.. / volrest.exe

Previous Version command-line tool

• https://blog.bitsadmin.com/extracting-credentials-from-remote-windows-system

Data

List snapshots of network share

volrest.exe \\W10.ad.bitsadmin.com\C$\Windows\System32\Config

• Also known as volume shadow copies
• Part of the Windows Server 2003 Resource Kit

• T1083
• T1003.002