{"id":1180,"date":"2019-08-05T18:21:56","date_gmt":"2019-08-05T16:21:56","guid":{"rendered":"http:\/\/itsimple.info\/?p=1180"},"modified":"2019-08-08T23:20:10","modified_gmt":"2019-08-08T21:20:10","slug":"how-to-protect-volume-shadow-copy-from-deletion","status":"publish","type":"post","link":"https:\/\/itsimple.info\/?p=1180","title":{"rendered":"How To Protect Volume Shadow Copy From Deletion"},"content":{"rendered":"<p>&nbsp;<\/p>\n<p>Volume Shadow Copy is a great and value add on to windows and can save data lost very fast and efficient . In the last years when virus\u00a0 and ransom virus appears the first think they do is to delete all of you shadow copies preventing you from fast restoring you lost files or encrypted files. Forcing you to pay or to use the backups you made to you file and data.<\/p>\n<p>Volume shadow copy are created by the file system with the help of &#8220;Providers&#8221; accessing this feature with API option is a mean to create\/delete Shadow Copies to a volume. Basically any one can write a code to manipulate the creation or deletion of Shadows with a code to connect to this API and manipulate this Shadows. more information from Microsoft\u00a0 <a href=\"https:\/\/docs.microsoft.com\/en-us\/windows\/win32\/vss\/volume-shadow-copy-reference\">here <\/a><\/p>\n<p>A full explanation on how Volume Shadow Copy work can be found <a href=\"https:\/\/www.dell.com\/community\/NetWorker\/The-Overview-of-VSS-in-Networker\/td-p\/7133991\">here :<\/a><\/p>\n<p><a href=\"https:\/\/www.dell.com\/community\/NetWorker\/The-Overview-of-VSS-in-Networker\/td-p\/7133991\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone wp-image-1181\" src=\"https:\/\/itsimple.info\/wp-content\/uploads\/2019\/08\/VSS_Map.png\" alt=\"\" width=\"730\" height=\"423\" srcset=\"https:\/\/itsimple.info\/wp-content\/uploads\/2019\/08\/VSS_Map.png 687w, https:\/\/itsimple.info\/wp-content\/uploads\/2019\/08\/VSS_Map-300x174.png 300w\" sizes=\"auto, (max-width: 730px) 100vw, 730px\" \/><\/a><\/p>\n<p>The Volume Shadow Copy is managed by the service VSS, So if we disable this service the API will not function. now most of the virus script just run this before corrpting the data (if the are lazy writing there own scripts to the API):<\/p>\n<pre>vssadmin.exe Delete Shadows \/All \/Quiet<\/pre>\n<p>Or<\/p>\n<pre>WMIC.exe shadowcopy delete \/nointeractive<\/pre>\n<p>But\u00a0 what if the service will be down and disabled ?<\/p>\n<p><a href=\"https:\/\/itsimple.info\/wp-content\/uploads\/2019\/08\/VSS_error.png\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-1182\" src=\"https:\/\/itsimple.info\/wp-content\/uploads\/2019\/08\/VSS_error.png\" alt=\"\" width=\"977\" height=\"245\" srcset=\"https:\/\/itsimple.info\/wp-content\/uploads\/2019\/08\/VSS_error.png 977w, https:\/\/itsimple.info\/wp-content\/uploads\/2019\/08\/VSS_error-300x75.png 300w, https:\/\/itsimple.info\/wp-content\/uploads\/2019\/08\/VSS_error-768x193.png 768w\" sizes=\"auto, (max-width: 977px) 100vw, 977px\" \/><\/a><\/p>\n<p>The API will be blocked for changes and our shadows will Survive\u00a0 !<\/p>\n<p>Here is a simple script to start and create Volume Shadow Copy For a partition &amp;\u00a0 stop and disable the service for protection (in the example Drive C: and Drive D: ) .<\/p>\n<pre>sc config VSS start= Demand \r\nnet start VSS\r\n\r\nWMIC shadowcopy call create Volume=C:\\\r\nWMIC shadowcopy call create Volume=D:\\\r\n\r\nnet stop VSS\r\nsc config VSS start= disabled<\/pre>\n<p>Then you can save as BAT file and scheduler this\u00a0 script to run as many times you want to create shadows for protection, Needless to say that when the VSS service is not running you will not be able to access the &#8220;Configure Shadow Copies&#8230;&#8221;<\/p>\n<p>Please take under consideration that is another program need to use shadow copy service it will fail unless you will execute service start &#8230;<\/p>\n<h2><strong>Shadow Copy is no backup !!! please make proper backups to your data<\/strong><\/h2>\n<p>&nbsp;<\/p>\n<hr \/>\n<h3>Good Luck<\/h3>\n","protected":false},"excerpt":{"rendered":"<p>&nbsp; Volume Shadow Copy is a great and value add on to windows and can save data lost very fast and efficient . In the last years when virus\u00a0 and ransom virus appears the first think they do is to delete all of you shadow copies preventing you from fast restoring you lost files or [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[21,4,12,14,15],"tags":[],"class_list":["post-1180","post","type-post","status-publish","format-standard","hentry","category-operating-systems","category-tech","category-tutorials","category-windows","category-windows-server"],"_links":{"self":[{"href":"https:\/\/itsimple.info\/index.php?rest_route=\/wp\/v2\/posts\/1180","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/itsimple.info\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/itsimple.info\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/itsimple.info\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/itsimple.info\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1180"}],"version-history":[{"count":0,"href":"https:\/\/itsimple.info\/index.php?rest_route=\/wp\/v2\/posts\/1180\/revisions"}],"wp:attachment":[{"href":"https:\/\/itsimple.info\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1180"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/itsimple.info\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1180"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/itsimple.info\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1180"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}