188

Hibernate the computer If the ransomware is encrypting the files, the key it is using for encryption is somewhere in memory. It would be preferable to get a memory dump, but you are unlikely to have the appropriate hardware for that readily available. Dumping just the right process should also work, but finding out which one may not be trivial (eg. the ...


79

What I would do: Suspend the process. Don't kill it, just pause it. Look in the process tree if there are any parents that might need suspending as well. Pull the network cable and/or turn off WiFi (and if you're paranoid, Bluetooth too). Check open files by those processes to see which one it is currently encrypting. If it's a particularly important one, ...


73

This 2013 article analyses retention time for several DRAM chips. Among the relevant information, one may list the following: Retention time depends on a lot of things, including the values of neighbouring bits. A DRAM bit is a potential well, and it loses its contents by moving charges from or into neighbouring areas, so whether there is room in these ...


65

Modern encryption is strong enough that there is no way to retrieve the lost data without the key. Although it's possible that it could be doable in the future in theory, consider that even the cipher 3DES, a trivial modification to a cipher designed nearly half a century ago in the 1970s, cannot be broken in the manner you want, and that was cryptography in ...


58

Ransom-ware (or any encryption software for that matter) will not encrypt the file in-place, because the encrypted filesize will not match the unencrypted filesize bit-for-bit (unless it's just an xor shuffle, in which case it's not really encryption). More importantly, a spontaneous abortion of the encryption process (due to a shutdown, running out of ...


44

There is no "correct" answer to your question, unfortunately. Data retention policies are specific to the needs of an organization, and are often implemented out of necessity to comply with various legal requirements , which vary depending on the nature of the data being stored, as well as the jurisdiction that the data falls under. Retaining log data can ...


39

This depends a lot on what medium is used to store the data and what you consider "irrecoverable". "Deleting" data mostly does not what most people think it does. Simply put, after a standard deletion, the data isn't gone but only the link between "Data XY lies at 0x000000" and the actual storage location 0x000000 is being deleted. Your data is still at ...


31

Every time I updated my iPhone with iTunes, iTunes automatically made a backup of the iPhone. These backups can be checked in: iTunes >> Edit Menu >> Preference >> Devices >> Device backups (Some backups might even be automatically moved to the Recycle bin) Isn't it possible to use one of these backups to restore to a (new) iPhone as ...


21

There are mechanisms that could result in data remanence in DRAM beyond the charge stored in the gates (which is typically gone in seconds, especially at normal elevated operating temperature). One is movement of ionic contaminants which can cause slight shifts in thresholds. This could be the 'burn in' that Tom's answer refers to. There may not be any ...


18

It is not possible to create a digital communication that will self-destruct after a certain amount of time (or upon sender's command). This because of the nature of the message, which once reaches the recipient' machine can be copied at will. This applies to email as well as instant messages. Therefore any service promising you messages that self-...


18

Factory resets reset your phone to a stock like state but does not remove your data, just applications. This leaves some data behind. The best way to prevent this data from being recovered is to encrypt the phone, and use wipe data/factory reset from the recovery menu. This way you don't have to download a ton of data and you can be fairly certain your ...


17

The reason you write '0' instead of '1' has to do with the way magnetic storage encodes the 0 and the 1. a long explanation of it can be found on Wikipedia under Run-length_limited. In short RLL is the methodology used to store the '1' and '0' and it is more complex than just to store the bit values themselves. On a side note to make the drive more like it ...


16

10 Years Storing logs is cheap, more often they're ASCII/UNICODE and easily compressed for long-term archival. Keeping your logs is better than purging for the reasons you can't anticipate. But a minimum, a ten-year retention policy is an industry best practice for US-based businesses since the federal statute of limitations and in most states is a ...


14

This is enough, or not, depending on the disk technology, the budget of the attacker, and some other details. When you fill a disk with zeros, you force the filesystem to reuse free blocks, and rewrite them. So, as first order approximation, this looks good for you: your file contents are overwritten. However, there are details: On some operating systems ...


14

[Mod Note: This answer is receiving a lot of flags, but is not worthy of deletion. This is a potentially valid course of action, though risky and potentially illegal in some jurisdictions. From a technical standpoint, this has a chance of being a way to preserve the data. Please see Meta for further discussion.] The best thing to do is nothing. Doing ...


13

The purpose of a TPM module is to ensure that there is absolutely no way to obtain the keys stored on it. Whether or not it actually fulfills that purpose is a topic for another question. For now let's assume that it works as designed. That means when the TPM module is destroyed, so is the key, and so is any hope to decrypt the data encrypted with it. ...


12

I feel like random people on the internet are not going to be able to answer this for you. This is a business decision. How valuable is the data? What is the risk of loss / corruption vs the cost of more disk space? Imagine your worst disaster-recovery scenario, how far back would you need to go to get a clean snapshot? I certainly can't answer any of this ...


12

The second question may generate a lot of opinions as answers. I will focus on the first question. What do you do to stop a potential ransomed encryption in progress? Steps: Un-plug your machine from the internet immediately. Use another machine for your internet searches for solutions. Shut down the affected machine with a cold power-down. Do not wait ...


11

There are any number of different ways it can be done. In large part, the easiest way is following the link pointers to each of the chunks, but that isn't the only way by any means. (The MFT isn't the only source of those links in many file systems as well.) At a lower level, it can identify all the chunks and try to match some of them up on content if the ...


11

As a former developer for one of the biggest Security Card System organizations in the world, I can confirm with you that the answer is resounding YES depending on the manufacturer and the type of the card. For example, my company used the standard ISO encoding standard for magnetic stripes for Debit cards, and quite frankly there is not much confidential ...


11

summary If you decap the dies, you can. The pads exist but are not bonded but available. The reason that you can get the information is that the timers that are used to inject and tunnel the floating gates do not push the data hard against the voltage rails. If the hardware supported a "tunneling on forever" type of control word, you could like ...


11

While the current leading answer dives into the technical details of data recovery, I will (try to) take the broader approach. How do we define "irrecoverable"? Depending on the circle you may associate with, "irrecoverable" could mean only some insignificant portion of the data is recoverable. While I don't practice law, this could prove "sufficient" as ...


10

Self-destructing emails, like email read receipts and mail services which tell you they can tell you which recipients have read your message and which have not, are at best misleading and at worse a con perpetrated on ignorant managers, executives and users who don't understand how email works. In general, all of these schemes rely on the recipient buying ...


10

I don't know why you say that SSDs implement ATA Security Erase improperly. Modern ones implement it using SED (which uses an encryption key known to the drive and stored in non-volatile memory for all your data, allowing it to simply erase the key to instantly render data unreadable), while others mark all sectors for being TRIMed, which should effectively ...


10

The Gutmann method is not useful for any modern device, whether a hard drive or a solid state drive. The fact that you cannot safely wipe a solid state drive due to wear leveling is irrelevant. For any modern hard drive, the best way to erase data on it is to wipe it once with a random pattern. For modern solid state drives, there is no effective way to wipe ...


9

If you're talking about modern hard disks (spinning platters, magnetic data), then it doesn't matter what is written as long as something is written. The NIST Special Publication 800-88 Rev 1 contains the relevant guidelines. It's updated and talks about different types of media. Now they do say that the overwrite should be verified (because maybe something ...


9

There are a few ways to solve this situation. One is to have the camera always encrypt one of the session keys to a camera backup key. The camera backup key is generated on account setup of the camera and a password is generated that is used to encrypt the backup key. This password is never stored on the camera itself. Your online storage would store the ...


9

Shut the computer down immediately. Provided you're not about to pay the ransom, any data that the virus is processing is lost anyway. So just push down the power button and hold it, or unplug the wire. Install Ubuntu or another portable Linux distribution onto your USB stick. Last time I did this it did fit on 2GB stick. I was cloning my HDD to SSD with ...


8

Usually Factory Reset is probably enough for removing almost all data stored internally by the Android phone. Menu> Settings> Privacy> Factory data reset> Erase phone storage Un-tick backup if not necessary. To be double sure(Extra paranoid mode): Do the Factory reset and then Menu> Settings> Security> Encrypt phone> Encrypt phone(...


8

Did a test with three different cards. Card 1 (Non-Chipped MC Pre-Paid) Swiped the card through a USB Magtek MSR Reader, and noted results. Got a clean Track 1 and Track 2 data. Cut the card vertically straight down the middle into a left piece and right piece. Took each piece and tried swiping through the card reader. Would only get an %E?;E? which is ...


Only top voted, non community-wiki answers of a minimum length are eligible