0

Four days ago my PC got phobos ransomware. I didn’t notice until three days ago, and the reason is that the attack stopped midway, leaving some of my data as it is and not leaving behind any ransom note or something like that.

Now, when I noticed the attack, I panicked so much, that I did two stupid mistakes. First, I deleted all (or I think I did) the files and programs that might be related to the attack (temp and prefetch folders, randomly named exe files, some software I’ve installed recently, and some strange module called frida-winjector). I now know that I should’ve sent these for analysis.

The second mistake: I had a backup but it seems that the backup software I’ve been using causes so much clatter on my external harddisk (some files had 4 copies!) so I decided I should (1) take all of that on my PC, (2) clean it up, (3) format the harddisk, then (4) put the backup back. The problem is, the ransomware attack happened on step 2, and in my panicking I copied all the unaffected data into the same backup harddisk, thus overwriting some of what may have remained of the lost data on the harddisk.

At first, I thought I could make use of shadow copies of my internal harddisk, since “encrypting a file” is just like renaming it, an encrypted copy is made and the old one deleted, so it must be in the shadow disk, right? Wrong, ransomware deletes shadow copies, as I’ve later found out.

But what if the attack stopped midway? When exactly in the process of the attack does the attacker delete the shadow copy? I’ve found the untouched data when I used a commercial recovery program, why then did I not find the encrypted data on the same disk?? Can someone understand what has happened?

Improve this question
2
  • 1
    What's exactly your question? The title seems rather unattached. There are different kinds of ransomware, so the answer would not be generalizable, but specific to a certain ransomware. Also, your reckless actions makes it almost impossible to repeat what has happened, so it's unlikely no-one would exactly know the state without access to the actual data in question.
    – Esa Jokinen
    Commented Aug 26, 2020 at 12:16
  • @EsaJokinen my question is whether my data could be found using recovery tools, since the attack stopped midway. As far as know from my research on the internet, I’ve been infected with a version of Phobos Ransomware that has appeared in March 2020 (filenames are appended with [email protected])
    – user401445
    Commented Aug 26, 2020 at 12:24

1 Answer 1

Reset to default
1

In case of ransomware, you would be able to recover:

  1. What hasn't yet been encrypted, obviously.

  2. What hasn't been overwritten, using specialized file recovery tools. These file recovery tools detect removed file systems and files by analysing the contents of the unallocated space. As it uses the data (former contents of a file) to determine whether it once was a file and encrypted data won't have such patterns, it's not a surprise it won't be able to recover removed encrypted data.

  3. Everything from the backups. Backups are the best weapon against ransomware there is! However, if the backups are stored somewhere the user has write access to, they may get encrypted by the ransomware, too.

    My recommendations for a good backup solution:

    • pull instead of push
    • use incremental backups.
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .