Backup Shadow Copies Explained: How VSS Works, What It Protects, and Why It Isn't a Backup

Windows systems generate and manage enormous amounts of live data. File servers, databases, virtual machines, and business applications are constantly reading from and writing to storage. Creating a reliable backup while these workloads remain active presents a challenge.

That's where backup shadow copies come in.

Using Microsoft's Volume Shadow Copy Service (VSS), Windows can create a point-in-time snapshot of a volume without requiring applications to shut down. Backup software then uses that snapshot to safely copy data while users continue working.

Although shadow copies are an essential part of many Windows backup strategies, they are often misunderstood. A shadow copy is not a backup by itself, and it should never be the only recovery mechanism an organization relies on.

Understanding how shadow copies work helps IT teams build more resilient backup strategies and improve operational maturity as they move from reactive IT management toward automated, proactive operations.

What Is a Backup Shadow Copy?

A backup shadow copy is a point-in-time snapshot of a Windows volume created through Microsoft's Volume Shadow Copy Service (VSS).

Rather than copying files that may still be changing, VSS creates a stable snapshot that backup software can safely read from. This allows files, applications, and services to remain online while the backup process runs.

Microsoft designed VSS specifically to coordinate backup operations across active Windows workloads. It provides a common framework that allows backup applications, Windows services, and supported business applications to work together during snapshot creation, reducing the risk of inconsistent backup data.

Because VSS only creates the snapshot, backup software is still responsible for copying the captured data to another storage location for long-term protection and recovery.

Shadow Copy vs Backup

Although the terms are sometimes used interchangeably, a shadow copy and a backup serve different purposes.

Shadow Copy

Traditional Backup

Point-in-time snapshot

Independent copy of data

Created by Volume Shadow Copy Service

Created by backup software

Usually used as the source for backup operations

Stored for long-term recovery

Often associated with the original storage infrastructure

Can be stored locally, offsite, or in the cloud

Designed for consistent data capture

Designed for data protection and recovery

Microsoft's VSS documentation explains that the snapshot serves as a stable source for backup operations rather than acting as the backup itself.

This distinction becomes important during storage failures or ransomware incidents. A snapshot alone does not provide the same level of protection as an isolated backup repository.

How Volume Shadow Copy Service Works

VSS coordinates several components whenever a backup begins.

The requester is typically the backup application initiating the backup job.

The writer represents Windows components or applications that prepare their data for backup. Windows includes numerous built-in writers, while applications such as SQL Server provide their own writers to coordinate application-specific data.

The provider creates and manages the actual shadow copy.

Microsoft's About the Volume Shadow Copy Service explains how these components communicate so that a consistent snapshot can be created while applications remain available.

During snapshot creation, the requester gathers metadata from writers, applications prepare their data, and the provider creates the snapshot. Microsoft documents this process in Shadow Copy Creation Details, including support for coordinated snapshots across multiple volumes when required.

Application-Consistent vs Crash-Consistent Snapshots

Not every snapshot provides the same level of protection.

A crash-consistent snapshot captures the storage exactly as it exists at a specific moment. This is similar to pulling the power cord on a running computer. Modern applications can often recover from this state, but recovery may require replaying transactions or performing integrity checks.

An application-consistent snapshot coordinates with VSS writers before the snapshot occurs. Writers temporarily prepare supported applications so their data is captured in a consistent state.

Microsoft's documentation on In-Box VSS Writers explains that writers identify the files, components, and restore information needed during backup and recovery.

SQL Server demonstrates why this coordination matters. According to Microsoft's documentation for Volume Shadow Copy Service (VSS) and SQL Writer, SQL Writer verifies that all storage volumes required by selected databases are included in the snapshot set. If required volumes are missing, the backup fails instead of producing an incomplete database backup.

For applications that support VSS, application-consistent backups generally provide more reliable recovery than crash-consistent snapshots alone.

Where Are Shadow Copies Stored?

Many Windows environments store shadow-copy data in shadow storage associated with the protected volume, although hardware providers may implement snapshots differently.

Because shadow copies typically remain closely tied to the original storage infrastructure, they should not be viewed as a substitute for independent backup copies.

Microsoft also notes that shadow-copy storage is finite. When the allocated storage becomes full, Windows automatically removes the oldest shadow copies to make room for newer ones. Organizations should understand these retention limits when planning recovery objectives.

Managing and Troubleshooting Shadow Copies

Windows provides several built-in administrative tools for working with VSS.

The official vssadmin utility displays registered VSS writers, providers, existing shadow copies, and shadow-storage information.

Administrators can also use vssadmin list shadows to view existing shadow copies on a system and confirm that snapshots have been created successfully.

For more advanced management, Windows Server includes Diskshadow, a scriptable command-line utility capable of creating, exposing, importing, and deleting supported shadow copies.

These tools are valuable when troubleshooting failed backups, verifying writer status, or investigating snapshot-related issues.

Can You Restore Individual Files From a Shadow Copy?

Yes, shadow copies can support recovery of individual files when they remain available.

Windows has historically exposed this functionality through features such as Previous Versions, allowing users or administrators to recover earlier versions of files without restoring an entire backup.

However, the availability of previous versions depends on whether the required shadow copy still exists. If the shadow copy has been deleted because storage limits were reached or administrative actions removed it, those recovery points are no longer available.

For long-term retention or disaster recovery, organizations should rely on dedicated backup repositories rather than local shadow copies alone.

Are Shadow Copies Safe From Ransomware?

Not necessarily.

While shadow copies can help recover recently changed files, they should not be considered ransomware-proof.

The National Institute of Standards and Technology recommends in Protecting Data from Ransomware and Other Data Loss Events that organizations conduct, maintain, and regularly test backup files to ensure successful recovery.

Likewise, NIST SP 800-209 recommends securing storage infrastructure, including backup systems and secondary copies, through appropriate administrative and security controls.

The CISA StopRansomware Guide also recommends maintaining isolated and regularly tested backups because attackers may attempt to compromise accessible backup data during an attack.

A locally accessible shadow copy can provide quick recovery for some scenarios, but it should not be the organization's only recovery mechanism.

Recovery Requires More Than Successful Backups

Creating backups is only part of a resilient recovery strategy.

Data Integrity: Identifying and Protecting Assets Against Ransomware and Other Destructive Events (NIST SP 1800-25) focuses on protecting assets and implementing controls before an incident occurs.

Data Integrity: Detecting and Responding to Ransomware and Other Destructive Events (NIST SP 1800-26) addresses identifying affected systems, analyzing the scope of data modification, and responding effectively after an incident.

Both publications reinforce the importance of validating recovery processes rather than assuming that successful backup jobs guarantee successful restoration.

Regular restore testing remains one of the most effective ways to verify that backup data is usable when it is needed most.

How Shadow Copies Fit Into Modern IT Operations

As organizations mature their IT operations, backup management becomes increasingly proactive.

Rather than waiting for backup failures to surface during an emergency, mature IT teams typically monitor backup health, investigate failed snapshots, verify endpoint stability, and regularly validate recovery procedures.

Although Level is not backup software, it helps IT teams maintain healthy endpoints by improving visibility into device health and operational issues that could affect backup reliability. Combining endpoint management with reliable backup software allows organizations to reduce operational risk while improving recovery readiness.

This proactive approach aligns with the broader IT Operations Maturity Model, where automation, visibility, and continuous monitoring replace reactive troubleshooting.

Frequently Asked Questions

Is a shadow copy the same as a backup?

No. A shadow copy is a point-in-time snapshot that backup software uses to capture consistent data. The backup application is responsible for storing protected copies for recovery.

What is the difference between VSS and a backup?

VSS creates consistent snapshots of running Windows workloads. Backup software reads from those snapshots and stores the data in backup repositories for long-term protection.

How long do shadow copies last?

Shadow copies remain available until they are deleted manually or automatically removed because allocated shadow-copy storage becomes full. Retention depends on available storage and system configuration.

Can ransomware delete shadow copies?

Attackers may attempt to compromise accessible backup data, including local recovery mechanisms. This is why CISA and NIST recommend maintaining isolated backups and regularly testing restoration procedures.

Do shadow copies replace backups?

No. Shadow copies improve backup consistency and support quick recovery scenarios, but they are only one component of a complete backup and disaster recovery strategy.

Final Thoughts

Backup shadow copies are a foundational part of Windows backup architecture. By creating point-in-time snapshots through Volume Shadow Copy Service, they allow backup software to capture consistent data while applications continue running.

However, shadow copies should be viewed as a snapshot mechanism rather than a complete backup solution. They work best when combined with protected backup repositories, secure storage infrastructure, regular restore testing, and proactive endpoint management.

Organizations that understand the role of VSS within a broader backup strategy are better positioned to improve resilience, recover more quickly from failures, and advance toward mature, proactive IT operations.