Volume Snapshot Service / Volume Shadow Copy
https://github.com/gtworek/PSBits/tree/master/HideSnapshot
Simple tool called IOCTL_VOLSNAP_QUERY_NAMES_OF_SNAPSHOTS returns all snapshot, including hidden ones.
Comme le soleil, les machines ne se couchent jamais.