Shadow copy
(also volume shadow copy, VSS)
Shadow copy definition
Shadow copy is a technology operating systems use to create backup copies or snapshots of computer files and folders at specific points in time. These copies enable users to recover and restore data during accidental deletion, data corruption, or system failures. Shadow copies are especially useful in mitigating the impact of ransomware attacks, as they allow users to restore files to their previous states without paying the ransom.
See also: buffer overflow attack, data backup, cryptolocker
Shadow copy examples
- Windows restore points: The Windows operating system uses shadow copy to create restore points, which capture the state of the system at a specific point in time. Users can roll back to a restore point to recover from system issues or malware infections.
- File History: Windows File History utilizes shadow copy to maintain versions of files in a specified folder, allowing users to restore previous file versions if necessary.
Shadow copy vs. traditional backups
Traditional backups typically involve copying files to an external storage device, while shadow copies create snapshots of files on the same volume. Shadow copies offer some advantages, such as faster recovery times and lower storage requirements. Still, they may be less secure as they remain on the same volume and can be affected by system failures or ransomware attacks. Traditional backups are generally more secure but may require more time and storage resources to maintain.
Using shadow copies effectively
To maximize the benefits of shadow copies, users should:
- Enable shadow copy functionality in their operating system and configure it to create copies regularly.
- Maintain traditional backups in addition to shadow copies to ensure comprehensive data protection.
- Consider using an anti-malware solution to detect and prevent ransomware attacks that may target shadow copies.