19

我正在尝试使用 Windows 7 中的 Windows Power Shell 创建和访问卷影复制快照。我发现我可以通过之前的超级用户问题使用以下内容创建快照：

(Get-WmiObject -list win32_shadowcopy).create("C:\","ClientAccessible")

我找不到任何文档表明可以将卷影副本设置为“已公开”，以便可以使用WMI. 同一个问题中链接的一篇文章显示了使用联结访问快照的黑客行为。

当我尝试访问符号链接时，我得到以下信息：

PS C:\Windows\system32> ls C:\shadowcopy
Get-ChildItem : The parameter is incorrect.

At line:1 char:3
+ ls <<<<  C:\shadowcopy
    + CategoryInfo          : ReadError: (C:\shadowcopy:String) [Get-ChildItem], IOException
    + FullyQualifiedErrorId : DirIOError,Microsoft.PowerShell.Commands.GetChildItemCommand

尝试直接访问快照会给出以下结果：

PS C:\Windows\system32> ls '\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy14'
Get-ChildItem : Paths that begin with \\?\GlobalRoot are internal to the kernel and should not be opened by managed applications.
At line:1 char:3
+ ls <<<<  '\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy14'
    + CategoryInfo          : NotSpecified: (:) [Get-ChildItem], ArgumentException
    + FullyQualifiedErrorId : System.ArgumentException,Microsoft.PowerShell.Commands.GetChildItemCommand

如何从 powershell 脚本访问 VSS 快照？

4

4 回答 4

31

你是如何创建符号链接的？如该文章中所述，您必须使用尾部反斜杠指定设备路径：

$s1 = (Get-WmiObject -List Win32_ShadowCopy).Create("C:\\", "ClientAccessible")
$s2 = Get-WmiObject Win32_ShadowCopy | Where-Object { $_.ID -eq $s1.ShadowID }
$d  = $s2.DeviceObject + "\\"

然后$d是您的卷字母说明符：

cmd /c mklink /d C:\shadowcopy "$d"

在此之后，我能够访问安装的卷影副本C:\shadowcopy就好了。

$s2.Delete()正如@KeyszerS 在评论中指出的那样，要卸载卷影复制调用。

于 2013-01-08T10:49:48.180 回答
3

因此，使用此处提供的信息和此处的官方 microsoft 文档https://docs.microsoft.com/en-us/previous-versions/windows/desktop/vsswmi​​/ create-method-in-class-win32-shadowcopy我创建了一个几个解决这个问题的 powershell 函数/cmdlet。随机注意，从 powershell 5 开始，新项目的 itemType 为 symbolicLink，但是当我尝试使用目标为影子快照制作一个时，它失败说路径不存在，所以 mklink 工具仍然是要走的路。

function New-ShadowLink {
[CmdletBinding()]
param (
    $linkPath="$($ENV:SystemDrive)\ShadowCopy"
)

begin {
    Write-Verbose "Creating a snapshot of $($ENV:SystemDrive)\"
    $class=[WMICLASS]"root\cimv2:win32_shadowcopy";
    $result = $class.create("$ENV:SystemDrive\", "ClientAccessible");
    Write-Verbose "Getting the full target path for a symlink to the shadow snapshot"
    $shadow = Get-CimInstance -ClassName Win32_ShadowCopy | Where-Object ID -eq $result.ShadowID
    $target = "$($shadow.DeviceObject)\";
}

process {
    Write-Verbose "Creating SymLink to shadowcopy at $linkPath"
    Invoke-Expression -Command "cmd /c mklink /d '$linkPath' '$target'";
}

end {
    Write-Verbose "Created link to shadowcopy snapshot of $($ENV:SystemDrive)\ at $linkPath";
    Write-Verbose "Returning shadowcopy snapshot object"
    return $shadow;
}

}

function Remove-ShadowLink {
[CmdletBinding()]
param (
    $shadow,
    $linkPath="$($ENV:SystemDrive)\ShadowCopy"
)

begin {
    Write-verbose "Removing shadow copy link at $linkPath"
}

process {
    Write-Verbose "Deleting the shadowcopy snapshot"
    $shadow.Delete();
    Write-Verbose "Deleting the now empty folder"
    Try {
        Remove-Item -Force -Recurse $linkPath -ErrorAction Stop;
    }
    catch {
        Invoke-Expression -Command "cmd /c rmdir /S /Q '$linkPath'";
    }
}

end {
    Write-Verbose "Shadow link and snapshot have been removed";
    return;
}

}

这些可以通过复制粘贴两个函数然后像这样运行它们来使用

$shadow = New-ShadowLink -Verbose;
ls C:\ShadowCopy # would show snapshot version of c drive
Remove-ShadowLink -shadow $shadow -Verbose;
ls C:\ShadowCopy # will give error as it doesn't exist

$s = New-ShadowLink -verbose
VERBOSE: Creating a snapshot of C:\
VERBOSE: Getting the full target path for a symlink to the shadow snapshot
VERBOSE: Creating SymLink to shadowcopy at C:\ShadowCopy
VERBOSE: Created link to shadowcopy snapshot of C:\ at C:\ShadowCopy
VERBOSE: Returning shadowcopy snapshot object
PS C:\> ls C:\ShadowCopy
    Directory: C:\ShadowCopy
#ommitted my C drive listing, but it would be here
PS C:\> Remove-ShadowLink -shadow $s -Verbose
VERBOSE: Removing shadow copy link at C:\ShadowCopy
VERBOSE: Deleting the shadowcopy snapshot
VERBOSE: Deleting the now empty folder
VERBOSE: Shadow link and snapshot have been removed
PS C:\> ls C:\ShadowCopy
ls : Cannot find path 'C:\ShadowCopy' because it does not exist.
于 2018-08-03T22:30:50.733 回答
0

这是因为Invoke-ExpressioninNew-ShadowLink返回一个字符串。如果将行修改为：

Invoke-Expression -Command "cmd /c mklink /d '$linkPath' '$target'" | Out-Null

它将解决问题。

于 2019-06-28T10:35:26.657 回答
0

尝试用 Remove-CimInstance -InputObject $shadow 替换$ shadow.Delete ()

这对我有用

在我收到类似错误之前：

$shadow.Delete()给了我错误：

Error en la invocación del método porque [Microsoft.Management.Infrastructure.CimInstance] no contiene ningún método llamado 'Delete'。En línea: 42 Carácter: 9 + $shadow.Delete(); + ~~~~~~~~~~~~~~~~ + CategoryInfo : InvalidOperation: (Delete:String) [], RuntimeException + FullyQualifiedErrorId : MethodNotFound

于 2020-01-24T10:40:26.070 回答