[magicalhippo]

They're talking about the Volume Shadow Copy Service[1], which effectively provides snapshots[2] of the filesystem.

Which files are part of a shadow copy is determined by the one creating a shadow copy, so it could include user data.

You can view and access the files in a shadow copy using ShadowExplorer[3] if you don't have the pro versions.

[1]: https://learn.microsoft.com/en-us/windows-server/storage/fil...

[2]: https://learn.microsoft.com/en-us/windows/win32/vss/the-vss-...

[3]: https://www.shadowexplorer.com/