Ransomware activity detection - how to monitor for shadow copies being deleted? I looked thru the main App/System logs and don't see entries being created when I disable Shadow Copies. Is this logged somewhere so it can be monitored and alerted on such activity which can indicate ransomware activity?