Can you hide partitions from ransomware?

[shmu26]

I am wondering whether Rollback Rx might actually be a convenient way to backup the C drive for recovery from a ransomware attack (and other attacks). This software stores snapshots of the C drive in a hidden partition, and even the free edition makes a new snapshot every day, when you boot. Besides that, it protects MBR from modifications.

Theoretically, ransomware could be programmed to see and encrypt all windows-compatible partitions, even hidden ones. The question is whether known types of ransomware actually do this. If they don't, then rollback seems to be a valid solution.

Please comment.

 

[BoraMurdar]

I think you can, in disk partition manager you can deny write access to partition you select, also you can hide it. Although when you want to store backups on that partition you would need to re-enable writing.

attributes disk set readonly

 

[Wave]

Yeah, follow the advice from @BoraMurdar.

That being said, it won't work for all ransomware, it depends on how it searches for the disks (enumeration), but most just use the normal Win32 APIs and don't do much to identify the hidden ones anyway.

It's a good idea though, you can also change the security descriptor on specific folders to prevent non-administrative processes from touching it (DACL protection); or use a file locker. In fact, you can encrypt files and then most ransomware will leave it alone!

Stay safe and good luck,
Wave.

 

[shmu26]

and what about Rollback Rx specifically? are its recovery partitions pretty well protected?

 

[AtlBo]

What if the drive is USB? If the drive is ejected using the "Remove safely" right click is this a guarantee?

 

[Wave]

If the drive is ejected using the "Remove safely" right click is this a guarantee?

Probably not, since the device is still connected to the system, so even if it wasn't accessible by default than an exploit would do the job. It's better to just unplug your USB if it's not really in-use.

However you can alter the write protection for the removable device; this will prevent ransomware processes from encrypting the files on the drive.

 

[AtlBo]

Thanks. I'll look into options. Maybe a script would help to turn on/off the protection when backup program runs. Not the safest, but must back up sometime. I guess I would have to log into Admin acct to run backup with an associated script.

 

[SHvFl]

Probably not, since the device is still connected to the system, so even if it wasn't accessible by default than an exploit would do the job. It's better to just unplug your USB if it's not really in-use.

However you can alter the write protection for the removable device; this will prevent ransomware processes from encrypting the files on the drive.

Until the malware gets admin access i guess. Maybe, probably, i don't know, i am guessing.

 

[Wave]

Until the malware gets admin access i guess. Maybe, probably, i don't know, i am guessing.

Not even! If it's read-only then being elevated or not should not have an effect.

 

[SHvFl]

Not even! If it's read-only then being elevated or not should not have an effect.

Can't the malware change the setting though if it has admin rights assuming a few security software decide this method of protecting drives is the best and it makes sense to code a workaround?

 

[Wave]

Can't the malware change the setting though if it has admin rights assuming a few security software decide this method of protecting drives is the best and it makes sense to code a workaround?

Somehow it can do this, even myself I am not sure what method it would use... Maybe the feature uses the registry or something - could be monitored and then that analysis could be used to make a circumvention for sure.

 

[Av Gurus]

You can use Secure Folder to set Deny Write (Read Only), Lock or Hide.

 

[509322]

I am wondering whether Rollback Rx might actually be a convenient way to backup the C drive for recovery from a ransomware attack (and other attacks). This software stores snapshots of the C drive in a hidden partition, and even the free edition makes a new snapshot every day, when you boot. Besides that, it protects MBR from modifications.

Theoretically, ransomware could be programmed to see and encrypt all windows-compatible partitions, even hidden ones. The question is whether known types of ransomware actually do this. If they don't, then rollback seems to be a valid solution.

Please comment.

RBRx already does this by allowing access to only the current active snapshot. RBRx is a recovery software via rollback.

If you want the technical infos, then post over at the HDS forum. Sam will explain.

 

[shmu26]

RBRx already does this by allowing access to only the current active snapshot.

sounds good, I wonder why more people don't know about this? It's not a total solution, but it's good for a user who does his new work on C drive, and only stores static data on the other drives. He can make an occasional offline backup for those drives.

 

[AtlBo]

You can use Secure Folder to set Deny Write (Read Only), Lock or Hide.

Looks like it might be what I'm looking for for protecting backup drives. "Trusted Applications" looks so marvelously appropriate HAHA . Thanks.

 

[Anker_by]

You can use Secure Folder to set Deny Write (Read Only), Lock or Hide.

View attachment 128085

Thats great app, i will take a look on it,!!

Edit: You know the official website, or softonic is trusted ?

 

[Av Gurus]

Thats great app, i will take a look on it,!!

Edit: You know the official website, or softonic is trusted ?

This app is abandonware but it works great.
Here is official page where you can download:
Hide, lock, set read-only and no-execution protection to your folders

 

[SHvFl]

Thats great app, i will take a look on it,!!

Edit: You know the official website, or softonic is trusted ?

The product is dead for a while now and official site also died. About softonic i have no clue but some member from here can probably link the original link i guess if you are still interested.

EDIT: They already linked you

 

[509322]

sounds good, I wonder why more people don't know about this? It's not a total solution, but it's good for a user who does his new work on C drive, and only stores static data on the other drives. He can make an occasional offline backup for those drives.

There is another product called Drive Vaccine by HDS. If I recall correctly, the user can protect non-system partitions. Maybe not, I haven't looked recently.