Volume Shadow Copy Removal is the deletion or disabling of Windows shadow copies that preserve previous versions of files and system states. Attackers use it to prevent recovery after encryption or destructive activity. Technically, it targets backup snapshots created by the Volume Shadow Copy Service, reducing rollback options and complicating incident response.
What Volume Shadow Copy Removal Does
Volume Shadow Copy Removal is not just file deletion, it is recovery suppression. By deleting or disabling Windows shadow copies, an attacker removes restore points that would otherwise let administrators roll back files, undo changes, or recover system state after encryption, sabotage, or other destructive activity.
The technique matters because volume shadow copies are often a fast, local recovery layer. When they are removed, incident responders lose a practical fallback even if primary data still exists elsewhere, which can turn an otherwise containable event into a prolonged outage.
How Attackers Use It in a Destructive Campaign
Shadow copy removal is commonly used near the end of a ransomware or wipe sequence, after the attacker has established access and prepared the environment for impact. Its purpose is to deny easy restoration, increase pressure on the victim, and make encryption or destruction more costly to recover from.
It is also a useful anti-recovery step in broader intrusion playbooks. Attackers may combine it with service disruption, backup tampering, or disabling recovery tooling so that defenders have fewer clean restore paths and less confidence that a quick rollback is possible.
In practice, the technique is often seen through Windows-native administrative commands and related tooling abuse, which makes it easy to blend into legitimate system administration activity if defenders do not baseline normal recovery operations.
For a deeper defensive breakdown of how this technique appears in Windows environments, see T1490 Inhibit System Recovery Defensive Guide.
Why It Breaks Recovery Assumptions
Many response plans assume that snapshot-based rollback will still be available after an incident. Shadow copy removal invalidates that assumption, because it attacks the recovery layer itself rather than only the live files. That is what makes the technique so effective in ransomware events and destructive operations.
Once shadow copies are gone, defenders must rely more heavily on external backups, immutable storage, or alternate recovery points. If those controls are weak, disconnected, or not recently tested, recovery time and business impact both increase sharply.
The technique also complicates forensic work. Investigators may lose an easy way to recover prior file versions, compare states, or reconstruct how the host changed before impact. That can make it harder to determine the original entry point, the sequence of changes, and the exact scope of tampering.
Windows forensic collection is often the next step when shadow copies are removed, because responders need artefacts from other sources to recover evidence and timeline context. The Windows Forensic Artefacts Guide is useful here for understanding what evidence remains when recovery points are missing.
Detection and Defensive Coverage
Detection should focus on both the act of removal and the surrounding behaviour. Sudden deletion of restore points, suspicious use of snapshot administration commands, changes to backup-related services, and activity that precedes encryption or mass file modification are all useful indicators.
Defensive coverage is stronger when recovery protection is treated as part of the anti-ransomware control set rather than as a backup-only concern. Immutable backups, protected recovery infrastructure, and alerting on recovery-disruption activity reduce the chance that a single compromised host can erase every easy restore option.
Collection and triage also matter, because responders often need to preserve evidence quickly when the attacker is trying to remove it. If a team can capture host artefacts before the environment is fully degraded, it has a better chance of confirming the technique and scoping the incident accurately.
The Anti-Forensics Detection Guide helps place shadow copy removal alongside other evidence-destruction behaviours, while the Ransomware Prevention Guide covers the defensive controls that reduce the value of this technique.
Risk and Threat Considerations
Volume shadow copy removal is dangerous because it directly targets the victim’s ability to recover, not just the confidentiality or integrity of individual files. In ransomware and destructive intrusions, that can turn a contained compromise into a prolonged outage by removing the easiest local rollback path.
Failure mechanism: The attacker disables or deletes Windows recovery snapshots after gaining sufficient host access, often alongside encryption, backup tampering, or service disruption, so the environment cannot quickly revert to a clean prior state.
Impact: Recovery becomes slower, more expensive, and more dependent on external backups or rebuilds, while forensic reconstruction may also be harder because earlier file states are no longer available.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8, NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1490 — Inhibit System Recovery | This technique is the ATT&CK recovery-disruption pattern itself. |
| Recommendation — Map recovery-disruption activity to T1490 and alert on shadow copy tampering. | ||
| CIS Controls v8 | CIS-11 — Data Recovery | Shadow copy removal directly undermines restore capability and recovery planning. |
| CIS-10 — Malware Defenses | Attackers use this technique in ransomware and destructive malware campaigns. | |
| Recommendation — Test backup and restore paths and protect recovery points against deletion. Harden endpoints and monitor for ransomware behaviours that precede recovery loss. | ||
| NIST CSF 2.0 | RC.RP-01 — Recovery Plan is Executed | The term centers on preserving and executing recovery after destructive compromise. |
| Recommendation — Validate that recovery procedures still work when local restore points are removed. | ||
| NIST SP 800-53 Rev 5 | CP-10 — System Recovery and Reconstitution | Shadow copy deletion directly affects system recovery and reconstitution capability. |
| Recommendation — Protect alternate recovery methods and verify they remain usable after compromise. | ||
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 31, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org