Viewing and Mounting Shadow Copy in SIFT

To view Shadow Copy snapshots

Mount the image in SIFT (https://benleeyr.wordpress.com/2020/05/24/mounting-e01-in-sift/)
vshadowinfo /mnt/ewf_mount/ewf1

Substitute 1 with any other number depending on which folder the EWF is mounted at

To Mount Shadow Copy snapshots

vshadowmount /mnt/ewf_mount/ewf1 /mnt/vss
cd /mnt/vss
for i in vss*; do mountwin $i /mnt/shadow_mount/$i; done
cd /mnt/shadow_mount
ls