backup vs. snapshot
expressionIT supportops culture
Snapshots are fast local restore points sharing the original's fate; backups live elsewhere and survive it - only the second answers ransomware.
The 3-2-1 rule: three copies, two media, one off-site.
A shadow copy is a point-in-time snapshot of a volume taken while it is in use, so that files locked by running applications can still be backed up consistently. Windows calls the mechanism Volume Shadow Copy Service, and the same idea appears everywhere under different names.
Its everyday value is the previous versions feature, which lets a user recover a file they overwrote an hour ago without involving anyone. That quietly resolves an enormous number of support requests, and the fact that most users do not know it exists is a genuine documentation failure rather than a technical one.
Its role in ransomware is why it now gets security attention. Deleting shadow copies is a standard early step for ransomware, precisely because they would otherwise make recovery trivial, and the command to do it is well known enough that its execution is a high-quality detection signal. That has driven both protections on the deletion path and the harder lesson underneath: a backup that lives on the machine being attacked, reachable by an administrator on that machine, is a convenience feature rather than a backup, and the copy that survives is the one somewhere else entirely.