Fixed Formatting of Files

workflows/operations/Windows/VSS/Delete Shadow Copies.md

@@ -0,0 +1,39 @@
+---
+tags:
+  - Windows
+  - VSS
+  - Backup
+---
+
+## Purpose
+There are times when you may need to delete shadow copies (Volume Shadow Copies) from a drive, commonly to free up disk space. While this is usually straightforward, you may encounter scenarios where shadow copies cannot be deleted through normal means. The following methods provide ways to forcibly remove all shadow copies from a specific volume.
+
+!!! warning
+    The examples below will **permanently delete all shadow copies** on the specified drive. The examples use drive `D:` > Adjust the drive letter as needed.
+
+## Method 1: Delete Shadow Copies Using `vssadmin`
+The `vssadmin` utility is the standard tool for managing shadow copies. It is typically safe and handles deletions gracefully.
+
+However, some antivirus or endpoint protection software may block its execution due to its similarity to behavior used by ransomware. If `vssadmin` fails, use the `diskshadow` method described below.
+
+```cmd
+vssadmin delete shadows /for=D: /all /quiet
+```
+
+* `/for=D:` specifies the target volume.
+* `/all` removes all shadow copies on that volume.
+* `/quiet` suppresses confirmation prompts.
+
+## Method 2: Delete Shadow Copies Using `diskshadow`
+`diskshadow` is a more direct and lower-level tool than `vssadmin`. It should be used as a fallback option if `vssadmin` fails or is blocked.
+
+```cmd
+diskshadow
+set context persistent nowriters
+delete shadows volume D:
+exit
+```
+
+Explanation:
+* `set context persistent nowriters` ensures the command does not involve writer components (e.g., for backups), reducing the chance of interference.
+* `delete shadows volume D:` removes all persistent shadow copies for volume `D:`.