|
Mount shadow volumes on disk images
https://forensicswiki.xyz/wiki/index.php?title=Mount_shadow_volumes_on_disk_images diskpart select vdisk file=C:\myimage.vhd attach vdisk readonly vssadmin list shadows vssadmin list shadows /for=E:\ vssadmin list mklink /D C:\shadow_volume_1 \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy7\ rd C:\shadow_volume_1 Configure VSS on Windows Server https://helpcenter.itopia.com/en/articles/724296-configuring-volume-shadow-copies-vss-on-windows-server Configure VSS on Windows 10 https://www.ubackup.com/windows-10/volume-shadow-copy-windows-10.html Step 1, enable on the drive: Control Panel, System, Advanced System Settings, System Protection, Enable on the target drive. Step 2, create a new Task Scheduler entry: Program/script: wmic Arguments: shadowcopy call create Volume=C:\ Step 3, resize if you need to, or redirect to a different drive: vssadmin Resize ShadowStorage /For=C: /On=D: /MaxSize=900MB Create a VSS Snapshot using powershell (gwmi -list win32_shadowcopy).Create('C:\','ClientAccessible') cmd.exe /k powershell -command $class=[WMICLASS]"root\cimv2:win32_shadowcopy" ; $class.create("C:\", "ClientAccessible") powershell.exe -Command (gwmi -list win32_shadowcopy).Create('C:\','ClientAccessible') Create a VSS Snapshot using WMIC wmic shadowcopy call create Volume='C:\' |