Volume Shadow Copy Deletion

What Volume Shadow Copy Deletion Means in Practice

Volume shadow copy deletion removes Windows shadow copies that would otherwise support file restoration, rollback, and forensic review. It is valuable to defenders because the same action that blocks recovery also removes a major source of evidence about what changed on the host.

On a standalone workstation this may simply reduce recovery options. In a compromised environment, however, it often signals an attempt to weaken resilience before encryption, tampering, or destructive activity continues.

Why Attackers Use It

Shadow copies are a common recovery path because they preserve earlier states of files and, in some cases, system data. Deleting them helps an attacker make recovery slower, more expensive, and more dependent on offline or external backups.

This behaviour is closely associated with ransomware tradecraft. A defender can treat it as part of a broader effort to inhibit system recovery, especially when it appears alongside backup tampering, service disruption, or mass file changes. See T1490 Inhibit System Recovery Defensive Guide for the recovery-focused attacker pattern behind this technique.

It also overlaps with anti-forensics. Removing snapshots can shorten the window in which investigators can inspect prior file states, registry artefacts, or pre-encryption content. The Anti-Forensics Detection Guide covers the broader evidence-destruction pattern that often accompanies shadow copy removal.

How Organisations Check Exposure and Preserve Recovery

Exposure is usually assessed by asking three questions: do endpoints and servers retain useful shadow copies, are they reachable by administrative tooling, and are backup and restore paths isolated from the same compromise path as the host. If the answer to any of those is weak, deletion can have outsized operational impact.

Recovery planning should assume that local copies may be removed during an intrusion. That means the real control is not only creating snapshots, but ensuring separate backup identity, immutability, and restore independence. The Ransomware Prevention Guide frames shadow copy protection as part of a larger resilience model rather than a single host-level setting.

For investigations, triage teams should preserve whatever remains before cleanup or reboot changes the evidence set. Windows Forensic Artefacts Guide is useful here because shadow copy states sit alongside other Windows artefacts that help reconstruct execution, rollback, and file-change timelines.

Detection, Containment, and Post-Compromise Review

Deletion activity is often visible through command-line telemetry, process creation, and follow-on loss of snapshot inventory. Because the act can be rapid, defenders benefit from alerting on the command patterns that remove copies and on abrupt changes in the number of available restore points.

After a confirmed incident, review whether the host still has alternate restore paths, whether the backup catalog was also touched, and whether the attacker used the deletion as a precursor to encryption or exfiltration. ATT&CK Impact Tactic Guide is a useful companion because it places shadow copy deletion in the wider set of destructive or disruptive actions that affect availability and recovery.

If the deletion was successful, post-patch review should include credential and access review for the account that executed it, because administrative execution is a prerequisite in many environments. The Credential Dumping Guide is relevant where shadow copy deletion occurs after credentials have already been exposed or reused elsewhere in the intrusion.

Operational Consequences for Recovery and Response

The practical consequence of volume shadow copy deletion is that an incident becomes harder to unwind. File-level restoration may fail, system rollback options may narrow, and responders may need to depend on offline backups, golden images, or rebuilds instead of local recovery.

That is why the technique matters even when no encryption is immediately visible. It often marks a stage in which the attacker is preparing the environment for irreversible impact, while defenders are still deciding whether the event is an intrusion, a prelude to ransomware, or a cleanup step after earlier compromise.

For triage workflows, it is also a signal to widen the investigation beyond the endpoint. A host that lost its shadow copies may also have had its logs, backups, or restore tooling interfered with, which changes both the response sequence and the confidence level in available evidence.

Risk and Threat Considerations

Shadow copy deletion matters because it weakens both recovery and investigation at the same time. Once local restore points disappear, a routine malware event can become a business-disrupting incident if offline backups are incomplete or untested.

Failure mechanism: An attacker or privileged malicious process removes restore points after gaining administrative execution, often to block rollback, delay recovery, and reduce the defender’s access to prior file states.

Impact: The organisation may lose a fast recovery path, have less evidence for root-cause analysis, and face longer downtime if encryption, destruction, or backup tampering follows.

Practitioner Guidance

What to watch for: Treat unexpected shadow copy loss as a containment trigger, not just a housekeeping event. The most useful response question is whether the deletion was an isolated administrative action or part of a broader compromise chain that also touched backups, logs, or privileged credentials.

Practitioner takeaway: If local restore points can be removed by the same trust path that administers the host, recovery is only as strong as the separation of your backups and administrative controls.

Related resources from NHI Mgmt Group

• How should security teams detect ransomware activity from file creation and shadow copy deletion on Windows endpoints?
• What happens when attackers combine data exfiltration, double extortion, and shadow copy deletion in a ransomware incident?
• How does Volume Shadow Copy Service (VSS) work?
• How do attackers use Volume Shadow Copy Service (VSS)?