Storage extent that represents a duplicate copy of the original volume at a previous time
Functions: | |
Type: | |
Toolsets: |
$r = Invoke-CimMethod -ClassName Win32_ShadowCopy -MethodName Create -Arguments @{Volume='C:\'} -CimSession $s
$r
$s
using New-CimSession
ROOT\Cimv2
Get-CimInstance -ClassName Win32_ShadowCopy -CimSession $s -Filter "ID=`"$($r.ShadowID)`""
Usecase
SAM
/SYSTEM
/SECURITY
/ntds.dit
files
$s
using New-CimSession
ROOT\Cimv2