CODEWITHSUNDEEP
powershell
Arbelac
Arbelac

Reputation: 1904

Get Drive letter from Volume ID

I want to use drive letter instead of Volume ID like below. How can I do that ?

Thanks,

My output :

VolumeName                                                  OriginatingMachine  InstallDate
\\?\Volume{3c0a6eed-1b4c-4e90-a25b-8af1af46e368}\           app01.contoso.com   4/13/2021 6:03:34 PM
\\?\Volume{de5c18ac-56e1-4efa-afb4-abaf476a99a9}\           app01.contoso.com   4/13/2021 6:03:34 PM

My desired output :

VolumeName  OriginatingMachine  InstallDate
E:          app01.contoso.com   4/13/2021 6:03:34 PM
X:          app01.contoso.com   4/13/2021 6:03:34 PM

Command:

Get-CimInstance Win32_ShadowCopy | Where InstallDate -lt ([datetime]::Now.AddDays(-5)) | Select-Object VolumeName,OriginatingMachine,InstallDate

Get-CimInstance Win32_ShadowCopy output :

Caption            :
Description        :
InstallDate        : 9/17/2021 9:22:06 PM
Name               :
Status             :
ClientAccessible   : False
Count              : 11
DeviceObject       : \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1234
Differential       : True
ExposedLocally     : False
ExposedName        :
ExposedPath        :
ExposedRemotely    : False
HardwareAssisted   : False
ID                 : {3C8DAB36-F083-4C68-84BA-E339B8A18AF3}
Imported           : False
NoAutoRelease      : True
NotSurfaced        : False
NoWriters          : False
OriginatingMachine : app01.contoso.com
Persistent         : True
Plex               : False
ProviderID         : {B5946137-7B9F-4925-AF80-51ABD60B20D5}
ServiceMachine     : app01.contoso.com
SetID              : {D3D15CE2-9FFC-4A22-B03C-77D7FCB7D40E}
State              : 12
Transportable      : False
VolumeName         : \\?\Volume{85e62cfa-2e9c-4a46-af5a-f0748acd60b6}\
PSComputerName     :

Upvotes: 0

Views: 1310

Answers (1)

FoxDeploy
FoxDeploy

Reputation: 13537

The Win32_ShadowCopy command returns Win32_ShadowCopy objects, which have a number of fields all described here.

Some of the fields provided in ShadowCopy happen to match other WMI Classes which have info about Drive Letters, namely the VolumeName field. This field happens to also be present on both the ShadowCopy and Win32_Volume class, the latter of which has the drive letter property we need!

All we have to do is lookup all of the shadow copies, then lookup all of the volumes on the machine, then we can loop through the copies to find the matching volumes. If you have some really complex mounting logic, you'll need to add some extra logic though in the foreach section.

So we would make a quick little function to do this lookup for us, which would look like this:

function Get-Win32ShadowVolumeDiskInfo{
    $shadowCopies = Get-CimInstance Win32_ShadowCopy
    $volumes = Get-CimInstance Win32_Volume
    $returnObject = @()

    foreach ($copy in $shadowCopies){
        $matchingVolume = $volumes | Where DeviceID -eq $copy.VolumeName
        $returnObject += [PSCustomObject]@{
            VolumeName=$matchingVolume.Name;
            OriginatingMachine = $copy.OriginatingMachine;
            InstallDate = $copy.InstallDate}
    }

    $returnObject
}

Upvotes: 2

Related Questions