Volume Shadow Copy Removal is the deletion or disabling of Windows shadow copies that preserve previous versions of files and system states. Attackers use it to prevent recovery after encryption or destructive activity. Technically, it targets backup snapshots created by the Volume Shadow Copy Service, reducing rollback options and complicating incident response.
What Volume Shadow Copy Removal Does
volume shadow copy removal is an anti-recovery action, not just a cleanup step. By deleting or disabling restore points and prior file states, it removes one of the most practical ways to roll back after ransomware encryption, sabotage, or destructive compromise.
Because shadow copies are part of Windows recovery and snapshot capability, the technique often appears late in an intrusion, after the attacker has already gained enough access to interfere with recovery. That timing matters: it can turn a contained incident into a longer outage by removing local restoration options.
How Attackers Use It in Real Intrusions
Attackers typically use volume shadow copy removal to make a victim more dependent on offline backups, external recovery services, or rebuilds. In ransomware cases, it reduces the chance that defenders can restore files quickly without paying attention to the attacker’s timeline.
The technique is also useful after destructive activity, because it helps erase straightforward rollback paths and can complicate forensic reconstruction of recent system changes. It is most effective when the attacker already has administrative-level execution or equivalent privileged access on the host.
Related attacker behavior is commonly tracked in MITRE ATT&CK Enterprise Matrix, which helps defenders map the technique to broader post-compromise activity such as privilege abuse, defense evasion, and recovery inhibition.
Security Implications for Backup and Recovery
The main security impact is reduced resilience. Shadow copies are a local safety net, so removing them narrows the set of recovery paths available during an incident and increases the operational cost of remediation.
It also creates a detection challenge. If teams do not monitor for snapshot deletion, the action can blend into ordinary administrative activity and be noticed only when restoration fails. That makes the control problem as much about visibility as it is about backup design.
On Windows systems, hardening and control expectations that cover configuration integrity, audit logging, and recovery protections are addressed in NIST SP 800-53 Rev 5 Security and Privacy Controls. In particular, recovery-oriented and configuration-oriented safeguards are the natural control family for limiting this kind of post-compromise disruption.
Common Failure Modes and Defensive Context
This technique usually succeeds when privileged access is too broad, administrative actions are insufficiently monitored, or backup strategy depends too heavily on local snapshots. It is often paired with other preparatory steps, such as disabling security tools, deleting backup catalogs, or targeting recovery services before encryption begins.
Defenders should think of it as part of a larger “deny recovery” pattern rather than a stand-alone tactic. The practical consequence is that even a technically successful decryption or partial remediation effort may still be slow if the last convenient restore point has been removed.
Operational hardening guidance for Windows environments is also reflected in the CIS Benchmarks, which are commonly used to reduce weak defaults and improve recovery-related configuration discipline.
Risk and Threat Considerations
Volume shadow copy removal is a high-value destructive step because it converts a compromise into a recovery problem. Once snapshots are deleted, organisations may lose an easy rollback path and face longer downtime, more expensive rebuilds, and greater pressure to rely on offline backups.
Failure mechanism: Attackers with sufficient privilege disable or delete shadow copies so local restore points no longer exist when defenders need them.
Impact: Recovery becomes slower and less reliable, ransomware leverage increases, and incident response may have to proceed without the simplest host-level restoration option.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1490 — Inhibit System Recovery | Shadow copy deletion is a classic system-recovery inhibition technique. |
| Recommendation — Map shadow copy deletion to T1490 and alert on recovery-disabling commands. | ||
| NIST SP 800-53 Rev 5 | AU-2 — Event Logging | Snapshot deletion should be auditable because it changes recovery state and incident evidence. |
| CM-2 — Baseline Configuration | Recovery protections depend on controlled system configuration and hardening. | |
| Recommendation — Log recovery-state changes and review them for suspicious administrative activity. Baseline Windows recovery settings and restrict who can change them. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | Deletion of recovery artifacts is best detected through protected logs and alerting. |
| CIS-5 — Account Management | The technique generally requires excessive or compromised administrative privilege. | |
| Recommendation — Protect and centralise logs so snapshot deletion events remain visible during incidents. Limit administrative reach so recovery features cannot be disabled by ordinary operator access. | ||
Related resources from NHI Mgmt Group
- Volume shadow copy
- How should security teams detect ransomware activity from file creation and shadow copy deletion on Windows endpoints?
- Why do shadow copy deletions increase the impact of ransomware on enterprise systems?
- What do organisations get wrong when they try to manage shadow data after a migration or development copy is created?
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 24, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
