http://valinet6l6tq6d5yohaa6gdsf2ho4qcqcxyj2nahp5kd4z7nsa6ycdqd.onion/2022/08/29/Working-with-shadow-copies-is-kind-of-broken-on-Windows-11-22H2.html
Well, no really, since trying to open files that are clearly in the snapshot we have selected produces an error (which also seems to read from some illegal buffer, as signified by the Chinese characters, but that’s a bug for some other time): Looking a bit on the code, after the call to QuerySnapshotNames , there are calls to BuildSnapshots - > TestSnapshot - > GetFileAttributesExW .