我试图创建和访问使用Windows电源外壳在Windows 7中，我发现我可以创建使用下面通过以前的快照卷影复制快照超级用户的问题 ：
(Get-WmiObject -list win32_shadowcopy).create("C:\","ClientAccessible")
我无法找到这表明它可以设置一个卷影副本“暴露”，以便它可以映射到使用驱动器号的任何文件WMI 。 的文章中同样的问题链接显示了使用结访问快照黑客攻击。
当我尝试访问符号链接，我得到如下：
PS C:\Windows\system32> ls C:\shadowcopy
Get-ChildItem : The parameter is incorrect.
At line:1 char:3
+ ls <<<< C:\shadowcopy
+ CategoryInfo : ReadError: (C:\shadowcopy:String) [Get-ChildItem], IOException
+ FullyQualifiedErrorId : DirIOError,Microsoft.PowerShell.Commands.GetChildItemCommand
试图直接访问快照提供了以下内容：
PS C:\Windows\system32> ls '\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy14'
Get-ChildItem : Paths that begin with \\?\GlobalRoot are internal to the kernel and should not be opened by managed applications.
At line:1 char:3
+ ls <<<< '\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy14'
+ CategoryInfo : NotSpecified: (:) [Get-ChildItem], ArgumentException
+ FullyQualifiedErrorId : System.ArgumentException,Microsoft.PowerShell.Commands.GetChildItemCommand
我如何从一个PowerShell脚本访问VSS快照？
你是如何创建符号链接？ 作为该文章中介绍，你必须指定一个斜杠设备路径：
$s1 = (Get-WmiObject -List Win32_ShadowCopy).Create("C:\", "ClientAccessible")
$s2 = Get-WmiObject Win32_ShadowCopy | Where-Object { $_.ID -eq $s1.ShadowID }
$d = $s2.DeviceObject + "\" # <-- this here
cmd /c mklink /d C:\shadowcopy "$d"
在此之后，我能够访问安装卷影副本C:\shadowcopy就好了。
要卸载的卷影副本调用$s2.Delete()如@KeyszerS在评论中指出。
因此，与这里提供的信息，在这里微软的官方文档https://docs.microsoft.com/en-us/previous-versions/windows/desktop/vsswmi/create-method-in-class-win32-shadowcopy我创建了一个夫妇PowerShell函数/是解决这个问题的cmdlet。 随机音符，因为PowerShell的5个新项目有symbolicLink的ITEMTYPE但是当我试图让一个与目标是影子快照失败话说，路径不存在，所以mklink工具仍然是要走的路。
function New-ShadowLink {
[CmdletBinding()]
param (
$linkPath="$($ENV:SystemDrive)\ShadowCopy"
)
begin {
Write-Verbose "Creating a snapshot of $($ENV:SystemDrive)\"
$class=[WMICLASS]"root\cimv2:win32_shadowcopy";
$result = $class.create("$ENV:SystemDrive\", "ClientAccessible");
Write-Verbose "Getting the full target path for a symlink to the shadow snapshot"
$shadow = Get-CimInstance -ClassName Win32_ShadowCopy | Where-Object ID -eq $result.ShadowID
$target = "$($shadow.DeviceObject)\";
}
process {
Write-Verbose "Creating SymLink to shadowcopy at $linkPath"
Invoke-Expression -Command "cmd /c mklink /d '$linkPath' '$target'";
}
end {
Write-Verbose "Created link to shadowcopy snapshot of $($ENV:SystemDrive)\ at $linkPath";
Write-Verbose "Returning shadowcopy snapshot object"
return $shadow;
}
}
function Remove-ShadowLink {
[CmdletBinding()]
param (
$shadow,
$linkPath="$($ENV:SystemDrive)\ShadowCopy"
)
begin {
Write-verbose "Removing shadow copy link at $linkPath"
}
process {
Write-Verbose "Deleting the shadowcopy snapshot"
$shadow.Delete();
Write-Verbose "Deleting the now empty folder"
Try {
Remove-Item -Force -Recurse $linkPath -ErrorAction Stop;
}
catch {
Invoke-Expression -Command "cmd /c rmdir /S /Q '$linkPath'";
}
}
end {
Write-Verbose "Shadow link and snapshot have been removed";
return;
}
}
这些可以通过复制粘贴来使用这两个功能，然后运行它们像这样
$shadow = New-ShadowLink -Verbose;
ls C:\ShadowCopy # would show snapshot version of c drive
Remove-ShadowLink -shadow $shadow -Verbose;
ls C:\ShadowCopy # will give error as it doesn't exist
$s = New-ShadowLink -verbose
VERBOSE: Creating a snapshot of C:\
VERBOSE: Getting the full target path for a symlink to the shadow snapshot
VERBOSE: Creating SymLink to shadowcopy at C:\ShadowCopy
VERBOSE: Created link to shadowcopy snapshot of C:\ at C:\ShadowCopy
VERBOSE: Returning shadowcopy snapshot object
PS C:\> ls C:\ShadowCopy
Directory: C:\ShadowCopy
#ommitted my C drive listing, but it would be here
PS C:\> Remove-ShadowLink -shadow $s -Verbose
VERBOSE: Removing shadow copy link at C:\ShadowCopy
VERBOSE: Deleting the shadowcopy snapshot
VERBOSE: Deleting the now empty folder
VERBOSE: Shadow link and snapshot have been removed
PS C:\> ls C:\ShadowCopy
ls : Cannot find path 'C:\ShadowCopy' because it does not exist.
