The Reality of Ransomware

Ransomware is a reality, but there are ways you can turn back the clock on data, to a previous day, or even a week...

This is called Volume Shadow Copies, and is a built in feature of any windows operating system. It's as simple as copying data from a historical restore point, and pasting it over randsomware infected data.

Here's how to set it up...

To backup your files, you can enable the Volume Shadow Copy in Windows 10/8/7. It gives you a chance to restore deleted file or folder.

What is Volume Shadow Copy?

Volume Shadow Copy (also known as Volume Snapshot Service or VSS ) is a technology included in Microsoft Windows. It allows you to take backup copies or snapshots of computer files or volumes whether in use or not. It requires VSS service, VSS requester, VSS writer, VSS provider during the process. And you can do it manually or automatically.

Shadow Copies can be created on local and external volume by Windows component that uses VSS technology. In Windows 7, you can create a shadow copy via Backup and Restore, System Restore points. In Windows 8/10, you can use file history feature.

Shadow copies also give you a chance to restore deleted files or folders. In Windows 7, you can use the Previous Versions tab. But it was removed for local volumes since Windows 8. So, In Windows 8/8.1/10, you can choose to use ShadowExplorer, which allows you to look through the old shadow copies and restore files.

How to enable Volume Shadow Copy in Windows 10/8/7?

Method 1: Enable Volume Shadow Copy using system restore points

• Step 1. Type system restore in the search box, then select Create a restore point.
• Step 2. Select a drive and click Configure.
• Configure
• Step 3. Tick Restore system settings and previous versions of files. After that, click Apply.
• Enable System Restore
• Step 4. Click Create to enable the volume shadow copy. After it's created, you can click OK to exit this window.
• Create

Method 2: Turn on Volume Shadow Copy using task scheduler
If you want to customize a volume shadow copy in Windows 10, you can use Task Scheduler. It’s more accurate. You can select a specific time to create a shadow copy.

Step 1. Open Task Scheduler. You can click Start, type task scheduler and select it from the list.

Step 2. Click Create Task and specify a name for the task (eg: ShadowCopy).

Create Task

Step 3. Create a new trigger. You can click the Trigger tab and New option in this interface, then select settings.

New Trigger

Step 4. Enable shadow copy. You can click the Actions tab and New option, type vmic under the Program or script option, input shadowcopy call create Volume=C: at the right side of the Add argument option.

Enable Shadow Copy

When you run program items using VSS technology, you may receive volume shadow copy error in Windows 10.

In this case, you should go to Services and check if the Volume Shadow Copy service is started at first time. Once it stops, the volume shadow copy service is not working in Windows 10 and the program will fail to create a snapshot for your volume.

How to disable Volume Shadow Copy in Windows 10/8/7?
Step 1. Go to System Properties window, select a drive and click Configure.

Step 2. In the Restore settings section, tick Disable system protection and click Apply and OK to exit this window.

Disable Shadow Copy

How to restore deleted files or folders via Shadow Copy?

Method 1: Using Windows Restore Previous Versions feature in Windows 7

Step 1. Select the file or folder you want to restore in a previous state. You can navigate to the file or folder and right-click it.

Step 2. Select Restore Previous Versions from the drop-down menu. In addition, you still can select Properties and click the Previous Versions tab.

Restore Previous Veresion

Step 3. Select the version of file or folder to restore.

In this window, you can see 3 options, including Open, Copy, Restore.

Open button allows you to view the content of file or folder.
Copy button allows you to copy file or folder to another location on the computer, even on external hard drive.

Restore button gives you a chance to restore the file or folder to the same location and replace the existing version.

Note: Sometimes, you will receive a message like there are no previous versions available. One of the possible reasons is that the volume shadow service is disabled. You can manually enable it in task manager.

There Are No Previous Versions Available

The detailed steps: right-click taskbar> select Start Task Manager > click services at the bottom > find Volume Shadow Copy and double-click it > set the startup type as Automatic > click Apply to make it available.

Method 2: Turn off Volume Shadow Copy using shadow explorer in Windows 8/10
Step 1. Download ShadowExplorer utility, install and launch it.

Step 2. Select the drive and date to restore file or folder.

Step 3. Select the file or folder to restore its previous version. You can right-click it and pitch on Export option.

Export

Step 4. Specify the location to save the previous version of file or folder. Wait and check the previous file or folder.

Can Volume Shadow Copy replace backup?
As mentioned above, volume shadow copy can create a snapshot of your computer files or volume.

Hope I’ve been able to shed a bit of insight around Disaster Recovery and how we can help businesses safe guard there data.

Darren Coetzee - Boss Global Technology Solutions