To view Shadow Copy snapshots
- Mount the image in SIFT (https://benleeyr.wordpress.com/2020/05/24/mounting-e01-in-sift/)
- vshadowinfo /mnt/ewf_mount/ewf1
Substitute 1 with any other number depending on which folder the EWF is mounted at
To Mount Shadow Copy snapshots
- vshadowmount /mnt/ewf_mount/ewf1 /mnt/vss
- cd /mnt/vss
- for i in vss*; do mountwin $i /mnt/shadow_mount/$i; done
- cd /mnt/shadow_mount
- ls