June 21, 2022, 10:54 a.m. | /u/tzichntzch

Computer Forensics www.reddit.com

Hello all,

I have a laptop ssd drive with windows,

I took the drive created E01 file, decrypt it from bittlocker encryption and i want to know the history of the partitions,

I tried to use volume shadow copies but they all very recent, how can I tell if the partitions changed somehow?

thanks in advance.

computerforensics

SOC 2 Manager, Audit and Certification

@ Deloitte | US and CA Multiple Locations

Digital Trust Cyber Transformation Senior

@ KPMG India | Mumbai, Maharashtra, India

Security Consultant, Assessment Services - SOC 2 | Remote US

@ Coalfire | United States

Sr. Systems Security Engineer

@ Effectual | Washington, DC

Cyber Network Engineer

@ SonicWall | Woodbridge, Virginia, United States

Security Architect

@ Nokia | Belgium