VSSADMIN LIST VOLUMES vssadmin 1.1 - Volume Shadow Copy Service administrative command-line tool (C) Copyright 2001-2005 Microsoft Corp. Volume path: C:\ Volume name: \\?\Volume{24205f92-aa80-11e0-a970-806e6f6e6963}\ Volume path: E:\ Volume name: \\?\Volume{154d98d6-bb9d-11e1-88ee-806e6f6e6963}\ vssadmin 1.1 - Volume Shadow Copy Service administrative command-line tool (C) Copyright 2001-2005 Microsoft Corp. VSSADMIN LIST WRITERS Writer name: 'Task Scheduler Writer' Writer Id: {d61d61c8-d73a-4eee-8cdd-f6f9786b7124} Writer Instance Id: {1bddd48e-5052-49db-9b07-b96f96727e6b} State: [1] Stable Last error: No error Writer name: 'VSS Metadata Store Writer' Writer Id: {75dfb225-e2e4-4d39-9ac9-ffaff65ddf06} Writer Instance Id: {088e7a7d-09a8-4cc6-a609-ad90e75ddc93} State: [1] Stable Last error: No error Writer name: 'Performance Counters Writer' Writer Id: {0bada1de-01a9-4625-8278-69e735f39dd2} Writer Instance Id: {f0086dda-9efc-47c5-8eb6-a944c3d09381} State: [1] Stable Last error: No error Writer name: 'System Writer' Writer Id: {e8132975-6f93-4464-a53e-1050253ae220} Writer Instance Id: {88d304b6-0416-4c15-9c15-038eee26c8bb} State: [1] Stable Last error: No error Writer name: 'SqlServerWriter' Writer Id: {a65faa63-5ea8-4ebc-9dbd-a0c4db26912a} Writer Instance Id: {a6242bdf-e201-4a61-b48a-3c8565154a78} State: [1] Stable Last error: No error Writer name: 'FSRM Writer' Writer Id: {12ce4370-5bb7-4c58-a76a-e5d5097e3674} Writer Instance Id: {d7efbf3a-2640-43a8-8c71-36ed61bf706e} State: [1] Stable Last error: No error Writer name: 'FRS Writer' Writer Id: {d76f5a28-3092-4589-ba48-2958fb88ce29} Writer Instance Id: {1a1f7009-6451-4cdc-bc18-981a64801e61} State: [1] Stable Last error: No error Writer name: 'Registry Writer' Writer Id: {afbab4a2-367d-4d15-a586-71dbb18f8485} Writer Instance Id: {e742247b-8e95-449d-b3d3-cf73418a9d32} State: [1] Stable Last error: No error Writer name: 'Microsoft Exchange Writer' Writer Id: {76fe1ac4-15f7-4bcd-987e-8e1acb462fb7} Writer Instance Id: {85e5576e-be1c-4df3-95ff-8af1ba17d4b0} State: [1] Stable Last error: No error Writer name: 'IIS Config Writer' Writer Id: {2a40fd15-dfca-4aa8-a654-1f8c654603f6} Writer Instance Id: {358087c8-de10-4029-bdc5-6e5524bf384e} State: [1] Stable Last error: No error Writer name: 'MSSearch Service Writer' Writer Id: {cd3f2362-8bef-46c7-9181-d62844cdc0b2} Writer Instance Id: {2104e2a9-cfcf-4f33-8a6b-6fb74ffc6aa8} State: [1] Stable Last error: No error Writer name: 'ASR Writer' Writer Id: {be000cbe-11fe-4426-9c58-531aa6355fc4} Writer Instance Id: {1345b577-7a7e-4d03-8518-f60b29ee40f6} State: [7] Failed Last error: Timed out Writer name: 'Dhcp Jet Writer' Writer Id: {be9ac81e-3619-421f-920f-4c6fea9e93ad} Writer Instance Id: {e52091ab-fae4-4811-a6a4-65a55b48c07f} State: [1] Stable Last error: No error Writer name: 'Certificate Authority' Writer Id: {6f5b15b5-da24-4d88-b737-63063e3a1f86} Writer Instance Id: {733b8aaf-762f-437a-baca-b2c79ff09e45} State: [1] Stable Last error: No error Writer name: 'COM+ REGDB Writer' Writer Id: {542da469-d3e1-473c-9f4f-7847f01fc64f} Writer Instance Id: {cf3a1c76-f328-46e0-9e57-209cc837d416} State: [1] Stable Last error: No error Writer name: 'TS Gateway Writer' Writer Id: {368753ec-572e-4fc7-b4b9-ccd9bdc624cb} Writer Instance Id: {c158b405-1862-44a8-bbf2-5536a8dc2dc4} State: [1] Stable Last error: No error Writer name: 'Shadow Copy Optimization Writer' Writer Id: {4dc3bdd4-ab48-4d07-adb0-3bee2926fd7f} Writer Instance Id: {d024a439-840b-4e81-ae07-7ad479cf3093} State: [1] Stable Last error: No error Writer name: 'NPS VSS Writer' Writer Id: {35e81631-13e1-48db-97fc-d5bc721bb18a} Writer Instance Id: {6a135f82-4976-4152-b3a9-4d8bc4caeb04} State: [1] Stable Last error: No error Writer name: 'IIS Metabase Writer' Writer Id: {59b1f0cf-90ef-465f-9609-6ca8b2938366} Writer Instance Id: {d6a9e695-09bf-4abe-877a-471b10ec0daf} State: [1] Stable Last error: No error Writer name: 'BITS Writer' Writer Id: {4969d978-be47-48b0-b100-f328f07ac1e0} Writer Instance Id: {ea86400b-0731-46da-97d3-9ef2ffb15f03} State: [1] Stable Last error: No error Writer name: 'NTDS' Writer Id: {b2014c9e-8711-4c5c-a5a9-3cf384484757} Writer Instance Id: {b9683a7c-4415-4c4e-848e-80f5c6cee31e} State: [1] Stable Last error: No error Writer name: 'WMI Writer' Writer Id: {a6ad56c2-b509-4e6c-bb19-49d8f43532f0} Writer Instance Id: {18014777-df2b-4e5c-87d0-f2fb8b1717dd} State: [1] Stable Last error: No error VSSADMIN LIST PROVIDERS vssadmin 1.1 - Volume Shadow Copy Service administrative command-line tool (C) Copyright 2001-2005 Microsoft Corp. Provider name: 'Microsoft Software Shadow Copy provider 1.0' Provider type: System Provider Id: {b5946137-7b9f-4925-af80-51abd60b20d5} Version: 1.0.0.7 VSSADMIN LIST SHADOWS vssadmin 1.1 - Volume Shadow Copy Service administrative command-line tool (C) Copyright 2001-2005 Microsoft Corp. Contents of shadow copy set ID: {2cf6f79b-4a18-412b-92c9-2bf87a543568} Contained 1 shadow copies at creation time: 6/21/2012 12:00:04 PM Shadow Copy ID: {2c6a8432-dada-4089-b5cf-f089b2c4c392} Original Volume: (C:)\\?\Volume{24205f92-aa80-11e0-a970-806e6f6e6963}\ Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy6 Originating Machine: WIN2K11.reillylaw.local Service Machine: WIN2K11.reillylaw.local Provider: 'Microsoft Software Shadow Copy provider 1.0' Type: ClientAccessible Attributes: Persistent, Client-accessible, No auto release, No writers, Differential Contents of shadow copy set ID: {dcf4edaf-33af-4946-ab37-b5e1f013b8b5} Contained 1 shadow copies at creation time: 6/22/2012 7:00:03 AM Shadow Copy ID: {a71fbfc8-4e08-4e61-af8e-43113445879b} Original Volume: (C:)\\?\Volume{24205f92-aa80-11e0-a970-806e6f6e6963}\ Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy10 Originating Machine: WIN2K11.reillylaw.local Service Machine: WIN2K11.reillylaw.local Provider: 'Microsoft Software Shadow Copy provider 1.0' Type: ClientAccessible Attributes: Persistent, Client-accessible, No auto release, No writers, Differential Contents of shadow copy set ID: {6eb97f39-6750-47e0-8603-cb5fb0595ab8} Contained 1 shadow copies at creation time: 6/22/2012 12:00:17 PM Shadow Copy ID: {f074cc77-a8b5-45ea-8a37-23f008e43875} Original Volume: (C:)\\?\Volume{24205f92-aa80-11e0-a970-806e6f6e6963}\ Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy11 Originating Machine: WIN2K11.reillylaw.local Service Machine: WIN2K11.reillylaw.local Provider: 'Microsoft Software Shadow Copy provider 1.0' Type: ClientAccessible Attributes: Persistent, Client-accessible, No auto release, No writers, Differential Contents of shadow copy set ID: {4182111a-3b47-4ae4-93b1-e7ace78e8c61} Contained 1 shadow copies at creation time: 6/25/2012 7:00:08 AM Shadow Copy ID: {362e9c6e-7521-4e2c-97cd-c318dfed011f} Original Volume: (C:)\\?\Volume{24205f92-aa80-11e0-a970-806e6f6e6963}\ Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy15 Originating Machine: WIN2K11.reillylaw.local Service Machine: WIN2K11.reillylaw.local Provider: 'Microsoft Software Shadow Copy provider 1.0' Type: ClientAccessible Attributes: Persistent, Client-accessible, No auto release, No writers, Differential Contents of shadow copy set ID: {ba2a7fee-778c-477b-bcfa-bbaeaf510a3d} Contained 1 shadow copies at creation time: 6/25/2012 12:00:10 PM Shadow Copy ID: {fa9458e9-b5f9-496d-b15f-55d7246793fc} Original Volume: (C:)\\?\Volume{24205f92-aa80-11e0-a970-806e6f6e6963}\ Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy19 Originating Machine: WIN2K11.reillylaw.local Service Machine: WIN2K11.reillylaw.local Provider: 'Microsoft Software Shadow Copy provider 1.0' Type: ClientAccessible Attributes: Persistent, Client-accessible, No auto release, No writers, Differential Contents of shadow copy set ID: {2e809118-7e27-41cc-b57f-5ce5c92555de} Contained 1 shadow copies at creation time: 6/26/2012 7:00:03 AM Shadow Copy ID: {e2116613-2d33-43dc-a9f4-f72d765d0d76} Original Volume: (C:)\\?\Volume{24205f92-aa80-11e0-a970-806e6f6e6963}\ Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy24 Originating Machine: WIN2K11.reillylaw.local Service Machine: WIN2K11.reillylaw.local Provider: 'Microsoft Software Shadow Copy provider 1.0' Type: ClientAccessible Attributes: Persistent, Client-accessible, No auto release, No writers, Differential Contents of shadow copy set ID: {e214ee22-904f-4db0-b1ba-fbc1b70f19d3} Contained 1 shadow copies at creation time: 6/26/2012 12:00:04 PM Shadow Copy ID: {1ff66b14-3023-429c-8512-a21c2e11c99c} Original Volume: (C:)\\?\Volume{24205f92-aa80-11e0-a970-806e6f6e6963}\ Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy26 Originating Machine: WIN2K11.reillylaw.local Service Machine: WIN2K11.reillylaw.local Provider: 'Microsoft Software Shadow Copy provider 1.0' Type: ClientAccessible Attributes: Persistent, Client-accessible, No auto release, No writers, Differential Contents of shadow copy set ID: {ff8c4509-7811-4db9-bac4-af2fceb3c069} Contained 1 shadow copies at creation time: 6/27/2012 7:00:04 AM Shadow Copy ID: {689a8652-43d0-4d3b-995a-1df1f6b4412d} Original Volume: (C:)\\?\Volume{24205f92-aa80-11e0-a970-806e6f6e6963}\ Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy31 Originating Machine: WIN2K11.reillylaw.local Service Machine: WIN2K11.reillylaw.local Provider: 'Microsoft Software Shadow Copy provider 1.0' Type: ClientAccessible Attributes: Persistent, Client-accessible, No auto release, No writers, Differential Contents of shadow copy set ID: {92a51a61-98f3-4d08-8eda-cb9b7174d490} Contained 1 shadow copies at creation time: 6/27/2012 12:00:06 PM Shadow Copy ID: {97266fb6-fd49-4ff7-b9c9-7c14a38129b3} Original Volume: (C:)\\?\Volume{24205f92-aa80-11e0-a970-806e6f6e6963}\ Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy32 Originating Machine: WIN2K11.reillylaw.local Service Machine: WIN2K11.reillylaw.local Provider: 'Microsoft Software Shadow Copy provider 1.0' Type: ClientAccessible Attributes: Persistent, Client-accessible, No auto release, No writers, Differential Contents of shadow copy set ID: {94a71290-da11-4f71-ad24-277ff2f9f590} Contained 1 shadow copies at creation time: 6/28/2012 7:00:06 AM Shadow Copy ID: {68d516b1-c8cf-470c-8be1-ec0884e532d1} Original Volume: (C:)\\?\Volume{24205f92-aa80-11e0-a970-806e6f6e6963}\ Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy33 Originating Machine: WIN2K11.reillylaw.local Service Machine: WIN2K11.reillylaw.local Provider: 'Microsoft Software Shadow Copy provider 1.0' Type: ClientAccessible Attributes: Persistent, Client-accessible, No auto release, No writers, Differential Contents of shadow copy set ID: {3a877b6a-9c1b-4b8f-9645-e43b0f1cbca8} Contained 1 shadow copies at creation time: 6/28/2012 12:00:12 PM Shadow Copy ID: {8d738c0e-3674-48e1-8ec6-4fcb0061d9c8} Original Volume: (C:)\\?\Volume{24205f92-aa80-11e0-a970-806e6f6e6963}\ Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy38 Originating Machine: WIN2K11.reillylaw.local Service Machine: WIN2K11.reillylaw.local Provider: 'Microsoft Software Shadow Copy provider 1.0' Type: ClientAccessible Attributes: Persistent, Client-accessible, No auto release, No writers, Differential Contents of shadow copy set ID: {ca36bf0f-17e5-4479-b4fa-f6b2999f8c66} Contained 1 shadow copies at creation time: 6/29/2012 7:00:03 AM Shadow Copy ID: {99aab116-f285-4af1-8a09-d505e8299dc6} Original Volume: (C:)\\?\Volume{24205f92-aa80-11e0-a970-806e6f6e6963}\ Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy41 Originating Machine: WIN2K11.reillylaw.local Service Machine: WIN2K11.reillylaw.local Provider: 'Microsoft Software Shadow Copy provider 1.0' Type: ClientAccessible Attributes: Persistent, Client-accessible, No auto release, No writers, Differential Contents of shadow copy set ID: {3544f5f5-1bd6-4012-bfa2-84ddbd156e98} Contained 1 shadow copies at creation time: 6/29/2012 12:00:07 PM Shadow Copy ID: {b82e8c96-b9f8-4d5f-aafd-fe9620ef46a8} Original Volume: (C:)\\?\Volume{24205f92-aa80-11e0-a970-806e6f6e6963}\ Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy42 Originating Machine: WIN2K11.reillylaw.local Service Machine: WIN2K11.reillylaw.local Provider: 'Microsoft Software Shadow Copy provider 1.0' Type: ClientAccessible Attributes: Persistent, Client-accessible, No auto release, No writers, Differential Contents of shadow copy set ID: {bc89039a-974d-4d90-beca-71875535875c} Contained 1 shadow copies at creation time: 7/2/2012 7:00:06 AM Shadow Copy ID: {dd37245a-3eb5-4795-896a-7a0290aeb2c8} Original Volume: (C:)\\?\Volume{24205f92-aa80-11e0-a970-806e6f6e6963}\ Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy61 Originating Machine: WIN2K11.reillylaw.local Service Machine: WIN2K11.reillylaw.local Provider: 'Microsoft Software Shadow Copy provider 1.0' Type: ClientAccessible Attributes: Persistent, Client-accessible, No auto release, No writers, Differential VSSADMIN LIST SHADOWSTORAGE vssadmin 1.1 - Volume Shadow Copy Service administrative command-line tool (C) Copyright 2001-2005 Microsoft Corp. Shadow Copy Storage association For volume: (C:)\\?\Volume{24205f92-aa80-11e0-a970-806e6f6e6963}\ Shadow Copy Storage volume: (C:)\\?\Volume{24205f92-aa80-11e0-a970-806e6f6e6963}\ Used Shadow Copy Storage space: 89.531 GB (9%) Allocated Shadow Copy Storage space: 92.253 GB (9%) Maximum Shadow Copy Storage space: 93.146 GB (10%) Shadow Copy Storage association For volume: (E:)\\?\Volume{154d98d6-bb9d-11e1-88ee-806e6f6e6963}\ Shadow Copy Storage volume: (E:)\\?\Volume{154d98d6-bb9d-11e1-88ee-806e6f6e6963}\ Used Shadow Copy Storage space: 0 B (0%) Allocated Shadow Copy Storage space: 0 B (0%) Maximum Shadow Copy Storage space: 139.728 GB (30%) BCDEDIT /ENUM ACTIVE Windows Boot Manager -------------------- identifier {bootmgr} device partition=C: description Windows Boot Manager locale en-US inherit {globalsettings} default {current} resumeobject {1fbaad4c-aa88-11e0-badb-965056d63158} displayorder {current} toolsdisplayorder {memdiag} timeout 30 Windows Boot Loader ------------------- identifier {current} device partition=C: path \Windows\system32\winload.exe description Windows Server 2008 R2 locale en-US inherit {bootloadersettings} recoverysequence {1fbaad4e-aa88-11e0-badb-965056d63158} recoveryenabled Yes osdevice partition=C: systemroot \Windows resumeobject {1fbaad4c-aa88-11e0-badb-965056d63158} nx OptOut MOUNTVOL Creates, deletes, or lists a volume mount point. MOUNTVOL [drive:]path VolumeName MOUNTVOL [drive:]path /D MOUNTVOL [drive:]path /L MOUNTVOL [drive:]path /P MOUNTVOL /R MOUNTVOL /N MOUNTVOL /E path Specifies the existing NTFS directory where the mount point will reside. VolumeName Specifies the volume name that is the target of the mount point. /D Removes the volume mount point from the specified directory. /L Lists the mounted volume name for the specified directory. /P Removes the volume mount point from the specified directory, dismounts the volume, and makes the volume not mountable. You can make the volume mountable again by creating a volume mount point. /R Removes volume mount point directories and registry settings for volumes that are no longer in the system. /N Disables automatic mounting of new volumes. /E Re-enables automatic mounting of new volumes. Possible values for VolumeName along with current mount points are: \\?\Volume{24205f92-aa80-11e0-a970-806e6f6e6963}\ C:\ \\?\Volume{154d98d6-bb9d-11e1-88ee-806e6f6e6963}\ E:\ \\?\Volume{24205f95-aa80-11e0-a970-806e6f6e6963}\ D:\ VER Microsoft Windows [Version 6.1.7601] REG QUERY "HKLM\SYSTEM\CurrentControlSet\control\hivelist" /s HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\control\hivelist \REGISTRY\MACHINE\HARDWARE REG_SZ \REGISTRY\MACHINE\SYSTEM REG_SZ \Device\HarddiskVolume1\Windows\System32\config\SYSTEM \REGISTRY\MACHINE\SOFTWARE REG_SZ \Device\HarddiskVolume1\Windows\System32\config\SOFTWARE \REGISTRY\USER\.DEFAULT REG_SZ \Device\HarddiskVolume1\Windows\System32\config\DEFAULT \REGISTRY\MACHINE\SECURITY REG_SZ \Device\HarddiskVolume1\Windows\System32\config\SECURITY \REGISTRY\MACHINE\SAM REG_SZ \Device\HarddiskVolume1\Windows\System32\config\SAM \REGISTRY\USER\S-1-5-20 REG_SZ \Device\HarddiskVolume1\Windows\ServiceProfiles\NetworkService\NTUSER.DAT \REGISTRY\USER\S-1-5-19 REG_SZ \Device\HarddiskVolume1\Windows\ServiceProfiles\LocalService\NTUSER.DAT \Registry\User\S-1-5-21-2498191724-3829266903-1178186729-1156 REG_SZ \Device\HarddiskVolume1\Users\netadmin\NTUSER.DAT \Registry\User\S-1-5-21-2498191724-3829266903-1178186729-1156_Classes REG_SZ \Device\HarddiskVolume1\Users\netadmin\AppData\Local\Microsoft\Windows\UsrClass.dat \Registry\User\S-1-5-21-2498191724-3829266903-1178186729-1157 REG_SZ \Device\HarddiskVolume1\Users\spfarm\NTUSER.DAT \Registry\User\S-1-5-21-2498191724-3829266903-1178186729-1157_Classes REG_SZ \Device\HarddiskVolume1\Users\spfarm\AppData\Local\Microsoft\Windows\UsrClass.dat \Registry\User\S-1-5-21-2498191724-3829266903-1178186729-1161 REG_SZ \Device\HarddiskVolume1\Users\spsearch\NTUSER.DAT \Registry\User\S-1-5-21-2498191724-3829266903-1178186729-1161_Classes REG_SZ \Device\HarddiskVolume1\Users\spsearch\AppData\Local\Microsoft\Windows\UsrClass.dat \Registry\User\S-1-5-21-2498191724-3829266903-1178186729-1162 REG_SZ \Device\HarddiskVolume1\Users\TEMP.REILLYLAW\NTUSER.DAT \Registry\User\S-1-5-21-2498191724-3829266903-1178186729-1162_Classes REG_SZ \Device\HarddiskVolume1\Users\TEMP.REILLYLAW\AppData\Local\Microsoft\Windows\UsrClass.dat \REGISTRY\MACHINE\BCD00000000 REG_SZ \Device\HarddiskVolume1\Boot\BCD \REGISTRY\MACHINE\COMPONENTS REG_SZ \Device\HarddiskVolume1\Windows\System32\config\COMPONENTS