Stop Using VSS as a Backup Before Ransomware Deletes Your Shadow Copies

About this episode

The episode discusses the dangers of relying on VSS as a backup solution in the face of ransomware attacks.

Stop Using VSS as a Backup Before Ransomware Deletes Your Shadow Copies Ransomware deletes shadow copies using your own built-in Windows tools against you — and if VSS was your backup plan, you just found out the hard way that it wasn't. In this episode, W. Curtis Preston (Mr. Backup), Prasanna Malaiyandi, and Dr. Mike Saylor break down exactly what shadow copies are, why they don't qualify as a real backup, and how attackers are weaponizing vssadmin to wipe your recovery options before you even know you're under attack. If you've got Windows systems and you've been thinking "eh, we've got shadow copies," this episode is for you. We cover the history of VSS — what it was actually designed for, why it became a crutch, and why using it as your primary backup strategy is a bad idea on multiple levels. Performance, the 3-2-1 rule, and the fact that one attacker with admin rights can delete every single copy in seconds. We also get into the living off the land angle: how attackers do recon on your shadow copies, how they use them to scope out valuable data before going full ransomware, and what you can actually do to detect and respond to this behavior using EDR tools. The bottom…

People in this episode

Host: W. Curtis Preston

Guests: Prasanna Malaiyandi, Dr. Mike Saylor

Topics covered

• VSS
• shadow copies
• ransomware
• backup strategies
• data recovery
• cybersecurity

Keywords

• VSS
• shadow copies
• ransomware
• backup
• data recovery
• cybersecurity
• EDR tools

Mentioned in this episode

Organizations: Windows, EDR

Books & works: 3-2-1 rule

More episodes of The Backup Wrap-Up

• California Election Counting Explained by an Actual Poll Worker · June 8, 2026 · 25 min
• Stop 90% of Ransomware Attacks with Basic Cyber Hygiene · May 25, 2026 · 40 min
• Claude Deletes a Company — But It's Not Really Claude's Fault · May 18, 2026 · 40 min
• How Honeypots and Canary Files Catch Attackers Before They Strike · May 11, 2026 · 34 min
• Network Segmentation to Prevent Ransomware: What the UCSF Attack Taught Us · May 4, 2026 · 47 min
• Ransomware Sanctions, OFAC, and the Lazarus Group: A Real Case Study · April 20, 2026 · 37 min