> For the complete documentation index, see [llms.txt](https://www.iblue.team/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.iblue.team/general-notes-1/exploring-volume-shadow-copies-manually.md).

# Exploring Volume Shadow Copies Manually

Download and install Arsenal Image Mounter

{% embed url="<https://github.com/ArsenalRecon/Arsenal-Image-Mounter>" %}

Run Arsenal Image MountTool. This installs a virtual SCSI controller driver and allows you to interact with your image.

Mount your image with Arsenal Image Mounter

<div align="left"><img src="/files/-MK8tuQebJTLxz4jhgEJ" alt=""></div>

Select ‘mount through libewf’ which is what we require (we’re mounting a split E01 image series which is in the EWF format).

Mount options. We require ‘Read only’ to preserve the integrity of our image.

<div align="left"><img src="/files/-MK8u9-6FTirBu5NmGsX" alt="Select necessary options"></div>

<div align="left"><img src="/files/-MK8uAxnRVJ8y2_oP2zA" alt="Disk is now mounted"></div>

\
Our primary/operating system partition is now mounted as K:

![](/files/-MK8uLOVqVSam3hH5opC)

Open an elevated command prompt

```
C:> vssadmin list shadows /for=K:
```

<div align="left"><img src="/files/-MK8uQF69kbYAAihyjjF" alt=""></div>

Enter working directory

```
C:> cd C:\users\user\Desktop\Temp
```

Create symbolic link to required volume shadow copy

```
$ mklink /D vss4 \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy4\
(make sure you include trailing slash after HarddiskVolumeShadowCopy4)

C:> cd vss4
C:> dir
```

<div align="left"><img src="/files/-MK8uvn9cFZN9xsBuphr" alt=""></div>

Obviously this will become rather tedious if you're searching multiple shadow copies across multiple disks, however if you're only looking to see whether a particular file exists in a known location, this can be a quick and easy method.