Metadata-Version: 2.1
Name: reshadow
Version: 0.0.21
Summary: PyShadow - ShadowCopy Anaylze Tool
Home-page: https://github.com/alicangnll/pyshadow
Author: Ali Can Gönüllü
Author-email: alicangonullu@yahoo.com
License: GNU General Public License v2.0
Project-URL: Bug Report, https://github.com/pyshadow/pymem/issues/new
Classifier: Intended Audience :: Developers
Classifier: Topic :: Software Development :: Libraries :: Python Modules
Classifier: Programming Language :: Python :: 3.8
Classifier: Programming Language :: Python :: 3.9
Classifier: Programming Language :: Python :: 3.10
Classifier: Programming Language :: Python :: 3.11
Description-Content-Type: text/markdown
License-File: LICENSE

<img src="pic/PY-removebg-preview-crop.png" />

#### Python ShadowCopy Analyzer for Cyber Security Researchers!

### Medium Link for Developers
<a href="https://alicann.medium.com/pyshadow-shadowcopy-editor-50357b055c4b">Click here</a>


### Installation
<p>PyPi : <a href="https://pypi.org/project/pyshadowcopy/">PyShadowCopy</a></p>

### Example Code
<pre>
# List all ShadowCopy
'''
Example Result
ID : {e9a894be-dae7-49cb-9196-b5a22148210b}
Creation Date : 6.11.2022 19:58:20
Shadow Copy Location : \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy7
'''
list = ReShadowCode.VSS_ListShadows()
for shadowlist in list:
    print("ID : " + shadowlist["id"] + "\nCreation Date : " + shadowlist["creation_time"] + "\nShadow Copy Location : " + shadowlist["shadowcopy"] + "\n")
#Create a ShadowCopy
ReShadowCode.VSS_Create()
#Create a pipe/symlink with ShadowCopy() (Ex. \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy<b>id</b>)
ReShadowCode.VSS_Create_Pipe("C:\\Shadow1", "id")
#Get file list from ShadowCopy
'''
Example Result
Ali
Ali Can Gönüllü
Ali_000_vcRuntimeMinimum_x64.log
Ali_000_vcRuntimeMinimum_x86.log
Ali_001_vcRuntimeAdditional_x64.log
Ali_001_vcRuntimeAdditional_x86.log
All Users
Default
Default User
desktop.ini
Public
TEMP
'''
list = ReShadowCode.VSS_Get_FileList("C:\\Shadow1\\Users")
for files in list:
    print(files)
</pre>

### Images
<img src="pic/Shadow copy creation process.jpg" />
<img src="pic/Architectural diagram of Volume Shadow Copy Service.jpg" />
