ShadowExplorer Hands on Labs

Choose browser practice or recover a real earlier file version in a disposable Windows VM. Both routes use a harmless handover file and finish with a checked copy and a short finding.

Interactive Lab

Browser practice

ShadowExplorer Interactive Lab

Expand labOpen in new tab

No installation

Aster's support team needs the handover file from before a change reported at 08:30 UTC on 28 April. On training host WIN11-LAB01, find C:\Users\Avery\Documents\handover.txt in an earlier snapshot. Export it to the case folder, check a copy and write a short note. A snapshot is a saved view of the files at one time.

Browser simulation · Snapshot times and file lists are fictional; all displayed case times use UTC. The export returns a harmless text example with real byte hashes. No Windows host or Volume Shadow Copy is read. Verification and handover controls below the window belong to this course.

1. 1Find
2. 2Export
3. 3Check copy
4. 4Hand over

Show hint

SUSA-SE-026 · WIN11-LAB01Before: 28/04/2026 08:30 UTC

Open Export menuRight click a selected file, or press Shift+F10. On touch screens, use the button.

Full Lab

Windows VM / real file recovery

ShadowExplorer Full Lab

Three short activities

Case SUSA-SE-026 / before and after

Recover the earlier handover. Show what changed.

Aster's support team says a release time changed in a handover file. Make a harmless training file, save a Windows shadow copy, then change the file. Use ShadowExplorer to recover the earlier version and leave a checked copy and a short finding.

Tick each checkpoint after saving its evidence. Progress is self reported; this page cannot check your VM.

Investigation brief

Case questionWhat release time did the earlier handover contain?

Your task

Recover C:\SUSA-ShadowExplorer\handover.txt from a snapshot taken before the change. Compare it with the changed file.

Real case note: A snapshot is a saved view of a volume at one time. In a real incident, use existing shadow copies under your collection plan. Creating one after a change cannot bring back a missing earlier version. This lab creates a snapshot only to prepare a disposable training VM.

Before you start

Need: a disposable Windows 10 or 11 VM, administrator access for setup, Windows PowerShell 5.1, ShadowExplorer installed, and a separate writable training volume mounted as X:. Take a clean VM snapshot in your VM manager first so you can reset the exercise later.

Follow: use one administrator PowerShell window and run the blocks in order. Expand one step at a time and check its Look for result. Your real snapshot dates will differ from the browser lab's example dates.

Need help with the VM or storage?

Attach a spare virtual disk or approved training storage and give it drive letter X:. Keep case output there, away from the source on C:. Confirm both drives have free space. A VM snapshot saves the VM for rollback; a Windows shadow copy supplies the historical files that ShadowExplorer can browse. They serve different purposes.

If your course supplies a VM prepared for this exercise, confirm its case folder includes case-context.txt, before-sha256.csv, after-sha256.csv and after-reference.txt, plus the pre change shadow copy. Set $seCase = 'X:\SUSA-SE-026' and $seSource = 'C:\SUSA-ShadowExplorer\handover.txt' in PowerShell, then start at Activity 2, step 2. Use the snapshot time recorded in its case sheet. For a different supplied case, follow Browse and export with that case's paths and expected results.

Activity 1: Prepare the snapshot

Your first winSee your training file in a real Windows shadow copy before changing it.

1. Make the file and save its starting hash

Open Windows PowerShell as administrator inside the training VM. This block stops if either lab folder already exists. For another attempt, reset the disposable VM and choose a new case folder rather than overwrite saved evidence.

$seCase = 'X:\SUSA-SE-026'
$seSource = 'C:\SUSA-ShadowExplorer\handover.txt'
if (-not (Test-Path -LiteralPath 'X:\' -PathType Container)) { throw 'Attach the separate X: training volume first.' }
if (Test-Path -LiteralPath $seCase) { throw 'Case folder exists. Choose a new case folder.' }
if (Test-Path -LiteralPath 'C:\SUSA-ShadowExplorer') { throw 'Source folder exists. Use a clean training VM.' }
New-Item -ItemType Directory -Path $seCase, "$seCase\recovered", "$seCase\working", 'C:\SUSA-ShadowExplorer' -ErrorAction Stop | Out-Null
@(
    'Aster support handover'
    'Training example - SUSA-SE-026'
    'Release window: 17:00 UTC'
    'Next check: confirm the support ticket before changing the schedule.'
) | Set-Content -LiteralPath $seSource -Encoding UTF8 -ErrorAction Stop
Get-FileHash -Algorithm SHA256 -LiteralPath $seSource |
    Export-Csv -LiteralPath "$seCase\before-sha256.csv" -NoTypeInformation
@(
    'Case: SUSA-SE-026; disposable training VM'
    "Computer: $env:COMPUTERNAME"
    "Local time: $(Get-Date -Format o)"
    "Time zone: $((Get-TimeZone).Id)"
    "Source: $seSource"
    "Case folder: $seCase"
) | Set-Content -LiteralPath "$seCase\case-context.txt"
Get-Content -LiteralPath $seSource

Look for: Release window: 17:00 UTC and a saved before-sha256.csv. SHA-256 is a file fingerprint: matching hashes show matching bytes. Add ShadowExplorer's version and executable path to case-context.txt. Keep this PowerShell window open.

2. Create and check the training shadow copy

Close any editor displaying the training file. In ShadowExplorer, note the existing snapshot dates for C:. Then use Windows System Protection in this disposable VM:

1. Open Start, search Create a restore point, and open it.
2. On System Protection, select C:. If protection is off, select Configure, turn it on, allow disk space for restore points, and select Apply. Record any setting you change.
3. Select Create, enter SUSA-SE-026-before, and wait for the success message.
4. Close and reopen ShadowExplorer. Select C: and the newly listed snapshot. Browse to SUSA-ShadowExplorer and find handover.txt.
5. Save a screenshot showing the selected volume, snapshot time, folder and file. In case-context.txt, record the displayed snapshot date and time and the VM's time zone.

Look for: the training file in the new snapshot before you change the live file. Restore point creation alone does not prove the file is recoverable; check it in ShadowExplorer. Do not apply the restore point.

No new snapshot or no training file?

Confirm you selected C: and a snapshot made after creating the file. Check that System Protection completed successfully and has free disk space. Restart ShadowExplorer; if access is denied, try Run as administrator inside the VM. If the snapshot or file is still absent, stop here and use a prepared training VM. Keep a note of the failure. Enabling protection now cannot recover a real file's past state.

Ready to make the change I saved the VM, time zone, tool details and starting file hash. I saved the selected snapshot time and a screenshot showing the training file.Pause point: keep the case folder and the PowerShell window. If you reopen the window, set $seCase and $seSource to your recorded paths.

Next: change the live file, then recover its earlier version.

Continue to recovery ›

Activity 2: Recover the file

Your next winRecover the 17:00 version while the live file says 19:30.

Make your call

You are about to change the live file. What should the earlier snapshot contain? Does the snapshot time tell you exactly when someone later edited the file?

1. Change only the harmless live file

Continue only after seeing the file in your new snapshot. This block checks the starting hash before changing the training file and saves a copy of the changed version for comparison.

$seBeforeHash = (Import-Csv -LiteralPath "$seCase\before-sha256.csv").Hash
if ((Get-FileHash -Algorithm SHA256 -LiteralPath $seSource -ErrorAction Stop).Hash -ne $seBeforeHash) { throw 'Source differs from the starting file. Stop and inspect it.' }
if (Test-Path -LiteralPath "$seCase\after-reference.txt") { throw 'Changed version already saved. Do not repeat this step.' }
@(
    'Aster support handover'
    'Training example - SUSA-SE-026'
    'Release window: 19:30 UTC'
    'Next check: confirm the support ticket before changing the schedule.'
) | Set-Content -LiteralPath $seSource -Encoding UTF8 -ErrorAction Stop
Copy-Item -LiteralPath $seSource -Destination "$seCase\after-reference.txt" -ErrorAction Stop
Get-FileHash -Algorithm SHA256 -LiteralPath "$seCase\after-reference.txt" |
    Export-Csv -LiteralPath "$seCase\after-sha256.csv" -NoTypeInformation
"Controlled change recorded: $(Get-Date -Format o)" | Add-Content -LiteralPath "$seCase\case-context.txt"
Get-Content -LiteralPath "$seCase\after-reference.txt"

Look for: Release window: 19:30 UTC. The earlier snapshot should still hold the 17:00 version. The recorded lab time is a training reference, not a timestamp inferred by ShadowExplorer.

2. Export the earlier version with ShadowExplorer

1. Select C: and the same pre change snapshot you recorded in Activity 1. Use your VM's actual date, not the browser lab's date.
2. Browse to C:\SUSA-ShadowExplorer and select handover.txt. Save a screenshot with the volume, snapshot and file columns visible. Record the original path, displayed size, and modified, created and accessed times in case-context.txt.
3. Right click the file, choose Export, and select the empty X:\SUSA-SE-026\recovered folder (or your recorded case path).
4. Wait for export to finish. Record the export start and finish times, destination and any errors in case-context.txt.

Look for: recovered\handover.txt in your case folder. Leave it closed for now. Use the snapshot's displayed metadata in your note; destination metadata alone does not identify its source snapshot.

An overwrite prompt or export error?

Choose No or cancel if a destination file exists. Keep it and use a new, empty export folder; update the paths in the next steps. Leave Do not show this dialog again unchecked. If overwrite prompts were disabled, File → Settings lets you reset that choice. For export errors, check destination permissions, free space and the selected source path. Save the error and keep failed attempts separately.

Ready to check the export I saved the changed file, its hash and the controlled change time. I saved the earlier export with its snapshot, original path, metadata and export notes.Pause point: keep both versions. Export to the case folder, away from the original source path.

Next: check the recovered bytes and explain the difference.

Continue to checking ›

Activity 3: Check and explain

Your final winShow that the recovered file matches the starting version, then explain what it can tell the team.

1. Check the hashes and read a working copy

A working copy lets you review the file while keeping the original export. This block saves all four hashes, stops if the recovered file differs from the starting version, and checks the working copy. Read only protection helps prevent accidental edits; it is not a tamper proof evidence store.

$seRecovered = "$seCase\recovered\handover.txt"
$seWorking = "$seCase\working\handover.txt"
if (Test-Path -LiteralPath $seWorking) { throw 'Working copy exists. Keep it and choose a new working path.' }
$seBeforeHash = (Import-Csv -LiteralPath "$seCase\before-sha256.csv").Hash
$seAfterHash = (Import-Csv -LiteralPath "$seCase\after-sha256.csv").Hash
if ((Get-FileHash -Algorithm SHA256 -LiteralPath "$seCase\after-reference.txt" -ErrorAction Stop).Hash -ne $seAfterHash) { throw 'Changed reference no longer matches its saved hash. Stop and inspect it.' }
$seRecoveredHash = (Get-FileHash -Algorithm SHA256 -LiteralPath $seRecovered -ErrorAction Stop).Hash
(Get-Item -LiteralPath $seRecovered).IsReadOnly = $true
Copy-Item -LiteralPath $seRecovered -Destination $seWorking -ErrorAction Stop
(Get-Item -LiteralPath $seWorking).IsReadOnly = $false
$seWorkingHash = (Get-FileHash -Algorithm SHA256 -LiteralPath $seWorking).Hash
@(
    [pscustomobject]@{Version='Starting file'; Path=$seSource; SHA256=$seBeforeHash}
    [pscustomobject]@{Version='Changed reference'; Path="$seCase\after-reference.txt"; SHA256=$seAfterHash}
    [pscustomobject]@{Version='Recovered export'; Path=$seRecovered; SHA256=$seRecoveredHash}
    [pscustomobject]@{Version='Working copy'; Path=$seWorking; SHA256=$seWorkingHash}
) | Export-Csv -LiteralPath "$seCase\comparison.csv" -NoTypeInformation
if ($seRecoveredHash -ne $seBeforeHash) { throw 'Recovered file differs from the starting version. Check the snapshot and path; keep this attempt.' }
if ($seWorkingHash -ne $seRecoveredHash) { throw 'Working copy differs from the export. Stop and make a fresh copy in a new folder.' }
if ($seRecoveredHash -eq $seAfterHash) { throw 'Recovered and changed hashes match. Check whether the controlled change succeeded.' }
Get-Content -LiteralPath $seWorking

Look for: the starting file, recovered export and working copy have the same SHA-256; the changed reference has a different one. The working copy says 17:00 UTC; after-reference.txt says 19:30 UTC. Open the working copy and changed reference in Notepad to compare them. Keep the exported file unchanged.

Hash mismatch or a supplied case without a starting hash?

For a mismatch, keep comparison.csv and the failed export. Recheck the snapshot date and source path, then export to a new empty folder. Use new working and comparison paths so you keep earlier attempts. Report an unresolved mismatch rather than claim successful recovery.

In a real case, you often have no saved starting hash. Compare the export with its working copy to check that your copy matches. That does not prove the export matches a lost original. If using a supplied case, compare with its expected hash only when the case sheet provides one. Record that limit in your note.

2. Write a short finding

Make the analyst's callThe recovered file says 17:00. The changed reference says 19:30. What can you report?

Avery changed the time without approval.The selected snapshot contains an earlier version with a different release time.The file changed at the snapshot time.

Choose a finding, then use your actual results in the note.

Paste this template into Notepad and save it as handover.txt in the case folder root, outside recovered and working. Use your actual dates, paths and results. A clear account of a failed export is useful evidence too.

Question: What release time did the earlier handover contain?
VM, time zone and ShadowExplorer version/path:
Source volume, selected snapshot date/time and original file path:
Displayed file size and modified/created/accessed times:
Export destination, start/finish times and errors or prompts:
Checks: starting, export, working-copy and changed-reference SHA-256 (see comparison.csv).
Finding: earlier text ___; changed reference text ___; matching or differing hashes ___.
Limits: these versions do not identify the editor, approval or exact edit time.
Next check: compare the support ticket and change records with this finding.
Closeout: where the complete case folder was preserved before VM rollback.

Real DFIR use: ShadowExplorer helps recover available earlier file versions. It does not recover every deleted file, bypass encryption, or explain who made a change. Pair the recovered text and recorded snapshot with other case evidence. Treat unknown recovered files cautiously; this lab uses a harmless text file.

Case closeout3. Keep your evidence and reset the training VM

Preserve first

Keep the entire case folder: context, screenshots, both version hashes, changed reference, export, working copy, comparison and handover. Keep failed attempts with notes too.

Close ShadowExplorer and Notepad. Copy the complete case folder to storage that will survive VM rollback. Open the copied handover and compare the copied recovered file's SHA-256 with the saved recovered hash in comparison.csv. Record the copy location and check result. Then detach the case storage and roll back the disposable VM using your VM manager's clean snapshot. Do not delete shadow copies or apply System Restore on an incident machine to tidy up this exercise.

Ready for another analyst I saved the hash comparison and checked the two versions, or recorded the failure clearly. I saved a finding with limits and a next check, and verified the case copy outside the VM.You have recovered, checked and explained an earlier file version. Keep your case folder as the record of your work.

Finish with a note another analyst can check from your saved files.

Review your evidence ›

Full Lab evidence checklist

Case folder handoverSave the two checkpoints in each activity.

• 1Contextcase-context.txt, snapshot and file screenshots, before-sha256.csv
• 2Versionsrecovered/handover.txt, working/handover.txt, after-reference.txt, after-sha256.csv
• 3Findingcomparison.csv, handover.txt, errors and a verified case copy outside the VM

The recovery controls follow the ShadowExplorer manual. Your saved bytes and source details support the finding; browser ticks alone do not.

PreviousBrowse and exportReviewReturn to overview