Reply to thread

Message

<blockquote data-quote="HeiDef" data-source="post: 617544" data-attributes="member: 60542">1) Correct.&nbsp; MBR protection right now is per drive not per partition so multi partition drives are not fully covered.2) There is file restoration but let me explain a bit how it works.&nbsp; It is not system wide.&nbsp; Every change to every file from every process is not restorable.&nbsp; Instead RansomOff, through its detection heuristics, decides if a file should be saved before a change is made.&nbsp; Right now, only processes that have thrown an alert (i.e. ransomware) will have any files that were modified restored.&nbsp; If a process did not cause an alert and closes, the cache of files associated with that process are purged.&nbsp; The default setting is to do the restoration automatically however it can be changed to manual.&nbsp; That is why, when you goto the Restore form in the UI, you likely won&#039;t see any processes or files listed. That&#039;s because a) no ransomware was detected, b) no files were actually modified by the ransomware, or c) the files have already been restored and cleared from the cache.&nbsp; You can see a record of the cleanup and restoration in the Alerts (must click &#039;View All Sessions&#039; checkbox to view cleanup messages).&nbsp; So file restoration is there but done differently than other solutions in order to allow RansomOff to be as efficient as possible without using a lot of system resources.3) Latest build from today (5.2017.99.6252) adds confirmation message.</blockquote>

[QUOTE="HeiDef, post: 617544, member: 60542"] 1) Correct. MBR protection right now is per drive not per partition so multi partition drives are not fully covered. 2) There is file restoration but let me explain a bit how it works. It is not system wide. Every change to every file from every process is not restorable. Instead RansomOff, through its detection heuristics, decides if a file should be saved before a change is made. Right now, only processes that have thrown an alert (i.e. ransomware) will have any files that were modified restored. If a process did not cause an alert and closes, the cache of files associated with that process are purged. The default setting is to do the restoration automatically however it can be changed to manual. That is why, when you goto the Restore form in the UI, you likely won't see any processes or files listed. That's because a) no ransomware was detected, b) no files were actually modified by the ransomware, or c) the files have already been restored and cleared from the cache. You can see a record of the cleanup and restoration in the Alerts (must click 'View All Sessions' checkbox to view cleanup messages). So file restoration is there but done differently than other solutions in order to allow RansomOff to be as efficient as possible without using a lot of system resources. 3) Latest build from today (5.2017.99.6252) adds confirmation message. [/QUOTE]

Verification