From 28e5fa9eba560549bbffaf77e93eccd2becba0ce Mon Sep 17 00:00:00 2001 From: XiaoliChan <30458572+XiaoliChan@users.noreply.github.com> Date: Tue, 30 Dec 2025 18:39:02 +0800 Subject: [PATCH] [List Snapshots] Show shadowcopy InstallDate in WMI Query Signed-off-by: XiaoliChan <30458572+XiaoliChan@users.noreply.github.com> --- nxc/protocols/wmi.py | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/nxc/protocols/wmi.py b/nxc/protocols/wmi.py index 4594ab18..163f7571 100644 --- a/nxc/protocols/wmi.py +++ b/nxc/protocols/wmi.py @@ -402,7 +402,7 @@ class wmi(connection): def list_snapshots(self): drive = self.args.list_snapshots self.logger.info(f"Retrieveing volume shadow copies of {drive}.") - wql = "select ID, DeviceObject, ClientAccessible from win32_shadowcopy" + wql = "select ID, DeviceObject, ClientAccessible, InstallDate from win32_shadowcopy" def callback_func(iEnumWbemClassObject, records): while True: @@ -415,10 +415,10 @@ class wmi(connection): self.logger.info("Target volume shadow copies not existed.") return - self.logger.highlight(f"{'Drive':<8}{'Shadow Copy ID':<40}{'ClientAccessible':<18}{'Device Object':<50}") - self.logger.highlight(f"{'------':<8}{'--------------':<40}{'----------------':<18}{'-------------':<50}") + self.logger.highlight(f"{'Drive':<8}{'Shadow Copy ID':<40}{'ClientAccessible':<18}{'InstallDate':<27}{'Device Object':<50}") + self.logger.highlight(f"{'------':<8}{'--------------':<40}{'----------------':<18}{'-----------':<27}{'-------------':<50}") for record in snapshots: - self.logger.highlight(f"{drive:<8}{record['ID']['value']:<40}{record['ClientAccessible']['value']:<18}{record['DeviceObject']['value']:<50}") + self.logger.highlight(f"{drive:<8}{record['ID']['value']:<40}{record['ClientAccessible']['value']:<18}{record['InstallDate']['value']:<27}{record['DeviceObject']['value']:<50}") @requires_admin def execute(self, command=None, get_output=False, use_powershell=False):