Sophos Endpoint Server Protection - Hardiskvolumeshadowcopy

Hi David Ashcroft 

This is usually seen if you have had Volume Shadow Copies enabled at some point, disabled and the copies were not deleted.

We've also seen this instance occur if you use any other third party backup software that makes use of VSS services to create copies or snapshots.

You can add a scanning exclusion for VSS paths in your Threat Protection Policy to prevent these alerts from occurring.

Hi David Ashcroft 

This is usually seen if you have had Volume Shadow Copies enabled at some point, disabled and the copies were not deleted.

We've also seen this instance occur if you use any other third party backup software that makes use of VSS services to create copies or snapshots.

You can add a scanning exclusion for VSS paths in your Threat Protection Policy to prevent these alerts from occurring.

DianneY said:

Hi David Ashcroft 

This is usually seen if you have had Volume Shadow Copies enabled at some point, disabled and the copies were not deleted.

We've also seen this instance occur if you use any other third party backup software that makes use of VSS services to create copies or snapshots.

You can add a scanning exclusion for VSS paths in your Threat Protection Policy to prevent these alerts from occurring.

 

Thank you for the clarification. Our concern is that we may end up excluding real data. But because the path has "volumeshadowcopy" in it, I am guessing this is not going to be data on the actual hard disks on the serve. We use DPM for backup and we use deduplication, but I don't think either of those makes use of shadow copies. If you go to each disk on the server shadow copies are disable so it is quite a strange thing.

DPM is using VSS and therefore is leveraging Volume Shadow Copy which would be why you are seeing the events logged about files in Volume Shadow Copy.  The reported events are 100% accurate on the files locations.