Thinking about the threat posed by ransomware, the defense that makes the most sense to me is to have a secure copy, and an automated way to restore protected files. Ordinary backups are not really secure, because the ransomware could just as easily target your backups. Even network based backup isn't perfect, because the ransomed files are likely to be automatically backed up and supersede the valuable files. And anyway, backup of "valuable" files in the same stream as all the other routine stuff isn't perfect.

Is there any existing product that will (a) automatically make copies of designated files folders (b) audit the live files against the archive, looking for any kind of damage (not only ransomware).

  • this would be trivial to create if it doesn't exist, even with just a few shell scripts...
    – dandavis
    Jul 4 '17 at 21:07
  • Depending on the type of files, you could keep them in the cloud only and not on your drive. Use Google Drive for example and work with your files (if they're office-like) in the browser as much as possible.
    – Chris
    Jul 4 '17 at 21:10
  • 1
    This is why tape backup is still a thing. Also filesystem ACLs with append but not overwrite permissions. This seems like a solved problem. Jul 4 '17 at 23:38
  • i still burn documents to dvdr every month. call me old-fashioned, but it's saved my rear twice.
    – dandavis
    Jul 5 '17 at 19:45
  • there are any number of ad-hoc things you can do to protect your data. I'm looking for a turnkey solution specifically targeted to be a digital archive of self-designated important files.
    – ddyer
    Jul 5 '17 at 20:32

A good option is to backup to a remote system which regularly creates unmodifiable snapshots of the filesystem, which cannot be changed/deleted with the same credentials used to access the files.

I use FreeNAS for storing my personal files, and every 15min a snapshot of the ZFS volume is created on the server.

The account used to access the files can also be used to browse and restore old versions, but to delete a snapshot different credentials are needed which are not stored on my PCs.

The important part is: using the credentials stored on the PC (which are used to access the current version of the files and change them) it is not possible to delete snapshots.

But remember: Even a RAID system with scheduled automated snapshots cannot replace backups!

  • I also use a NAS that I periodically tar to AWS. It is set up so that the files go to S3 and from there to Glacier. If attackers stole the credentials from the NAS, they would be able to delete the current S3 version but not the Glacier copy. You could skip the NAS and go straight to S3. Backing up also protects against computer loss, dunking it in water, and other accidents.
    – Hbar
    Nov 26 '17 at 3:17

I'm not too sure about Windows, but for the home/single-use Linux box, there's "borgbackup" that does a great job.

All backups can be encrypted (though, unlike with "duplicity", borg does not use a GPG key; it's a symmetric key you need to supply either at a prompt or via an env var).

The best part is if you have a server, you can push your backups there, and you can set up the server to run in "append-only" mode (using standard ~/.ssh/authorized_keys techniques). Absolutely nothing on the client side will then be able to tamper with already created data.

I use this, and I keep an eye on the amount of "new" data sent over every day. Combined with what I know about "how much work did I do", this gives me a very crude way to catch any large scale changes, such as might happen with a ransomware attack.

(That is over and above all the other crazy things I do to keep different pieces of software separated, such as my mail, my casual browsing, and my "authenticated" browsing. I honestly don't think I'll ever get hit, but no harm adding an extra "warning" layer!)


First of all, every no-shit backup software will support differential or incremental backups with history. Thus, the "ransomed files will supersede valuable files" problem does not appear, nor can ransomware target backups if the computer doesn't have the credentials to access the network share outside the backup program.
The commercial backup software that I use now (Paragon) supports saving to a SMB share given its own username and password, and the FOSS software that I used before (redo) did as well, and I assume every no-shit backup software does. No access to share, no luck for malware.

Second, there exist media (notably DVD/BluRay) which are by design write-once. That means none more and none less than it sucks for general usage because you cannot reuse the medium after having written to it once (except for appending multi-session). But it also means that no matter how advanced malware gets in the future, malware cannot overwrite it. That's simply not supported by the medium.
One may be inclined to believe that the 25GiB that will fit on a BluRay are not nearly enough to hold all valuable data. You will be surprised how little of your valuable data is truly valuable and unreplaceable. Backup to BluRay is entirely feasible.

Is ransomware really such a problem? I don't know, judging from the amount of people concerned with it, it would appear to be that way, but I honestly don't know. I've been working with computers almost every day since the mid-1980s, and I've been using the internet before most people had even heard this thing existed. So far, I've had zero malware-related incidents on any computer I owned.
It's certainly not a mistake to have a backup just in case (and sure enough I do have one), but first and foremost you should make sure it doesn't get necessary to have one.


looking for any kind of damage (not only ransomware)

Detecting if the entire file is encrypted is trivial (there's even a MSWindows version). However something which encrypts the entire filesystem would be hard to detect automatically (but the impact very obvious).

Something which encrypts or damages partial content inside a file would be very difficult to differentiate from a normal user edit (lots of file formats are actually containers with multiple individual files inside - e.g. Adobe PDF, Microsoft Office). Analyzing the frequency distribution of characters (or tokens if you have a parser) can give more heuristic detection if the file is not compressed.

There is a lot of activity aimed at detecting ransomware by its pattern of file access (frequency of file renaming, file changes, directory crawling access).

A fairly simple solution is to monitor a small collection of files in the root and at the bottom of the directory tree (i.e. the places where malware will strike first) on a dedicated share as canaries. If these files are updated (without action by a user) then you know there's probably malware at work. Any host based IDS should be capable of this.

Ordinary backups are not really secure, because the ransomware could just as easily target your backups

If your "Ordinary backups" are available online then yes - but that's why we use tapes, optical drives and virtual tapes.

Is there any existing product

"Questions seeking product recommendations are off-topic as they become obsolete quickly"

(a) automatically make copies of designated files folders

Yes, there are lots of file copying and backup programs.

audit the live files against the archive

See above.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.