如何枚举给定文件或文件夹的卷影副本?

问题描述

所以我实际上是在尝试使用 PowerShell 检索屏幕截图中的信息.有点被第一个障碍难住了.

So i'm essentially trying to retrieve the information in the screenshot but with PowerShell. Kind of getting stumped at the first hurdle.

我能找到的最好的是 https://superuser.com/questions/643536/how-to-find-and-open-previous-versions-of-a-folder-programmatically-using-power

但它并不适合.

一直在阅读 https://msdn.microsoft.com/en-us/library/aa393625(v=vs.85).aspx

但我无法理解它.这是正确的道路吗?

But I'm not able to make much sense of it. Is that the right path to be going down?

推荐答案

在 PowerShell 中有几个步骤可以浏览卷影副本.首先，下面的代码将显示驱动器及其卷影副本的列表

There are a few of steps in PowerShell to get to browsing shadow copies.First, below code will display a list of drives and their shadow copies

$shadowStorageList = @();
$volumeList = Get-WmiObject Win32_Volume -Property SystemName,DriveLetter,DeviceID,Capacity,FreeSpace -Filter "DriveType=3" | select @{n="DriveLetter";e={$_.DriveLetter.ToUpper()}},DeviceID,@{n="CapacityGB";e={([math]::Round([int64]($_.Capacity)/1GB,2))}},@{n="FreeSpaceGB";e={([math]::Round([int64]($_.FreeSpace)/1GB,2))}} | Sort DriveLetter;
$shadowStorages = gwmi Win32_ShadowStorage -Property AllocatedSpace,DiffVolume,MaxSpace,UsedSpace,Volume |
                Select @{n="Volume";e={$_.Volume.Replace("\\","\").Replace("Win32_Volume.DeviceID=","").Replace("`"","")}},
                @{n="DiffVolume";e={$_.DiffVolume.Replace("\\","\").Replace("Win32_Volume.DeviceID=","").Replace("`"","")}},
                @{n="AllocatedSpaceGB";e={([math]::Round([int64]($_.AllocatedSpace)/1GB,2))}},
                @{n="MaxSpaceGB";e={([math]::Round([int64]($_.MaxSpace)/1GB,2))}},
                @{n="UsedSpaceGB";e={([math]::Round([int64]($_.UsedSpace)/1GB,2))}}

# Create an array of Customer PSobject
foreach($shStorage in $shadowStorages) {
    $tmpDriveLetter = "";
    foreach($volume in $volumeList) {
        if($shStorage.DiffVolume -eq $volume.DeviceID) {
            $tmpDriveLetter = $volume.DriveLetter;
        }
    }
    $objVolume = New-Object PSObject -Property @{
        Volume = $shStorage.Volume
        AllocatedSpaceGB = $shStorage.AllocatedSpaceGB
        UsedSpaceGB = $shStorage.UsedSpaceGB
        MaxSpaceGB = $shStorage.MaxSpaceGB
        DriveLetter = $tmpDriveLetter
    }
    $shadowStorageList += $objVolume;
}


for($i = 0; $i -lt $shadowStorageList.Count; $i++){
    $objCopyList = Get-WmiObject Win32_ShadowCopy  | Where-Object {$_.VolumeName -eq $shadowStorageList[$i].Volume} | select DeviceObject, InstallDate
    $shadowStorageList[$i] | add-member Noteproperty shadowcopies $objCopyList
    $shadowStorageList[$i]
}

示例输出:

AllocatedSpaceGB : 9.17 DriveLetter : F: Volume :\?\Volume{6c974bfe-0525-11e7-80bf-0050568007f5}\ MaxSpaceGB :15 UsedSpaceGB : 8.46 shadowcopys :{@{DeviceObject=\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy39;安装日期=20170902070009.648986+600}，@{DeviceObject=\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy40;安装日期=20170903070009.902376+600}，@{DeviceObject=\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy41;安装日期=20170904070016.340573+600}，@{DeviceObject=\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy42;安装日期=20170904120031.644419+600}...}

AllocatedSpaceGB : 6.28 DriveLetter : C: Volume :\?\Volume{4c22f9da-2b50-11e6-80b3-806e6f6e6963}\ MaxSpaceGB :6.96 UsedSpaceGB : 5.78 shadowcopies : {@{DeviceObject=\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy3;安装日期=20170921070020.298687+600}，@{DeviceObject=\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy4;安装日期=20170921120026.126738+600}，@{DeviceObject=\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy5;安装日期=20170922070025.309517+600}，@{DeviceObject=\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy6;安装日期=20170922120004.852824+600}...}

AllocatedSpaceGB : 6.28 DriveLetter : C: Volume : \?\Volume{4c22f9da-2b50-11e6-80b3-806e6f6e6963}\ MaxSpaceGB : 6.96 UsedSpaceGB : 5.78 shadowcopies : {@{DeviceObject=\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy3; InstallDate=20170921070020.298687+600}, @{DeviceObject=\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy4; InstallDate=20170921120026.126738+600}, @{DeviceObject=\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy5; InstallDate=20170922070025.309517+600}, @{DeviceObject=\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy6; InstallDate=20170922120004.852824+600}...}

要浏览卷影副本(例如 GLOBALROOT\Device\HarddiskVolumeShadowCopy6)，您需要创建指向它的符号链接(Windows 快捷方式)，然后您可以在 Windows 资源管理器中浏览该链接.示例代码如下:

To browse a shadow copy (example GLOBALROOT\Device\HarddiskVolumeShadowCopy6), you need to create a symbolic link to it (windows shortcut) which you can then browse in Windows explorer.Example code below:

# Load assembly to create symlink
try {
    $null = [mklink.symlink]
}
catch {
Add-Type @"
    using System;
    using System.Runtime.InteropServices;

  namespace mklink
    {
    public class symlink
    {
        [DllImport("kernel32.dll")]
        public static extern bool CreateSymbolicLink(string lpSymlinkFileName, string lpTargetFileName, int dwFlags);
    }
  }
"@
}
# create symlink
[mklink.symlink]::CreateSymbolicLink('symlink path (example C:\temp\link1)', '\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy4\', 1);

这篇关于如何枚举给定文件或文件夹的卷影副本?的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持！