# Exploring Volume Shadow Copies Manually Download and install Arsenal Image Mounter {% embed url="" %} Run Arsenal Image MountTool. This installs a virtual SCSI controller driver and allows you to interact with your image. Mount your image with Arsenal Image Mounter

Select ‘mount through libewf’ which is what we require (we’re mounting a split E01 image series which is in the EWF format). Mount options. We require ‘Read only’ to preserve the integrity of our image.

\ Our primary/operating system partition is now mounted as K: ![](https://3710248095-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MAcqFKR60dGwoJxmUG5%2F-MK8qAGQx3ZGrmJhiBki%2F-MK8uLOVqVSam3hH5opC%2Fimage.png?alt=media\&token=8a32af39-fb82-4430-9582-63ebd13f682f) Open an elevated command prompt ``` C:> vssadmin list shadows /for=K: ```

Enter working directory ``` C:> cd C:\users\user\Desktop\Temp ``` Create symbolic link to required volume shadow copy ``` $ mklink /D vss4 \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy4\ (make sure you include trailing slash after HarddiskVolumeShadowCopy4) C:> cd vss4 C:> dir ```

Obviously this will become rather tedious if you're searching multiple shadow copies across multiple disks, however if you're only looking to see whether a particular file exists in a known location, this can be a quick and easy method. --- # Agent Instructions: Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://www.iblue.team/general-notes-1/exploring-volume-shadow-copies-manually.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.