Advice Request Macrium Reflect versus Ransomware

Please provide comments and solutions that are helpful to the author of this topic.

shmu26

Level 85
Thread author
Verified
Honorary Member
Top Poster
Content Creator
Well-known
Forum Veteran
Jul 3, 2015
8,148
1
31,237
8,388
Middle Earth
Macrium Reflect (paid version) has a feature called "Macrium Image Guardian" that prevents any process other than Macrium Reflect from touching your backup files. This is supposed to save them from getting encrypted by ransomware.
Does anyone know how effective it is, and whether it has been tested?
 
Unfortunately I use the free version and I don't know about this function but, and sorry for the off topic, I think the best way to protect your backup from a ransomware attack, is saving it on offline and external support.
Surely MIG will be a solid feature but it is a local approach, and you never know what could happen to your local backup.
 
I was just about to ask, where are your back up files stored because i would have thought they should be stored externally to prevent them from being encrypted.
I've never used Macrium so can't answer your question but i know that for me using Aomei, my back up is stored on an external device which is not connected to pc unless i'm using it for something.
 
I have eternally stored backups that I make every week or so, and other more recent ones stored on an internal hard disk. I am happy for any protection I can get on the internally stored backups. They aren't mission-critical, but they are helpful.
 
I have eternally stored backups that I make every week or so, and other more recent ones stored on an internal hard disk. I am happy for any protection I can get on the internally stored backups. They aren't mission-critical, but they are helpful.
I think it's an advantage, because if you don't have an external disk, you're sure that way there's no danger, that nothing will affect it, to your backup.
 
I have eternally stored backups that I make every week or so, and other more recent ones stored on an internal hard disk. I am happy for any protection I can get on the internally stored backups. They aren't mission-critical, but they are helpful.
Don't know how good macrium reflect guardian is as i stopped using it but consider using secure folders (lock the location and add in trusted reflectbin.exe) or wd protected folders to secure the backup location some more (again add reflectbin.exe in allowed apps).
Ps i remember macrium was securing the files well in standard permission but forgot how it behaved if you have admin rights.
 
It's fundamental to protect backup files against ransomware but also against other types of threat. I think this feature of Macrium is great, but if you use for example Zemana, which has strong real-time protection against ransomware samples can stop malicious processes before the encryption starts.
 
I take a daily Macrium Reflect image to HDD that stays connected to my computer, and then take a weekly image to an external HDD that stays offline and separate from my computer except for when taking the image. To be 100% safe I suppose I cound unplug that 1st backup drive when connecting the 2nd one.
 
  • Like
Reactions: Weebarra
I don't know how good is MIG facing a real ransomware threat, but it is impossible to delete any of the images unless MIG is disabled. I use it even though all my hard drives are external, I don't keep any data on my computer...
 
  • Like
Reactions: Tutman and upnorth