What is "Disable Shadow Copy" option?

[Hack3rcon]

Hello,
What is "Disable Shadow Copy" option in cloning? It is better to enable or disable it?
Is it dangerous?

Thanks.

[JeffS]

Regarding the "Disable Shadow Copy" feature... When imaging a "live" system, this operation makes use of the Volume Shadow Copy service built in to Windows to allow OSF to make a copy of drives without resulting in data corruption caused from reading files that are currently being written to. This occurs with live systems as Windows is constantly making changes and modifying things. However, using the VSS, a snapshot state of the drive can be utilized to capture that point in time, so even if important evidence is being removed or modified by another process in the background, it would still appear in the resulting image file. If this feature is disabled while imaging a live system, or if the Volume Shadow Service is not available on that system, OSF tries to lock the drive to prevent any other programs from writing to it.

[JeffS]

"Is it dangerous?" - Attempting to image a live, running system with the Shadow Copy feature disabled, or without locking the drive, can often result in a corrupt image file.

[Hack3rcon]

Thank you.
For make an image from a live system, this option must be checked in OSForensics?

[David (PassMark)]

It should be checked. But there are various reasons why it might not be available (e.g. turned off, or no free disk space),