The removal of Windows shadow copies, which are used as recovery points for files and system states. Attackers delete them to make restoration harder and to force victims toward backups that may be offline, incomplete, or also compromised.
Expanded Definition
Shadow copy deletion refers to the intentional removal of Windows Volume Shadow Copy Service recovery snapshots so that rollback and file restoration become difficult or impossible after an intrusion. It is not a standalone attack goal so much as a destructive step that supports ransomware, wiper activity, and other post-compromise actions. In practice, the term covers commands, scripts, and administrative abuse that target local restore points, snapshots, and related backup surfaces.
For security teams, the key distinction is between legitimate lifecycle management of snapshots and malicious deletion intended to eliminate recovery options. The behavior is usually discussed in endpoint defense, incident response, and resilience planning, rather than as a formal standalone control category. NIST’s NIST Cybersecurity Framework 2.0 does not define the phrase itself, but it does frame the broader need for recovery planning, data protection, and incident response coordination.
The most common misapplication is treating shadow copy deletion as routine cleanup, which occurs when privileged tooling is used without logging, approval, or change control in environments that still rely on snapshots for recovery.
Examples and Use Cases
Implementing defenses against shadow copy deletion rigorously often introduces operational friction, requiring organisations to balance rapid administrative recovery against tighter privilege controls and better monitoring.
- Ransomware operators run built-in Windows utilities to remove snapshots before encrypting files, making local restore paths unavailable.
- A compromised administrator account disables or deletes shadow copies to prevent incident responders from using quick recovery options after lateral movement.
- Malware launched through an endpoint payload targets restore points on a workstation or server so that reboot-based recovery becomes harder.
- Security teams test alerting by simulating snapshot deletion and verifying whether endpoint telemetry, SIEM rules, and MITRE ATT&CK-aligned detections identify the destructive activity.
- Resilience teams compare snapshot protection with immutable backup controls and offline recovery workflows to ensure restoration is still possible if local copies are removed.
Shadow copy deletion is often paired with credential theft, privilege escalation, or remote execution, because the attacker usually needs sufficient rights to modify recovery data. Operationally, this makes the term relevant to both endpoint hardening and privileged access governance, especially where administrators, service accounts, or automation tools can issue destructive commands.
Why It Matters for Security Teams
Shadow copy deletion matters because it turns a recoverable security incident into a much more expensive restoration problem. Once snapshots are removed, defenders may lose a fast path to restore individual files, system states, or application data, increasing pressure to rely on backups that may be delayed, fragmented, or also targeted. That is why response playbooks, backup segmentation, and privilege boundaries must be designed before an incident, not after.
The concept also intersects with identity governance. If highly privileged accounts, delegated admin roles, or unmanaged non-human identities can delete recovery points, then recovery itself depends on access control quality. NIST CSF recovery outcomes and CISA guidance on resilience both reinforce the need to protect backup and restore channels as part of broader incident readiness.
Security teams usually encounter the full impact only after a ransomware event or destructive breach has already removed local restore options, at which point shadow copy deletion becomes an operationally unavoidable recovery issue.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the technical controls, while ISO/IEC 27001:2022, DORA and NIS2 define the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | RC.RP-1 | CSF recovery planning covers restoring services after destructive attacks that remove snapshots. |
| NIST SP 800-53 Rev 5 | CP-9 | CP-9 addresses backup protection and restoration, which shadow copy deletion undermines. |
| ISO/IEC 27001:2022 | A.8.13 | The standard requires backup controls, directly relevant when attackers delete recovery snapshots. |
| DORA | DORA resilience expectations are relevant when destructive attacks remove restoration points. | |
| NIS2 | NIS2 requires incident resilience and continuity, both affected by loss of shadow copies. |
Design continuity measures so recovery still works if local snapshots are destroyed.
