Windows 10: An abriviation I'm not familiar with? SVC?

Hi there,

I've been trying to recover a family members files after they fell victim to the new .locky Ransomware - After managing to recover some files using Recuva I went looking for some further reading on the subject.

I came across the page linked below and on it a commenter said:
"Windows 7 has shadow files. Too bad those files are corrupt because of the LOCKY virus ... but ... we were able to recover those files with RECUVA, restore them and start SHADOWEXPLORER and go back 6 days to recover a shadowcopy from the lost data folder. In the end we recovered about 99% of lost files !"

Someone replied with:
"That's great news. So to be clear, you use recuva to restore an old SVC and then used that to restore the files?"

It was this that had me interested and confused...Anyone know what the SVC is?

This of course was on a page pertaining to networks and could be something to do with that and therefore has no relevance to home users.

Thanks in advance.

http://www.bleepingcomputer.com/news...etwork-shares/

:)

 

What is the NoDo update? I'm not familiar with that.

It was the second WP7 update (for everyone, not just in Europe).
7004 - Original release
7008 - First update, to make updating work properly
7390 - NoDo - introduced Copy and Paste and allowed an applications only filter on Marketplace searching, plus a few other improvements, mostly performance related
7392 - Security update
7720 - Mango
7740 - Recent update,effectively first Mango service pack

 

What is the NoDo update? I'm not familiar with that.

All updates are cumulative, so if you have 7720 you automatically have all the previous ones I listed.

 

Possibly Shadow Volume Copy. (AKA Restore Point) Not really sure. But the way they are talking, files can be restored individually by "mounting" a restore point and picking thru with Explorer. A program I have used to explore a Restore Point (Shadow Copy) is System Restore Explorer. Download System Restore Explorer - MajorGeeks

 

Thanks for the reply! *Smile

Yeah, its what I thought - it seems not to directly correspond to anything. I'm currently searching the System Volume information folder using the \\localhost\C$ address and having used the 'take ownership' reg edit to grant access to the folder.

I'm finishing an inital Recuva deep scan for the files not overwritten. I then plan to use Recuva to try and recover the System Volume information folder as I suspect that .locky has corrupted it as well - I suspect this because (as you mentioned) Shadow Explorer is showing 'shadows' all dated the same. I did however manage to find dated shadows using 'Z-VSScopy' http://www.z-dbackup.com/vss-shadow-...le-backup.html

Unfortunatley these files are still locked. I am unsure when Locky got into the PC.

I will restore to a previous point after using recuva on the System volume information folder and try again.

Thanks again *Smile
L