Powershell 如何枚举给定文件或文件夹的卷影副本？

因此，我基本上是试图检索屏幕截图中的信息，但使用PowerShell。有点在第一个跨栏时被难倒了

我能找到的最好的是

但它不太合适

我一直在仔细阅读

但我不太明白。这条路走对了吗？

有一些进一步的信息

$SnapshotState=@("VSS_SS_UNKNOWN","VSS_SS_PREPARING","VSS_SS_PROCESSING_PREPARE","VSS_SS_PREPARED","VSS_SS_PROCESSING_PRECOMMIT","VSS_SS_PRECOMMITTED","VSS_SS_PROCESSING_COMMIT","VSS_SS_COMMITTED","VSS_SS_PROCESSING_POSTCOMMIT","VSS_SS_PROCESSING_PREFINALCOMMIT","VSS_SS_PREFINALCOMMITTED","VSS_SS_PROCESSING_POSTFINALCOMMIT","VSS_SS_CREATED","VSS_SS_ABORTED","VSS_SS_DELETED","VSS_SS_POSTCOMMITTED","VSS_SS_COUNT")
$Volumes=Get-Volume
$ShadowProvider=Get-WmiObject -Namespace "root\cimv2" -Class "Win32_ShadowProvider" | Select-Object -Property ID,Name
$ShadowOn=Get-WmiObject -Namespace "root\cimv2" -Class "Win32_ShadowOn" | Select-Object -Property Dependent,Antecedent
$ShadowOn | ForEach-Object { $_.Dependent=$_.Dependent.Replace("Win32_ShadowCopy.ID=",""); $_.Antecedent=$_.Antecedent.Replace("Win32_Volume.DeviceID=",""); $_.Dependent=$_.Dependent.Replace('"',""); $_.Antecedent=$_.Antecedent.Replace('"',""); $_.Antecedent=$_.Antecedent.Replace("\\","\") }
$ShadowCopy=Get-WmiObject -Namespace "root\cimv2" -Class "Win32_ShadowCopy"
$ShadowCopy=@($ShadowCopy)
for ($i=0; $i -lt $ShadowCopy.Count; $i++) {
  $DiffVolume=$ShadowOn | Where-Object { $_.Dependent -eq $ShadowCopy[$i].ID } | Select-Object -ExpandProperty Antecedent
  $DiffVolume=$Volumes | Where-Object { $_.Path -eq $DiffVolume } | Select-Object -ExpandProperty DriveLetter
  $ShadowCopy[$i] | Add-Member -MemberType NoteProperty -Name "DiffVolume" -Value $DiffVolume
  $DriveLetter=$Volumes | Where-Object { $_.Path -eq $ShadowCopy[$i].VolumeName } | Select-Object -ExpandProperty DriveLetter
  $ShadowCopy[$i] | Add-Member -MemberType NoteProperty -Name "Volume" -Value $DriveLetter
  $ShadowCopy[$i] | Add-Member -MemberType NoteProperty -Name "strState" -Value $SnapshotState[$ShadowCopy[$i].State]
  $ShadowCopy[$i] | Add-Member -MemberType NoteProperty -Name "CreateDate" -Value ([System.Management.ManagementDateTimeConverter]::ToDateTime($ShadowCopy[$i].InstallDate))
  $ShadowCopy[$i].PSObject.Properties.Remove("VolumeName")
  $ShadowCopy[$i] | Add-Member -MemberType NoteProperty -Name "Provider" -Value ($ShadowProvider | Where-Object { $_.ID -eq $ShadowCopy[$i].ProviderID } | Select-Object -ExpandProperty Name)
  $ShadowCopy[$i].PSObject.Properties.Remove("ProviderID")
}
$ShadowCopy | Select-Object Count,CreateDate,Volume,DiffVolume,strState,MaxSpace,UsedSpace,AllocatedSpace,Persistent,Differential,ClientAccessible,NoAutoRelease,NoWriters,ExposedLocally,ExposedRemotely,NotSurfaced,Transportable,Provider | Sort-Object -Property Count

---

还有一个名为vssadmin的实用程序，它似乎是本机实用程序。此链接使用vssadmin和select string来获取信息

要浏览卷影副本，PowerShell中有几个步骤。 首先，下面的代码将显示驱动器及其卷影副本的列表

$shadowStorageList = @();
$volumeList = Get-WmiObject Win32_Volume -Property SystemName,DriveLetter,DeviceID,Capacity,FreeSpace -Filter "DriveType=3" | select @{n="DriveLetter";e={$_.DriveLetter.ToUpper()}},DeviceID,@{n="CapacityGB";e={([math]::Round([int64]($_.Capacity)/1GB,2))}},@{n="FreeSpaceGB";e={([math]::Round([int64]($_.FreeSpace)/1GB,2))}} | Sort DriveLetter;
$shadowStorages = gwmi Win32_ShadowStorage -Property AllocatedSpace,DiffVolume,MaxSpace,UsedSpace,Volume |
                Select @{n="Volume";e={$_.Volume.Replace("\\","\").Replace("Win32_Volume.DeviceID=","").Replace("`"","")}},
                @{n="DiffVolume";e={$_.DiffVolume.Replace("\\","\").Replace("Win32_Volume.DeviceID=","").Replace("`"","")}},
                @{n="AllocatedSpaceGB";e={([math]::Round([int64]($_.AllocatedSpace)/1GB,2))}},
                @{n="MaxSpaceGB";e={([math]::Round([int64]($_.MaxSpace)/1GB,2))}},
                @{n="UsedSpaceGB";e={([math]::Round([int64]($_.UsedSpace)/1GB,2))}}

# Create an array of Customer PSobject
foreach($shStorage in $shadowStorages) {
    $tmpDriveLetter = "";
    foreach($volume in $volumeList) {
        if($shStorage.DiffVolume -eq $volume.DeviceID) {
            $tmpDriveLetter = $volume.DriveLetter;
        }
    }
    $objVolume = New-Object PSObject -Property @{
        Volume = $shStorage.Volume
        AllocatedSpaceGB = $shStorage.AllocatedSpaceGB
        UsedSpaceGB = $shStorage.UsedSpaceGB
        MaxSpaceGB = $shStorage.MaxSpaceGB
        DriveLetter = $tmpDriveLetter
    }
    $shadowStorageList += $objVolume;
}


for($i = 0; $i -lt $shadowStorageList.Count; $i++){
    $objCopyList = Get-WmiObject Win32_ShadowCopy  | Where-Object {$_.VolumeName -eq $shadowStorageList[$i].Volume} | select DeviceObject, InstallDate
    $shadowStorageList[$i] | add-member Noteproperty shadowcopies $objCopyList
    $shadowStorageList[$i]
}

样本输出：

AllocatedSpaceGB:9.17驱动器号：F:卷： \？\Volume{6c974bfe-0525-11e7-80bf-005056807F5}\MaxSpaceGB: 15个UsedSpaceGB:8.46卷影副本： {@{DeviceObject=\？\GLOBALROOT\Device\HarddiskVolumeShadowCopy39； InstallDate=2017090207009.648986+600}，@{DeviceObject=\？\GLOBALROOT\Device\HarddiskVolumeShadowCopy40； InstallDate=2017090307009.902376+600}，@{DeviceObject=\？\GLOBALROOT\Device\HarddiskVolumeShadowCopy41； InstallDate=20170904070016.340573+600}，@{DeviceObject=\？\GLOBALROOT\Device\HarddiskVolumeShadowCopy42； 安装日期=20170904120031.644419+600}…}

AllocatedSpaceGB:6.28驱动器号：C:卷： \？\Volume{4c22f9da-2b50-11e6-80b3-806e6f6e6963}\MaxSpaceGB: 6.96 UsedSpaceGB:5.78卷影副本：{@{DeviceObject=\？\GLOBALROOT\Device\HarddiskVolumeShadowCopy3； 安装日期=20170921070020.298687+600}， @{DeviceObject=\？\GLOBALROOT\Device\HarddiskVolumeShadowCopy4； 安装日期=20170921120026.126738+600}， @{DeviceObject=\？\GLOBALROOT\Device\HarddiskVolumeShadowCopy5； 安装日期=20170922070025.309517+600}， @{DeviceObject=\？\GLOBALROOT\Device\HarddiskVolumeShadowCopy6； InstallDate=20170922120004.852824+600}…}

要浏览卷影副本（例如GLOBALROOT\Device\HarddiskVolumeShadowCopy6），您需要创建指向该卷影副本的符号链接（windows快捷方式），然后可以在windows资源管理器中浏览该卷影副本。 示例代码如下：

# Load assembly to create symlink
try {
    $null = [mklink.symlink]
}
catch {
Add-Type @"
    using System;
    using System.Runtime.InteropServices;

  namespace mklink
    {
    public class symlink
    {
        [DllImport("kernel32.dll")]
        public static extern bool CreateSymbolicLink(string lpSymlinkFileName, string lpTargetFileName, int dwFlags);
    }
  }
"@
}
# create symlink
[mklink.symlink]::CreateSymbolicLink('symlink path (example C:\temp\link1)', '\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy4\', 1);

---

虽然这可能不是OP问题的精确解决方案，但我将其添加到几个相关帖子中，希望它能帮助其他人，他们和我一样，需要一种方法列出远程路径上的所有快照。寻找这个是痛苦的，我正要放弃，直到我找到了答案

我一直在搜索以编程方式列出以前版本的功能。。找不到在SMB/CIFS共享上查看以前版本的解决方案。Volrest、vssadmin、alphaVss等。。周而复始。。甚至win32_shadowCopy也失败了，因为我们的目标机器是NetApp。什么都没用

然后我发现这篇文章说他们可以使用Perl中的SMB命令来查看它们

如果Perl可以做到这一点，那么某些winAPI肯定也可以做到。FSCTL_SRV_ENUMERATE_快照是所需的SMB命令

终于找到了这位为.NET创建dll的天才（上帝保佑Kenjuino）：

在添加对Kenjuino的dll的引用后，我将其命名为：

Dim s() as String = LibEnumRemotePreviousVersion.PreviousversionOnRemote("\\server\share")

它以@GMT bla返回所有以前的版本。然后，您需要做的就是将您想要的附加到UNC路径的末尾

---

没有mklink，没有映射驱动器，没有任何驱动器。。如果微软自己掏出脑袋把它放进.Net中，一切都会准确、简单地运行。

卷影副本不是按文件夹存储的。这是以每卷为基础的。通过在

HKLM\system\CurrentControlSet\Control\BackupRestore\filesnotosnapshot

中设置注册表项，可以排除卷影复制的内容。您将在这里看到示例。注意“

/s

”参数，它指示递归子目录。还要注意，不能将通配符放在路径的中间。他们只能在最后。下面是我的脚本，用于枚举副本及其相关信息

$SnapshotState=@("VSS_SS_UNKNOWN","VSS_SS_PREPARING","VSS_SS_PROCESSING_PREPARE","VSS_SS_PREPARED","VSS_SS_PROCESSING_PRECOMMIT","VSS_SS_PRECOMMITTED","VSS_SS_PROCESSING_COMMIT","VSS_SS_COMMITTED","VSS_SS_PROCESSING_POSTCOMMIT","VSS_SS_PROCESSING_PREFINALCOMMIT","VSS_SS_PREFINALCOMMITTED","VSS_SS_PROCESSING_POSTFINALCOMMIT","VSS_SS_CREATED","VSS_SS_ABORTED","VSS_SS_DELETED","VSS_SS_POSTCOMMITTED","VSS_SS_COUNT")
$Volumes=Get-Volume
$ShadowProvider=Get-WmiObject -Namespace "root\cimv2" -Class "Win32_ShadowProvider" | Select-Object -Property ID,Name
$ShadowOn=Get-WmiObject -Namespace "root\cimv2" -Class "Win32_ShadowOn" | Select-Object -Property Dependent,Antecedent
$ShadowOn | ForEach-Object { $_.Dependent=$_.Dependent.Replace("Win32_ShadowCopy.ID=",""); $_.Antecedent=$_.Antecedent.Replace("Win32_Volume.DeviceID=",""); $_.Dependent=$_.Dependent.Replace('"',""); $_.Antecedent=$_.Antecedent.Replace('"',""); $_.Antecedent=$_.Antecedent.Replace("\\","\") }
$ShadowCopy=Get-WmiObject -Namespace "root\cimv2" -Class "Win32_ShadowCopy"
$ShadowCopy=@($ShadowCopy)
for ($i=0; $i -lt $ShadowCopy.Count; $i++) {
  $DiffVolume=$ShadowOn | Where-Object { $_.Dependent -eq $ShadowCopy[$i].ID } | Select-Object -ExpandProperty Antecedent
  $DiffVolume=$Volumes | Where-Object { $_.Path -eq $DiffVolume } | Select-Object -ExpandProperty DriveLetter
  $ShadowCopy[$i] | Add-Member -MemberType NoteProperty -Name "DiffVolume" -Value $DiffVolume
  $DriveLetter=$Volumes | Where-Object { $_.Path -eq $ShadowCopy[$i].VolumeName } | Select-Object -ExpandProperty DriveLetter
  $ShadowCopy[$i] | Add-Member -MemberType NoteProperty -Name "Volume" -Value $DriveLetter
  $ShadowCopy[$i] | Add-Member -MemberType NoteProperty -Name "strState" -Value $SnapshotState[$ShadowCopy[$i].State]
  $ShadowCopy[$i] | Add-Member -MemberType NoteProperty -Name "CreateDate" -Value ([System.Management.ManagementDateTimeConverter]::ToDateTime($ShadowCopy[$i].InstallDate))
  $ShadowCopy[$i].PSObject.Properties.Remove("VolumeName")
  $ShadowCopy[$i] | Add-Member -MemberType NoteProperty -Name "Provider" -Value ($ShadowProvider | Where-Object { $_.ID -eq $ShadowCopy[$i].ProviderID } | Select-Object -ExpandProperty Name)
  $ShadowCopy[$i].PSObject.Properties.Remove("ProviderID")
}
$ShadowCopy | Select-Object Count,CreateDate,Volume,DiffVolume,strState,MaxSpace,UsedSpace,AllocatedSpace,Persistent,Differential,ClientAccessible,NoAutoRelease,NoWriters,ExposedLocally,ExposedRemotely,NotSurfaced,Transportable,Provider | Sort-Object -Property Count

---

获取WmiObject Win32\u卷影副本

？