Categories:
🠪 General
Email
🠪 Servers
🠪 Testing
🠪 Tips
Hardware
🠪 3D Printing
🠪 Apple
🠪 Batteries
🠪 Drives
🠪 Edgerouter
🠪 Electronics
🠪 Laptop
🠪 Modems
🠪 Phone
🠪 Printers
🠪 Raspberry Pi
🠪 Tablets
🠪 Testing
🠪 Virtualization
hidden
🠪 General
Links
🠪 Interesting
🠪 Media
Network
🠪 Data
🠪 Testing
🠪 VPN
Scripts
🠪 Batch
🠪 Linux
🠪 Powershell
Servers
🠪 Databases
🠪 Misc
🠪 Website
Software
🠪 Other
Utilities
🠪 Backup
🠪 Fix Issues
🠪 Recovery
Video
🠪 Editing
Websites
🠪 HTML
🠪 Testing
Windows
🠪 Adjustments
🠪 Issues
🠪 Remote Desktop
🠪 Security
🠪 Slow
🠪 Software
🠪 Startup
Submit Entry
| Airin's Notes
Category: Scripts 🠪 Batch
VSS - Volume Shadow Copies | December 1, 2023 |
Mount shadow volumes on disk images
https://forensicswiki.xyz/wiki/index.php?title=Mount_shadow_volumes_on_disk_images
diskpart
select vdisk file=C:\myimage.vhd
attach vdisk readonly
vssadmin list shadows
vssadmin list shadows /for=E:\
vssadmin list
mklink /D C:\shadow_volume_1 \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy7\
rd C:\shadow_volume_1
Configure VSS on Windows Server
https://helpcenter.itopia.com/en/articles/724296-configuring-volume-shadow-copies-vss-on-windows-server
Configure VSS on Windows 10
https://www.ubackup.com/windows-10/volume-shadow-copy-windows-10.html
Step 1, enable on the drive:
Control Panel, System, Advanced System Settings, System Protection, Enable on the target drive.
Step 2, create a new Task Scheduler entry:
Program/script: wmic
Arguments: shadowcopy call create Volume=C:\
Step 3, resize if you need to, or redirect to a different drive:
vssadmin Resize ShadowStorage /For=C: /On=D: /MaxSize=900MB
Create a VSS Snapshot using powershell
(gwmi -list win32_shadowcopy).Create('C:\','ClientAccessible')
cmd.exe /k powershell -command $class=[WMICLASS]"root\cimv2:win32_shadowcopy" ; $class.create("C:\", "ClientAccessible")
powershell.exe -Command (gwmi -list win32_shadowcopy).Create('C:\','ClientAccessible')
Create a VSS Snapshot using WMIC
wmic shadowcopy call create Volume='C:\'
|
|