8

While reading about ways to recover from a ransomware on a Windows machine it's often recommended to use the System Restore functionality, e.g. to restore from a Restore Point.

I know that the Restore Points are located in the hidden System Volume Information folder on the root of the C: drive. If enabled, will it "survive" a ransomware? By default, only SYSTEM is permitted on that folder, but there are ways to grant permissions to basically any user using the built-in cacls command?

Improve this question
7
  • 2
    I wouldn't recommend trusting a system on which malware ran even if you manage to restore it to an usable state.
    – André Borie
    Mar 2, 2017 at 10:33
  • @AndréBorie would you than trust the backup that was made shortly before the impact ?
    – cyzczy
    Mar 2, 2017 at 14:11
  • 4
    Keep in mind that restore points are not full-system backups: they are backups of core system data, e.g. registry data. Most ransomware will leave core OS files alone, at least enough so you can run the system and cough up some bitcoins. Your user data is not part of a restore point and is very likely to be encrypted.
    – user53736
    Mar 2, 2017 at 15:06
  • @Snowman but if I'm not mistaken you can configure System Protection to restore system setting and previous versions of files . . .
    – cyzczy
    Mar 2, 2017 at 20:55
  • @adam86 previous versions of files such as device drivers, system libraries/executables, and other files you might find in the "windows" directory and subdirectories.
    – user53736
    Mar 2, 2017 at 20:59

2 Answers 2

Reset to default
11

Some ransomware do compromise system restore points, others don't. To do it, they would need to have admin priveliges. But it is not at all unimaginable that malware would have that.

So should you rely on system restore points stored on your hard drive as protections against malware before the infection? Absolutely not! You need to have an external backup.

But could you rely on them to restore lost data after an infection, if you have no other backups? Yes, possibly, but only as a last resort. Be aware that your system may still be infected even after the restoration if the ransomware has infected the system image (or the ransomware could simply have encrypted them as well). You might also want to try to identify the ransomware, and do some research to figure out if that particular strand of malware compromise system restore points or not.

Also, as Tsar points out, system restore points don't contain user data most of the time. So you might not get much back from them.

Improve this answer
1
  • 6
    System restore points most of the time doesn't contain user data, tho.
    – T. Sar
    Mar 2, 2017 at 17:27
5

Maybe, maybe not. It depends on the ransomware. There is no such thing as the ransomware. Each one of these annoying pests uses different methods to make a system unusable and they get constantly improved. Whatever a specific ransomware does, it might still allow a system restore or it might also destroy or disable this functionality.

The only effective precaution against ransomware are complete system backups on a physically separated systems.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .