Protects the silent "undo history" Windows keeps for your files, so ransomware can't destroy your last-ditch recovery option.
Windows quietly keeps point-in-time snapshots of your drive called shadow copies (sometimes called "Previous Versions"). If a file gets corrupted or overwritten, you can right-click it, choose Restore previous versions, and often pull back an earlier copy. It's a genuinely underrated safety net.
The problem: ransomware knows about shadow copies too. One of the first things most ransomware does is run vssadmin delete shadows /all to wipe them out so you can't recover without paying.
Shadow Guard watches for any program trying to delete your shadow copies and blocks it. Only programs you've explicitly approved are allowed through.
Monitors running programs and intercepts any attempt to delete shadow copies in real time. Fast, low overhead, and catches most attacks. Turn this on first.
Uses a Windows feature called Image File Execution Options to hijack the standard tools ransomware uses to delete shadow copies (vssadmin.exe, wbadmin.exe, wmic.exe). Any attempt to run them fails unless launched from an approved program. This is the stronger of the two — but may interfere with legitimate backup tools, so pair it with the Allowed Programs list.
You don't have to wait for Windows to take a shadow copy on its own schedule. Click Create Snapshot, pick a drive, and Shadow Guard will ask Windows to take a fresh snapshot right now. This is a great habit before installing new software or major Windows updates.