.. / Win32_ShadowCopy

Storage extent that represents a duplicate copy of the original volume at a previous time


Functions:
Type:
Toolsets:

Data

Create new shadow copy

$r = Invoke-CimMethod -ClassName Win32_ShadowCopy -MethodName Create -Arguments @{Volume='C:\'} -CimSession $s
$r

Comments

Show details of a volume shadow copy

Get-CimInstance -ClassName Win32_ShadowCopy -CimSession $s -Filter "ID=`"$($r.ShadowID)`""
Usecase
Get shadow copy details for use with Copy-Item to obtain SAM/SYSTEM/SECURITY/ntds.dit files

Comments



Updated: 2023-07-01
Contributor: Arris Huijgen (bitsadmin)