Skip to main content
Share Your Experience: Take the 2024 Developer Survey
188 votes
Accepted

What should you do if you catch encryption ransomware mid-operation?

Hibernate the computer If the ransomware is encrypting the files, the key it is using for encryption is somewhere in memory. It would be preferable to get a memory dump, but you are unlikely to have ...
Ángel's user avatar
  • 18.9k
79 votes

What should you do if you catch encryption ransomware mid-operation?

What I would do: Suspend the process. Don't kill it, just pause it. Look in the process tree if there are any parents that might need suspending as well. Pull the network cable and/or turn off WiFi (...
Luc's user avatar
  • 32.9k
64 votes
Accepted

Is there any hope of getting my pictures back after an iPhone factory reset some day in the future?

Modern encryption is strong enough that there is no way to retrieve the lost data without the key. Although it's possible that it could be doable in the future in theory, consider that even the cipher ...
forest's user avatar
  • 66.8k
58 votes

What should you do if you catch encryption ransomware mid-operation?

Ransom-ware (or any encryption software for that matter) will not encrypt the file in-place, because the encrypted filesize will not match the unencrypted filesize bit-for-bit (unless it's just an xor ...
J.J's user avatar
  • 785
51 votes
Accepted

How can data from VirtualBox leak to the host and how to avoid it?

You are doing it the wrong way around: you have an untrusted host system running a hypervisor and you are trying to run a trusted environment inside this untrusted host. But, the untrusted host system ...
Steffen Ullrich's user avatar
44 votes
Accepted

Should we keep logs forever to investigate past data breaches?

There is no "correct" answer to your question, unfortunately. Data retention policies are specific to the needs of an organization, and are often implemented out of necessity to comply with various ...
John's user avatar
  • 769
40 votes

At what point is deleted data irrecoverable?

This depends a lot on what medium is used to store the data and what you consider "irrecoverable". "Deleting" data mostly does not what most people think it does. Simply put, after a standard ...
dmuensterer's user avatar
  • 1,184
31 votes

Is there any hope of getting my pictures back after an iPhone factory reset some day in the future?

Every time I updated my iPhone with iTunes, iTunes automatically made a backup of the iPhone. These backups can be checked in: iTunes >> Edit Menu >> Preference >> Devices >> ...
Henk Groot's user avatar
29 votes

How can data from VirtualBox leak to the host and how to avoid it?

The data didn't "leak" onto the host. The data always was on the host to begin with. The files inside the guest are stored in the virtual hard drive file, and the virtual hard drive file is ...
Tanner Swett's user avatar
16 votes
Accepted

What happens when a TPM chip breaks or fails?

The purpose of a TPM module is to ensure that there is absolutely no way to obtain the keys stored on it. Whether or not it actually fulfills that purpose is a topic for another question. For now let'...
Philipp's user avatar
  • 49.4k
16 votes

Should we keep logs forever to investigate past data breaches?

10 Years Storing logs is cheap, more often they're ASCII/UNICODE and easily compressed for long-term archival. Keeping your logs is better than purging for the reasons you can't anticipate. But a ...
123456789123456789123456789's user avatar
14 votes

What should you do if you catch encryption ransomware mid-operation?

[Mod Note: This answer is receiving a lot of flags, but is not worthy of deletion. This is a potentially valid course of action, though risky and potentially illegal in some jurisdictions. From a ...
Dasya's user avatar
  • 441
12 votes

What should you do if you catch encryption ransomware mid-operation?

The second question may generate a lot of opinions as answers. I will focus on the first question. What do you do to stop a potential ransomed encryption in progress? Steps: Un-plug your machine ...
Brent Kirkpatrick's user avatar
12 votes
Accepted

How many backups should I keep?

I feel like random people on the internet are not going to be able to answer this for you. This is a business decision. How valuable is the data? What is the risk of loss / corruption vs the cost of ...
Mike Ounsworth's user avatar
11 votes

At what point is deleted data irrecoverable?

While the current leading answer dives into the technical details of data recovery, I will (try to) take the broader approach. How do we define "irrecoverable"? Depending on the circle you may ...
dark_st3alth's user avatar
  • 3,022
10 votes

How to erase as much as possible an SSD without ATA Secure Erase?

I don't know why you say that SSDs implement ATA Security Erase improperly. Modern ones implement it using SED (which uses an encryption key known to the drive and stored in non-volatile memory for ...
guest's user avatar
  • 246
10 votes
Accepted

Is GNU shred relevant for SSDs?

The Gutmann method is not useful for any modern device, whether a hard drive or a solid state drive. The fact that you cannot safely wipe a solid state drive due to wear leveling is irrelevant. For ...
forest's user avatar
  • 66.8k
10 votes
Accepted

Recovery of EEPROM data after bulk erase operation

summary If you decap the dies, you can. The pads exist but are not bonded but available. The reason that you can get the information is that the timers that are used to inject and tunnel the ...
b degnan's user avatar
  • 536
9 votes

What happens when a TPM chip breaks or fails?

If the TPM 'breaks' or becomes otherwise inaccessible, all cryptography dependent on keys stored by the TPM also breaks. This is the most concise and inclusive way I could think to put it. I say '...
Wilbur Whateley's user avatar
9 votes

What should you do if you catch encryption ransomware mid-operation?

Shut the computer down immediately. Provided you're not about to pay the ransom, any data that the virus is processing is lost anyway. So just push down the power button and hold it, or unplug the ...
Tomáš Zato's user avatar
  • 1,248
8 votes
Accepted

Magnet to wipe HDD

Short answer: That won't work. You'll need to degauss it, which will render the drive unusable. Long answer: Sure. Get a powerful magnet, put it next to the hard drive, with N facing the drive. ...
forest's user avatar
  • 66.8k
8 votes
Accepted

Is tails os susceptible to a cold boot attack?

Could malware interfere with the wiping process? If there is malware present on the system, then yes, it will be able to interfere with the memory wiping process. If a malicious process spawns many ...
forest's user avatar
  • 66.8k
8 votes

What should you do if you catch encryption ransomware mid-operation?

In addition to the shutdown & copy approach others have mentioned there's another factor: The ransomware wants to hide what's going on until it's finished it's evil--thus the encrypted files are ...
Loren Pechtel's user avatar
8 votes

Should we keep logs forever to investigate past data breaches?

Storing these log files indefinitely MAY BE illegal in the EU. I am saying MAY BE, since the new data protection legislative comes into effect in May 2018 and there are still some unclear areas. ...
MikiRaven's user avatar
8 votes

Is there any hope of getting my pictures back after an iPhone factory reset some day in the future?

Modern smartphones encrypt data backed by Trusted Execution Environment (TEE). TEE stores keying material that is used together with master key and screen lock code to derive a key that encrypts and ...
defalt's user avatar
  • 6,861
7 votes
Accepted

SSD is formatted twice and filled twice. Can i recover old deleted data?

Given the information that you have rewritten all ssd contents twice with true random data to the brim I'd say No, you cannot recover any data from that disk. This is the sane answer to give to ...
BlueWizard's user avatar
6 votes

How to tell if an email is encrypted, or just corrupted?

They are standards for encryption of mails, notable S/MIME and PGP. There is defined how the encrypted message gets encapsulated so that the mail client knows that it is encrypted. These ...
Steffen Ullrich's user avatar
6 votes

My local certificates may have been compromised. What to do now?

If you think an attacker has had unauthorised access to your system, the only way to be sure that you've removed the infection is to rebuild the system completely from trusted media. Whilst you may ...
Rory McCune's user avatar
  • 62.3k
6 votes
Accepted

Why can't you and how to take a picture from infected computer?

I would recommend downloading a live Linux distribution (Ubuntu is great for this), create a bootable USB device on a clean computer, and booting your infected computer with this USB drive. With ...
ThoriumBR's user avatar
  • 54.4k
6 votes

At what point is deleted data irrecoverable?

On many kinds of magnetic disk drives, overwriting a sector even once with random data is likely to render the data permanently irrecoverable even with advanced forensic techniques. A variety of ...
supercat's user avatar
  • 2,059

Only top scored, non community-wiki answers of a minimum length are eligible