Diskshadow
Diskshadow.exe is a tool that exposes the functionality offered by the volume shadow copy Service (VSS). By default, Diskshadow uses an interactive command interpreter similar to that of Diskraid or Diskpart. Microsoft documentation
See an use example in Abusing Windows Group privileges.
| Command | Description |
|---|---|
| set command | Sets the context, options, verbose mode, and metadata file for creating shadow copies. |
| load metadata command | Loads a metadata .cab file prior to importing a transportable shadow copy or loads the writer metadata in the case of a restore. |
| writer command | verifies that a writer or component is included or excludes a writer or component from the backup or restore procedure. |
| add command | Adds volumes to the set of volumes that are to be shadow copied, or adds aliases to the alias environment. |
| create command | Starts the shadow copy creation process, using the current context and option settings. |
| exec command | Executes a file on the local computer. |
| begin backup command | Starts a full backup session. |
| end backup command | Ends a full backup session and issues a backupcomplete event with the appropriate writer state, if needed. |
| begin restore command | Starts a restore session and issues a prerestore event to involved writers. |
| end restore command | Ends a restore session and issues a postrestore event to involved writers. |
| reset command | Resets Diskshadow to the default state. |
| list command | Lists writers, shadow copies, or currently registered shadow copy providers that are on the system. |
| delete shadows command | Deletes shadow copies. |
| import command | Imports a transportable shadow copy from a loaded metadata file into the system. |
| mask command | Removes hardware shadow copies that were imported by using the import command. |
| expose command | Exposes a persistent shadow copy as a drive letter, share, or mount point. |
| unexpose command | Unexposes a shadow copy that was exposed by using the expose command. |
| break command | Disassociates a shadow copy volume from VSS. |
| revert command | Reverts a volume back to a specified shadow copy. |
| exit command | Exits the command interpreter or script. |