In the process of trying to recover data in bulk from what I assumed was a failing hard drive, Windows Security kindly notified me it had found a handful of malicious items among the recovered files. I immediately nuked that secondary drive, but for a few items it reported either "Remediation Failed" or "Item removed or restored from quarantine".

I did a full scan, then an offline scan, and a full scan in safe mode with Security Scanner, all of which found nothing. I have not seen any symptoms that match the items it detected, and have read that those two concerning reports are a common artifact of manually deleting items it found.

My finger is hovering over the "nuke it from orbit" button anyway, but for now I think this an interesting question: Obviously nothing can guarantee it, but what tools, techniques, or combinations thereof that can produce a higher confidence than just running Microsoft's tools in sequence? Perhaps some combination of tools run on a Linux CD/USB?

  • Though recent events inspired me to ask this question, i'm much more curious about the theory behind it than the practicality of the solutions. Though killing it with fire is the only way to be sure, i'm curious what if any tactics exist for risk minimization when that isn't possible or practical. – abraxian Cataract Jan 25 '20 at 2:48

If you want a guarantee, go back to scratch. Nuke the disk and reinstall from source media.

There are too many things that can't be "cleaned" using any tools.

When we want to see the contents of an untrusted hard drive, we spin up a clean VM (free stuff, look at virtualbox). We attach the drive to the VM, recover the files we know are safe. Run any kind of necessary scanning in the VM. Finally, transfer them to the host OS. Then nuke the VM and start again (or restore from the snapshot).

Hope that helps.

  • Of course that's probably what i'm gonna end up doing, I was just curious if there was anything in-between a scan vs a nuke in effectiveness, seems like a pretty wide confidence gap that i'd be very surpised if nobody has filled. Using a VM to safely get at the files I need is a good idea though! – abraxian Cataract Jan 25 '20 at 4:02
  • Yeah - basically if none of the AV / security tools you've ran have found any new problems, then you're probably not going to find any problems. It's unlikely an old hard drive has new zero days on it. I'd think you were pretty safe with what you've done. BUT you'll NEVER KNOW and if that bugs you, then you're going to have to wipe. :-) – Jonathan Jan 25 '20 at 7:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.