Data Recovery · LanCologne

What are the implications of a corrupted Volume Shadow Copy (VSS) for data recovery?

Windows„ Volume Shadow Copy Service (VSS) stores previous states of a volume block by block in the “System Volume Information„ folder. This allows you to restore older versions of files using “Previous Versions’ – provided the shadow copies are present and intact.

Free enquiry

Technical background

Shadow copies are created by restore points, backup software or scheduled tasks on Servern. They occupy a limited amount of storage space; older copies are automatically deleted. Ransomware often targets them specifically (e.g. via vssadmin). Depending on the disk allocation, deleted shadow copies may still be partially present in areas that have not been overwritten.

What you should – and shouldn’t – do now

  • Do not create any new restore points or backups on the same volume.
  • In the event of a ransomware attack: Do not continue to use the system and have it forensically secured.
  • Do not defragment or optimise the data carrier.

Here’s how we do it

  • Create an image of the affected volume.
  • Mount existing shadow copies individually and compare file versions.
  • Search for remnants of deleted shadow copies in unallocated areas.

Borders

  • Shadow copies are not backups; if they are stored on a faulty storage medium, they will suffer the same fate.
  • Shadow copies that have already been overwritten cannot be restored.

Possible results

Previous versions of files, dated relative to the respective shadow copy.

How we carry out data recovery

Every data storage device is first diagnosed in our own laboratory in Cologne; the diagnosis is free of charge. You will then receive a written quote and can decide whether to accept it. If you decline, you can collect the data storage device from the laboratory by appointment – there are no postage costs involved – or we will post it back to you; in which case postage and packaging costs may apply. Data is recovered from copies, not from the original – using professional data recovery hardware such as the PC-3000. If a drive needs to be opened, this is carried out on a HEPA H14-filtered clean bench. We do not offer a guarantee of success prior to diagnosis, as this is simply not possible in a professional context. Your storage device and your data will remain confidential and will not be passed on to third parties.

1Enquiries and submission by post or in person at the laboratory by prior appointment
2Free diagnosis of the cause of the damage
3Written quotation – we will only proceed once you have approved it; if you decline, you may collect the item from the laboratory or we will return it to you (postage and packaging costs may apply)
4Recovery, data verification and confidential handover

Request a diagnosis   Find out more about the process, costs and confidentiality →

Frequently Asked Questions

Are shadow copies a backup?+
No. They are stored on the same storage medium and will be lost if that medium fails.
Is it still possible to find shadow copies after a ransomware attack?+
Sometimes. If they have simply been deleted and not overwritten, it is sometimes possible to recover some of the data.
Are there shadow copies on clients as well?+
Yes, provided that Computer Protection or system restore points are enabled.

Related topics

🔗 Related topics