如何枚举给定文件或文件夹的卷影副本? [英] How to enumerate Shadow Copies of a given file or folder?

问题描述

所以我实际上是在尝试使用 PowerShell 检索屏幕截图中的信息.有点被第一个障碍难住了.

So i'm essentially trying to retrieve the information in the screenshot but with PowerShell. Kind of getting stumped at the first hurdle.

我能找到的最好的是 https://superuser.com/questions/643536/how-to-find-and-open-previous-versions-of-a-folder-programmatically-using-power

但它并不适合.

一直在阅读 https://msdn.microsoft.com/en-us/library/aa393625(v=vs.85).aspx

但我无法理解它.这是正确的道路吗?

But I'm not able to make much sense of it. Is that the right path to be going down?

推荐答案

在 PowerShell 中有几个步骤可以浏览卷影副本.首先，下面的代码将显示驱动器及其卷影副本的列表

There are a few of steps in PowerShell to get to browsing shadow copies. First, below code will display a list of drives and their shadow copies

$shadowStorageList = @();
$volumeList = Get-WmiObject Win32_Volume -Property SystemName,DriveLetter,DeviceID,Capacity,FreeSpace -Filter "DriveType=3" | select @{n="DriveLetter";e={$_.DriveLetter.ToUpper()}},DeviceID,@{n="CapacityGB";e={([math]::Round([int64]($_.Capacity)/1GB,2))}},@{n="FreeSpaceGB";e={([math]::Round([int64]($_.FreeSpace)/1GB,2))}} | Sort DriveLetter;
$shadowStorages = gwmi Win32_ShadowStorage -Property AllocatedSpace,DiffVolume,MaxSpace,UsedSpace,Volume |
                Select @{n="Volume";e={$_.Volume.Replace("\\","\").Replace("Win32_Volume.DeviceID=","").Replace("`"","")}},
                @{n="DiffVolume";e={$_.DiffVolume.Replace("\\","\").Replace("Win32_Volume.DeviceID=","").Replace("`"","")}},
                @{n="AllocatedSpaceGB";e={([math]::Round([int64]($_.AllocatedSpace)/1GB,2))}},
                @{n="MaxSpaceGB";e={([math]::Round([int64]($_.MaxSpace)/1GB,2))}},
                @{n="UsedSpaceGB";e={([math]::Round([int64]($_.UsedSpace)/1GB,2))}}

# Create an array of Customer PSobject
foreach($shStorage in $shadowStorages) {
    $tmpDriveLetter = "";
    foreach($volume in $volumeList) {
        if($shStorage.DiffVolume -eq $volume.DeviceID) {
            $tmpDriveLetter = $volume.DriveLetter;
        }
    }
    $objVolume = New-Object PSObject -Property @{
        Volume = $shStorage.Volume
        AllocatedSpaceGB = $shStorage.AllocatedSpaceGB
        UsedSpaceGB = $shStorage.UsedSpaceGB
        MaxSpaceGB = $shStorage.MaxSpaceGB
        DriveLetter = $tmpDriveLetter
    }
    $shadowStorageList += $objVolume;
}


for($i = 0; $i -lt $shadowStorageList.Count; $i++){
    $objCopyList = Get-WmiObject Win32_ShadowCopy  | Where-Object {$_.VolumeName -eq $shadowStorageList[$i].Volume} | select DeviceObject, InstallDate
    $shadowStorageList[$i] | add-member Noteproperty shadowcopies $objCopyList
    $shadowStorageList[$i]
}

示例输出:

AllocatedSpaceGB : 9.17 DriveLetter : F: Volume :\?\Volume{6c974bfe-0525-11e7-80bf-0050568007f5}\ MaxSpaceGB :15 UsedSpaceGB : 8.46 shadowcopys :{@{DeviceObject=\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy39;安装日期=20170902070009.648986+600}，@{DeviceObject=\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy40;安装日期=20170903070009.902376+600}，@{DeviceObject=\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy41;安装日期=20170904070016.340573+600}，@{DeviceObject=\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy42;安装日期=20170904120031.644419+600}...}

AllocatedSpaceGB : 9.17 DriveLetter : F: Volume : \?\Volume{6c974bfe-0525-11e7-80bf-0050568007f5}\ MaxSpaceGB : 15 UsedSpaceGB : 8.46 shadowcopies : {@{DeviceObject=\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy39; InstallDate=20170902070009.648986+600}, @{DeviceObject=\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy40; InstallDate=20170903070009.902376+600}, @{DeviceObject=\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy41; InstallDate=20170904070016.340573+600}, @{DeviceObject=\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy42; InstallDate=20170904120031.644419+600}...}

AllocatedSpaceGB : 6.28 DriveLetter : C: Volume :\?\Volume{4c22f9da-2b50-11e6-80b3-806e6f6e6963}\ MaxSpaceGB :6.96 UsedSpaceGB : 5.78 shadowcopies : {@{DeviceObject=\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy3;安装日期=20170921070020.298687+600}，@{DeviceObject=\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy4;安装日期=20170921120026.126738+600}，@{DeviceObject=\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy5;安装日期=20170922070025.309517+600}，@{DeviceObject=\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy6;安装日期=20170922120004.852824+600}...}

AllocatedSpaceGB : 6.28 DriveLetter : C: Volume : \?\Volume{4c22f9da-2b50-11e6-80b3-806e6f6e6963}\ MaxSpaceGB : 6.96 UsedSpaceGB : 5.78 shadowcopies : {@{DeviceObject=\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy3; InstallDate=20170921070020.298687+600}, @{DeviceObject=\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy4; InstallDate=20170921120026.126738+600}, @{DeviceObject=\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy5; InstallDate=20170922070025.309517+600}, @{DeviceObject=\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy6; InstallDate=20170922120004.852824+600}...}

要浏览卷影副本(例如 GLOBALROOT\Device\HarddiskVolumeShadowCopy6)，您需要创建指向它的符号链接(Windows 快捷方式)，然后您可以在 Windows 资源管理器中浏览该链接.示例代码如下:

To browse a shadow copy (example GLOBALROOT\Device\HarddiskVolumeShadowCopy6), you need to create a symbolic link to it (windows shortcut) which you can then browse in Windows explorer. Example code below:

# Load assembly to create symlink
try {
    $null = [mklink.symlink]
}
catch {
Add-Type @"
    using System;
    using System.Runtime.InteropServices;

  namespace mklink
    {
    public class symlink
    {
        [DllImport("kernel32.dll")]
        public static extern bool CreateSymbolicLink(string lpSymlinkFileName, string lpTargetFileName, int dwFlags);
    }
  }
"@
}
# create symlink
[mklink.symlink]::CreateSymbolicLink('symlink path (example C:\temp\link1)', '\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy4\', 1);

这篇关于如何枚举给定文件或文件夹的卷影副本?的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！