Jump to content

grabbing newest shadow with vssown then deleting


pipeitup
 Share

Recommended Posts

If there are already shadows on the system and I use vssown /create and attempt to grab Shadow1, I'm not grabbing the shadow I just created. Is there a way to get the ID for the newest shadow so I can grab the right one, then use that ID to delete the shadow after I'm finished? Cheers!

Link to comment
Share on other sites

make a batch file and add this:

vssadmin Delete Shadows /All /quiet

I should have been more specific in my post. The goal is to make it automated with little to no disruption. I would want to keep any shadows that are already on the system, but automatically create/dump/delete one.

Link to comment
Share on other sites

I should have been more specific in my post. The goal is to make it automated with little to no disruption. I would want to keep any shadows that are already on the system, but automatically create/dump/delete one.

why not delete them all and create a new one and use that new one? a batch file can delete them all then run vssown. you can use twin duck firmware as mass storage device too. i use the mimikatz payload to run an exe file that is on the ducky.

Here are some options..vssadmin Delete Shadows /For=VolumeSpec [/Oldest] [/Quiet]vssadmin Delete Shadows /Shadow=ShadowID [/Quiet]vssadmin Delete Shadows /All /quiet

Example Usage: vssadmin Delete Shadows /For=C: /Oldest /quiet

if you still want to delete a specific shadowcopy then use this one

vssadmin Delete Shadows /Shadow=ShadowID [/Quiet]
Edited by shamwow
Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...