Storage extent that represents a duplicate copy of the original volume at a previous time
| Functions: | |
| Type: | |
| Toolsets: |
$r = Invoke-CimMethod -ClassName Win32_ShadowCopy -MethodName Create -Arguments @{Volume='C:\'} -CimSession $s
$r
$s using New-CimSession
ROOT\Cimv2
Get-CimInstance -ClassName Win32_ShadowCopy -CimSession $s -Filter "ID=`"$($r.ShadowID)`""
Usecase
SAM/SYSTEM/SECURITY/ntds.dit files
$s using New-CimSession
ROOT\Cimv2