188
votes
Accepted
What should you do if you catch encryption ransomware mid-operation?
Hibernate the computer
If the ransomware is encrypting the files, the key it is using for encryption is somewhere in memory. It would be preferable to get a memory dump, but you are unlikely to have ...
- 18.8k
78
votes
What should you do if you catch encryption ransomware mid-operation?
What I would do:
Suspend the process. Don't kill it, just pause it.
Look in the process tree if there are any parents that might need suspending as well.
Pull the network cable and/or turn off WiFi (...
- 32.7k
64
votes
Accepted
Is there any hope of getting my pictures back after an iPhone factory reset some day in the future?
Modern encryption is strong enough that there is no way to retrieve the lost data without the key. Although it's possible that it could be doable in the future in theory, consider that even the cipher ...
- 66.5k
58
votes
What should you do if you catch encryption ransomware mid-operation?
Ransom-ware (or any encryption software for that matter) will not encrypt the file in-place, because the encrypted filesize will not match the unencrypted filesize bit-for-bit (unless it's just an xor ...
- 785
51
votes
Accepted
How can data from VirtualBox leak to the host and how to avoid it?
You are doing it the wrong way around: you have an untrusted host system running a hypervisor and you are trying to run a trusted environment inside this untrusted host. But, the untrusted host system ...
- 198k
44
votes
Accepted
Should we keep logs forever to investigate past data breaches?
There is no "correct" answer to your question, unfortunately. Data retention policies are specific to the needs of an organization, and are often implemented out of necessity to comply with various ...
- 769
40
votes
At what point is deleted data irrecoverable?
This depends a lot on what medium is used to store the data and what you consider "irrecoverable".
"Deleting" data mostly does not what most people think it does.
Simply put, after a standard ...
- 1,144
31
votes
Is there any hope of getting my pictures back after an iPhone factory reset some day in the future?
Every time I updated my iPhone with iTunes, iTunes automatically made a backup of the iPhone. These backups can be checked in:
iTunes >> Edit Menu >> Preference >> Devices >> ...
- 411
29
votes
How can data from VirtualBox leak to the host and how to avoid it?
The data didn't "leak" onto the host. The data always was on the host to begin with. The files inside the guest are stored in the virtual hard drive file, and the virtual hard drive file is ...
- 391
19
votes
Accepted
Securely erasing personal data from Android phone before selling
Factory resets reset your phone to a stock like state but does not remove your data, just applications. This leaves some data behind. The best way to prevent this data from being recovered is to ...
- 7,006
16
votes
Accepted
What happens when a TPM chip breaks or fails?
The purpose of a TPM module is to ensure that there is absolutely no way to obtain the keys stored on it. Whether or not it actually fulfills that purpose is a topic for another question. For now let'...
- 49.3k
16
votes
Should we keep logs forever to investigate past data breaches?
10 Years
Storing logs is cheap, more often they're ASCII/UNICODE and easily compressed for long-term archival.
Keeping your logs is better than purging for the reasons you can't anticipate.
But a ...
13
votes
What should you do if you catch encryption ransomware mid-operation?
[Mod Note: This answer is receiving a lot of flags, but is not worthy of deletion. This is a potentially valid course of action, though risky and potentially illegal in some jurisdictions. From a ...
- 439
12
votes
Accepted
How many backups should I keep?
I feel like random people on the internet are not going to be able to answer this for you. This is a business decision. How valuable is the data? What is the risk of loss / corruption vs the cost of ...
- 58.8k
12
votes
What should you do if you catch encryption ransomware mid-operation?
The second question may generate a lot of opinions as answers. I will focus on the first question. What do you do to stop a potential ransomed encryption in progress?
Steps:
Un-plug your machine ...
11
votes
Accepted
Could data be recovered from cut magnetic stripe card?
As a former developer for one of the biggest Security Card System organizations in the world, I can confirm with you that the answer is resounding YES depending on the manufacturer and the type of the ...
- 420
11
votes
At what point is deleted data irrecoverable?
While the current leading answer dives into the technical details of data recovery, I will (try to) take the broader approach.
How do we define "irrecoverable"?
Depending on the circle you may ...
- 3,032
10
votes
How to erase as much as possible an SSD without ATA Secure Erase?
I don't know why you say that SSDs implement ATA Security Erase improperly. Modern ones implement it using SED (which uses an encryption key known to the drive and stored in non-volatile memory for ...
- 246
10
votes
Accepted
Is GNU shred relevant for SSDs?
The Gutmann method is not useful for any modern device, whether a hard drive or a solid state drive. The fact that you cannot safely wipe a solid state drive due to wear leveling is irrelevant. For ...
- 66.5k
10
votes
Accepted
Recovery of EEPROM data after bulk erase operation
summary
If you decap the dies, you can. The pads exist but are not bonded but available. The reason that you can get the information is that the timers that are used to inject and tunnel the ...
- 536
9
votes
Securely erasing personal data from Android phone before selling
Usually Factory Reset is probably enough for removing almost all data stored internally by the Android phone.
Menu> Settings> Privacy> Factory data reset> Erase phone storage
Un-tick ...
- 856
9
votes
What should you do if you catch encryption ransomware mid-operation?
Shut the computer down immediately. Provided you're not about to pay the ransom, any data that the virus is processing is lost anyway. So just push down the power button and hold it, or unplug the ...
- 1,246
9
votes
What happens when a TPM chip breaks or fails?
If the TPM 'breaks' or becomes otherwise inaccessible, all cryptography dependent on keys stored by the TPM also breaks. This is the most concise and inclusive way I could think to put it.
I say '...
- 608
8
votes
Accepted
Is tails os susceptible to a cold boot attack?
Could malware interfere with the wiping process?
If there is malware present on the system, then yes, it will be able to interfere with the memory wiping process. If a malicious process spawns many ...
- 66.5k
8
votes
Accepted
Magnet to wipe HDD
Short answer:
That won't work. You'll need to degauss it, which will render the drive unusable.
Long answer:
Sure. Get a powerful magnet, put it next to the hard drive, with N facing the drive. ...
- 66.5k
8
votes
Could data be recovered from cut magnetic stripe card?
Did a test with three different cards.
Card 1 (Non-Chipped MC Pre-Paid)
Swiped the card through a USB Magtek MSR Reader, and noted results. Got a clean Track 1 and Track 2 data.
Cut the card ...
- 341
8
votes
What should you do if you catch encryption ransomware mid-operation?
In addition to the shutdown & copy approach others have mentioned there's another factor: The ransomware wants to hide what's going on until it's finished it's evil--thus the encrypted files are ...
- 773
8
votes
Should we keep logs forever to investigate past data breaches?
Storing these log files indefinitely MAY BE illegal in the EU. I am saying MAY BE, since the new data protection legislative comes into effect in May 2018 and there are still some unclear areas. ...
- 81
8
votes
Is there any hope of getting my pictures back after an iPhone factory reset some day in the future?
Modern smartphones encrypt data backed by Trusted Execution Environment (TEE). TEE stores keying material that is used together with master key and screen lock code to derive a key that encrypts and ...
- 6,751
6
votes
How to tell if an email is encrypted, or just corrupted?
They are standards for encryption of mails, notable S/MIME and PGP. There is defined how the encrypted message gets encapsulated so that the mail client knows that it is encrypted. These ...
- 198k
Only top scored, non community-wiki answers of a minimum length are eligible