Hello, you are using an old browser that's unsafe and no longer supported. Please consider updating your browser to a newer version, or downloading a modern browser.
Training Camp • Cybersecurity Glossary
Volume Shadow Copy uses Windows VSS to snapshot in-use files for backup and forensics; ransomware often deletes it to block recovery.
Volume Shadow Copy Definition: Volume Shadow Copy uses Windows VSS to snapshot in-use files for backup and forensics; ransomware often deletes it to block recovery.
Volume Shadow Copy is a Windows technology provided by the Volume Shadow Copy Service VSS that creates point-in-time snapshots of files and volumes, even while they are in use, to support backups and system restore. In digital forensics these snapshots are valuable because they can reveal earlier versions of files, deleted data, and historical system state. Attackers, conversely, often delete shadow copies with tools like vssadmin during ransomware attacks to prevent recovery.
Turn knowledge into credentials with our instructor-led cybersecurity boot camps.
View All Courses →