and timestamps before export.
Right-click, select Export, and choose X:\SUSA-SE-026\recovered.
Record run times, warnings and overwrite prompts.

Milestone 2Historical version exportedThe bytes remain linked to volume, snapshot and original path.

03

Activity 3: Verify and explain¶

Protect and hash the exported file and a working copy.
Open only the verified working copy with an approved viewer.
Compare it with supplied live or later versions.
Separate observation, interpretation, confidence and limitations.

Case and question:
Host, volume and snapshot time:
Original path and displayed metadata:
Export destination and SHA-256:
Working-copy SHA-256:
Conclusion, confidence and limitations:

Milestone 3Finding is reproducibleAnother analyst can repeat the export and verify the bytes.

Full Lab evidence checklist¶

Core completion¶
- Authority, host, time zone and tool version.
- Volume, snapshot time and original path.
- Displayed size and timestamps before export.
- Destination, run times, prompts and errors.
- Matching acquisition and working-copy SHA-256.
- Conclusion, confidence and limitations.

0 of 6 recorded Mark each saved item.

Troubleshooting¶

Symptom	First check
No snapshots appear	Confirm volume, VSS availability, service state and authority.
Expected path is absent	Check another supplied snapshot and path spelling.
Export fails	Check permissions, capacity, conflicts and path length.
Hashes differ	Stop and verify the exact acquisition and working copies.

Clean up¶

Close ShadowExplorer, preserve verified output, detach training storage, remove disposable working files when authorised, and restore the VM snapshot.