Sort ShadowCopies by Volume

austinmartinez2 · 2018-08-16T14:19:53.000Z

I have been working on a script that preforms an audit of ShadowCopies on the workstation. I am able to a display of the ShadowCopies and the date they were created, along with a count of how many there are, but I am looking to try and sort the listed ShadowCopies and tie them to their associated Volume letter. Any Tips?

$shadowStorageList = @();
$volumeList = Get-WmiObject Win32_Volume -Property SystemName,DriveLetter,DeviceID,Capacity,FreeSpace -Filter "DriveType=3" | select @{n="DriveLetter";e={$_.DriveLetter.ToUpper()}},DeviceID,@{n="CapacityGB";e={([math]::Round([int64]($_.Capacity)/1GB,2))}},@{n="FreeSpaceGB";e={([math]::Round([int64]($_.FreeSpace)/1GB,2))}} | Sort DriveLetter;
$shadowStorages = gwmi Win32_ShadowStorage -Property AllocatedSpace,DiffVolume,MaxSpace,UsedSpace,Volume |
                Select @{n="Volume";e={$_.Volume.Replace("\\","\").Replace("Win32_Volume.DeviceID=","").Replace("`"","")}},
                @{n="DiffVolume";e={$_.DiffVolume.Replace("\\","\").Replace("Win32_Volume.DeviceID=","").Replace("`"","")}},
                @{n="AllocatedSpaceGB";e={([math]::Round([int64]($_.AllocatedSpace)/1GB,2))}},
                @{n="MaxSpaceGB";e={([math]::Round([int64]($_.MaxSpace)/1GB,2))}},
                @{n="UsedSpaceGB";e={([math]::Round([int64]($_.UsedSpace)/1GB,2))}}

# Create an array of Customer PSobject
foreach($shStorage in $shadowStorages) {
    $tmpDriveLetter = "";
    foreach($volume in $volumeList) {
        if($shStorage.DiffVolume -eq $volume.DeviceID) {
            $tmpDriveLetter = $volume.DriveLetter;
        }
    }
    $objVolume = New-Object PSObject -Property @{
        Volume = $shStorage.Volume
        AllocatedSpaceGB = $shStorage.AllocatedSpaceGB
        UsedSpaceGB = $shStorage.UsedSpaceGB
        MaxSpaceGB = $shStorage.MaxSpaceGB
        DriveLetter = $tmpDriveLetter
        copies = $shadowStorageList[$i].shadowcopies
    }
    $shadowStorageList += $objVolume;
}

for($i = 0; $i -lt $shadowStorageList.Count; $i++){
    $objCopyList = Get-WmiObject Win32_ShadowCopy | Where-Object {$_.VolumeName -eq $shadowStorageList[$i].Volume} | select DeviceObject, InstallDate
    $shadowStorageList[$i] | add-member Noteproperty shadowcopies $objCopyList
    $shadowStorageList[$i].shadowcopies
    
}

Neally · 2018-08-16T14:24:56.000Z

If you post code, please use the ‘Insert Code’ button. Please and thank you!

PLEASE READ BEFORE POSTING! Read if you're new to the PowerShell forum! Programming & Development

Hi, and welcome to the PowerShell forum! Don’t apologize for being a “noob” or “newbie” or “n00b.” There’s just no need – nobody will think you’re stupid, and the forums are all about asking questions. Just ask! Use a descriptive subject. Don't say "Need help" or "PowerShell Help", actually summarize what the problem is. It helps the rest of us keep track of which problem is which. Don’t post massive scripts. We’re all volunteers and we don’t have time to read all that, nor will we copy, past…

austinmartinez2 · 2018-08-16T14:27:17.000Z

Thanks, I fixed the post now.

jitensh · 2018-08-16T15:04:17.000Z

Do not have shadow copies can you try this

 Get-WmiObject Win32_ShadowCopy | Where-Object {$_.VolumeName -eq $shadowStorageList[$i].Volume} | 
 select DeviceObject, InstallDate,Select @{n="VolumeName";e={$_.$volumeList.Label}

austinmartinez2 · 2018-08-16T15:15:05.000Z

Sadly, that just through me an error. I’ve been playing with it some more and I am able to have the shadowcopies separate themselves but in hard to read format, and if the list is too long, it cuts off. I am trying to get the list to display in an easy to read method. Which I am able to produce with the code above, just not separate them. So at the moment, I am torn with readability without separation, or separation without readability. This is the error I got with running your test. I have tried to use the method I used in this example to add the readable list to the code that has the copies separated, but it doesn’t format properly.

[ERROR MESSAGE]

At line:31 char:27

$shadowStorageList[$i] | add-member Noteproperty shadowcopies $ob …
~
Missing ‘=’ operator after key in hash literal.
At line:36 char:6
write-host $shadowStorageList.shadowcopies.count
~
Missing ‘=’ operator after key in hash literal.
At line:36 char:6
write-host $shadowStorageList.shadowcopies.count
~
The hash literal was incomplete.
At line:29 char:51
for($i = 0; $i -lt $shadowStorageList.Count; $i++){
~
Missing closing ‘}’ in statement block or type definition.
CategoryInfo : ParserError: ( , ParentContainsErrorRecordException
FullyQualifiedErrorId : MissingEqualsInHashLiteral

[OUTPUT I’M AFTER}

DeviceObject InstallDate

\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy25 20180816100312.004022-360
\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy4 20180807120004.975960-360
\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy5 20180807160004.269317-360
\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy6 20180808070003.911615-360
\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy7 20180808120004.337998-360
\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy8 20180808160004.535222-360
\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy9 20180809003802.258154-360
\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy10 20180809070004.070060-360
\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy11 20180809120005.622604-360
\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy12 20180809160004.710214-360
\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy13 20180810070003.545046-360
\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy14 20180810120004.352146-360
\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy15 20180810160003.823910-360
\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy16 20180813120006.245752-360
\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy17 20180813160006.501994-360
\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy18 20180814070006.354801-360
\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy19 20180814120006.493219-360
\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy20 20180814160006.583484-360
\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy21 20180815070006.176014-360
\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy22 20180815120006.635497-360
\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy23 20180815160006.756178-360
\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy24 20180816070006.257017-360

[OUTPUT I GET]

ShadowCopyList : {@{DeviceObject=\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy4; InstallDate=20180807120004.975960-360}, @{DeviceObject=\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy5;
InstallDate=20180807160004.269317-360}, @{DeviceObject=\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy6; InstallDate=20180808070003.911615-360},
@{DeviceObject=\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy7; InstallDate=20180808120004.337998-360}…}

jitensh · 2018-08-17T06:51:21.000Z

Are you looking for output something like this?

Capture.png800×131 29.7 KB

I have tried this

for($i = 0; $i -lt $shadowStorageList.Count; $i++){
    $objCopyList = Get-CimInstance Win32_ShadowCopy | Where-Object {$_.VolumeName -eq $shadowStorageList[$i].Volume} | 
    select DeviceObject,Installdate ,@{n="DriveLetter";e={Get-WmiObject Win32_Volume |?{$_.deviceid -eq $shadowStorageList[$i].Volume}|select -exp Driveletter}}
    $shadowStorageList[$i] | add-member Noteproperty shadowcopies $objCopyList
    $shadowStorageList[$i].shadowcopies

austinmartinez2 · 2018-08-17T12:02:42.000Z

That is a nice output. There is some other information that I want displayed that was displayed before that isn’t in that example, but I think I can use this example and expand on it. I’ll see what happens. Thanks a lot.

jitensh · 2018-08-17T12:33:01.000Z

austinmartinez2:

That is a nice output. There is some other information that I want displayed that was displayed before that isn’t in that example, but I think I can use this example and expand on it. I’ll see what happens. Thanks a lot.

What I understand is you want to display drive letters and Volume shadow copy creation date, what else you looking for?

austinmartinez2 · 2018-08-17T14:23:06.000Z

That output you were able to help with is the main thing I was after. The rest of the information I was able to obtain in display along with that table. I do have this resolved now, so thanks so much. You have been a great help.

@jitensh