This may be old news to you, but it was new to me... I was reading about Vista and volume shadow copy on /. (http://it.slashdot.org/it/07/07/14/071237.shtml) when I decided to try running vssadmin.exe on my Win XP, SP2 box. Imagine my suprise to see it installed -- not only that, it has a 2001 copyright date on it! Ok, chaulk that up to in-attention on my part; yet another place to look for forensic-type data...