Volume Shadow Copy Service (VSS) is a Windows feature that creates point-in-time snapshots of files and volumes. These snapshots are designed to be restore-friendly, so administrators and backup tools can recover data after deletion, corruption, or system failure without needing the original state to remain unchanged.
In cyber security, VSS matters because it sits inside the recovery workflow that attackers often try to disrupt. Ransomware crews may delete shadow copies to prevent easy restoration, or abuse access to snapshots as part of broader defense evasion and credential theft activity. For defenders, VSS is both a recovery asset and a high-value target: protecting snapshot permissions, monitoring deletion commands, and hardening backup infrastructure can reduce the chance that an intruder turns recovery tools into an obstacle.