1

Is it possible to determine whether a restore has been carried out on a file or folder from a Volume Shadow Copy snapshot?

Moo
  • 2,225
  • 19
  • 23

1 Answers1

1

If you mean can you tell if a file has been replaced by an older version copied from a shadow copy, then the answer is no. I suppose you could compare it's timestamp with versions in all the older shadow copies to see if one matched, but there's no system audit of retrieving a file from a shadow copy.

JR

John Rennie
  • 7,756
  • 1
  • 22
  • 34