Cryptolocker and shadow copies?

Question

Malware

I'm wondering if anyone can explain intelligibly? It is known that shadow copies do not copy all information, but only the changed blocks of data. This means that when infected with a cryptolocker, it may turn out that some files cannot be obtained from shadow copies, because part of the file will be encrypted. Explain please?

Answer 1

blog.macrium.com/2012/11/backup-internals-what-is-...
The changed blocks of the file are copied to the shadow storage. If the entire file is encrypted, then all blocks of the file will be in storage. If only part of the file is encrypted (modified), then the original blocks will be stored in the vault, i.e. you can easily restore the original appearance of the file.

Answer 2

Shadow copies are disabled and destroyed in a couple of lines of code. Draw your own conclusions.

Answer 3

Yes, I am aware that some ransomware can overwrite shadow copies. But still I wanted to understand how it works.