How can I safely restore files from an infected computer?

Question

This was asked before, however was 6 years ago and things change.

I have a relative's computer, that got owned by an AnyDesk "delete your files" ransomware attack.

I'm pretty sure they just deleted files and asked for money, and that was the end. However as they didn't get any money, and had a few hours access to the computer, I can't say for sure.

So imagine worst case type "infection", the question is how to get files that were "recovered" back in a safe manner.

Files means data files only. Pictures, videos, text, docs, excel, pdf. No exe or ini or bat etc.

Here's the sequence of events that happened after the attack.

1. computer shut down and removed from network
2. hard drives removed
3. new hard drives installed, and fresh windows from fresh usb creations media
4. connect to network and install Norton, run full scan of everything
5. disconnect from network
6. put in one of the original drives, copy over files that had not been deleted.
7. put in the "deleted" hard drive, and using ccleaner recuva restore a large number of files
8. run norton AV on the lot
9. copy them to a fresh external usb drive
10. run av on the drive
11. remove the drive.
12. format c drive and fresh re-install windows yet again

I think that after all this, what I have is a computer that is clean (new drives, new windows).

I also have an external USB drive, that was plugged into a compromised computer, and contains files that a hacker had access to.

I have plugged that into another "sacrificial" laptop, and run AV on it again 2 weeks later, and it still clean.

Does that mean those files are safe to restore to other computers, which I definitely don't want compromised, or are there some other more detailed steps to take to be 100% sure?

=================== UPDATE

So given the files were copied from docked HD to external HDD with AV running (offline situation) on a freshly installed windows system...

What I thank I will do now is the following:

Set up a Linux distro with AV installed. Connect the External drive and scan it. Copy the files to local and scan. format the external HDD and copy the files back.

Put the HDD into a "live" windows computer taken offline. scan with malwarebites. scan with Norton again. if all ok, copy the files to local PC and reconnect to network, and continue on the basis that the files are now safe!

Install

Answer 1

Any access to potentially infected files incurs some level of risk of re-infection. However, your suggestions certainly help to mitigate that risk.

The best solution would be to reinstall the computer with new hard drives or systems, and then install the old drive into an adapter or dock and manually copy the individual files you are concerned with.

In doing so, you should have a good antimalware software program active.

Answer 2

I mean if you assume the worst case scenario: Just don't do it. Give them the newly set up computer and let their lost data serve as a cautionary tale.

Like in the worst case scenario every single file might be compromised, the flash memory of your BIOS might be corrupted, the hardware might be damaged and whatnot.

So in terms of steps you could take:

-1. Backup your (important) data regularly.

0. If you can afford it, just let that hard drive sit for a while. Because ultimately time is on your side. That is, the malware on that device is frozen in place, but the world keeps spinning, so AV scanners improve, vulnerabilities get patched, malware forensics might be able to more reliably tell you what kinds of viruses were popular around that time and how they worked. So maybe in a year or more your in a much safer position to take a look at it again. Or the data becomes useless and/or unreadable due to digital rot...

1. Computer shut down and removed from network.

Probably good advice give any program or attacker as little time and access as possible. Though with several hours of access you're probably well too late for that.

2. hard drives removed

Yeah hardware infections are probably rarer, so that would be the critical components.

3. new hard drives installed, and fresh windows from fresh usb creations media

Maybe rather linux distro that looks like Windows, but that probably won't save them from social engineering either...

4. connect to network and install Norton, run full scan of everything

This step isn't entirely clear. Like do you need network connection to install norton and what do you scan? Like ideally you scan the network before you reintroduce your fresh windows to make sure the rest of the network wasn't compromised and reinfects your device. Apart from that your new device should be clean.

5. disconnect from network

Sound good to keep things disconnected when you reintroduce compromized hardware.

6. put in one of the original drives, copy over files that had not been deleted.

It's probably not a good idea to boot the compromised drive directly and if you can avoid it you should probably also not use your new setup as a live system. There are dedictated live systems that you can install burn to CDs or USB sticks for that so if something goes wrong a USB device is probably cheaper than a hard drive.

Also you might want to use linux for that, rather than Windows. That might mean that you can't use your preferred recovery tools, but would need to google "recovery tools linux", but that also means that you're having a different OS, a different file system and some more protection in case you've got a windows specific virus. Or if you really need to you can probably run your recovery tools with wine or in a virtual box or whatnot, but just in general you put a little more protection in between.

Also in case of the simple data types you could also try to display the content and copy that rather than copying the file, which might strip it of additional addatives.

Then you're run it through AVs, virustotal or whatnot and put it on a permanent storage without any OS or programs on it and give all the live systems used in that a full clean. So format everything, overriding and whatnot. Preferrably by another live system.

And ideally you'd still let that sit for some time before you check it in a sandbox on a sacrificial laptop or whatnot again.

Not sure that is 100% safe and that you couldn't find ways to get through that process undetected, but it should already mitigate some risks.