Shadow Copy Deletion

What Shadow Copy Deletion Means in Practice

Shadow copy deletion is a recovery-disruption technique, not just a housekeeping action. By removing Windows volume shadow copies and related restore points, attackers reduce the chance that defenders can roll back files, recover system state, or quickly restore encrypted hosts without relying on other backups.

That makes the technique especially useful during ransomware operations, where the attacker wants to convert a recoverable incident into a business-stopping event. It is often paired with other recovery suppression steps, such as disabling recovery features, deleting backup catalogues, or targeting connected backup systems.

Why Attackers Use It

The goal is to raise the cost of recovery and narrow the victim's options. If local recovery points disappear, incident responders may be forced to depend on offline, immutable, or otherwise hardened backups, which are slower to restore and are not always available for every endpoint or server.

This technique also helps attackers shape the negotiation environment. When restoration becomes difficult, organisations are more likely to face prolonged downtime, lost productivity, and pressure to accept the attacker’s terms or spend heavily on emergency recovery.

Ransomware Prevention Guide places shadow copy protection in the wider set of controls that make ransomware less able to deny recovery.

How Organisations Detect Exposure

Exposure checks should focus on whether shadow copies exist, whether backup and recovery features are enabled, and whether administrative tools can reach them. In practice, teams look for suspicious use of commands such as VSS, backup catalogue deletion, recovery suppression, or unexpected changes to restore-point settings on Windows systems.

Detection works best when it is tied to endpoint telemetry and change monitoring, not just after-the-fact incident review. A deletion event on its own can be legitimate in maintenance, but repeated or broad deletion across many hosts is a strong indicator of destructive intent.

T1490 Inhibit System Recovery Defensive Guide focuses on the recovery-suppression behaviours that make this technique visible.

Windows Forensic Artefacts Guide helps analysts connect shadow copy removal with the broader evidence set on Windows hosts.

Recovery, Containment, and Post-Compromise Review

When shadow copies are deleted, restoration strategy matters more than ever. Organisations should favour backups that are offline, isolated, or protected from the same administrative boundary as the infected system, because local recovery options may no longer be trustworthy.

After containment, responders should review whether the deletion was isolated, whether backup systems were also touched, and whether the attacker had enough privilege to suppress recovery across multiple hosts. That review is important because shadow copy deletion often signals a broader compromise rather than a single-file incident.

Anti-Forensics Detection Guide is useful when shadow copy deletion appears alongside log clearing, timestomping, or other evidence-removal activity.

ATT&CK Impact Tactic Guide situates recovery suppression within the broader set of destructive and disruptive attacker outcomes.

How Shadow Copy Deletion Relates to Identity and Privilege

Shadow copy deletion usually requires elevated local privileges, so the technique is often a sign that an attacker has already crossed an access boundary. That makes privileged account hygiene, separation of admin duties, and monitoring for unusual administrative execution central to limiting abuse.

In mature environments, the important question is not only whether shadow copies exist, but whether the account that can delete them is tightly controlled and observable. If the same privileges that manage recovery also reach everyday endpoints, the attacker has a much easier path from initial access to irreversible damage.

Credential Dumping Guide is relevant because recovery suppression often follows credential theft or privilege escalation.

ATT&CK Impact Tactic Guide also helps explain how destruction of recovery points fits the final phase of many ransomware operations.

Risk and Threat Considerations

Shadow copy deletion is risky because it turns a recoverable compromise into a much harder recovery event. Once local restore points are removed, defenders lose a fast rollback option and may discover too late that their remaining backups are not sufficient for the scale of the incident.

Failure mechanism: Attackers use administrative access to remove volume shadow copies, backup catalogues, or recovery settings before encryption or destruction begins, which prevents easy restoration and increases pressure on the victim.

Impact: The organisation may face longer outages, higher restoration cost, broader data loss, and a stronger incentive for the attacker to escalate extortion.

Practitioner Guidance

Why practitioners should care: Treat shadow copy deletion as a recovery-control event, not just an endpoint command. If it appears in telemetry, assume the attacker is trying to deny rollback and widen the blast radius of the compromise.

What to watch for: Repeated deletion activity across many hosts, especially when paired with ransomware, backup tampering, or unusual administrative sessions, should trigger immediate containment and recovery-path review.

Practitioner takeaway: Recovery resilience depends on keeping the attacker away from the same administrative controls that create restore options in the first place.

Related resources from NHI Mgmt Group

• How should security teams detect ransomware activity from file creation and shadow copy deletion on Windows endpoints?
• What happens when attackers combine data exfiltration, double extortion, and shadow copy deletion in a ransomware incident?
• Volume Shadow Copy Deletion
• Why do shadow copy deletions increase the impact of ransomware on enterprise systems?