Reply to thread

Message

<blockquote data-quote="sebazzo" data-source="post: 883519" data-attributes="member: 87681">Hi there,my laptop recently got infected by a ransomware. I was able to recoup everything bar a few recent files, so all good. The lead-up to my question: I noticed the infection straight away, shut the laptop down and rebooted in safe mode. There I could see that I caught the ransomware red-handed, the data on D: was only partly encrypted yet.Now, in order to install malwarebytes, I needed to exit safe mode and boot normally. I knew this would re-enable the ransomware for a few minutes, and perhaps encrypt the entire d-drive. I wasn&#039;t bothered by that, because I was gonna need to restore the backup anyway. So that&#039;s what I did, and yes, those few minutes were sufficient to corrupt all files on D.So my question: In safe mode, is there any way to safely disable an internal drive without having to remove it? Of course in between shutting down from safe mode and rebooting in normal mode I could have opened the laptop and removed the NVMe physically. But I&#039;d like to know whether or not there is a solution on the software side of things.Cheers,SebThinkpad P53, i9 RTX4000, Intel NVMe boot drive, Samsung 970 Evo Plus NVMe storage drive, Win 10 Pro</blockquote>

[QUOTE="sebazzo, post: 883519, member: 87681"] Hi there, my laptop recently got infected by a ransomware. I was able to recoup everything bar a few recent files, so all good. The lead-up to my question: I noticed the infection straight away, shut the laptop down and rebooted in safe mode. There I could see that I caught the ransomware red-handed, the data on D: was only partly encrypted yet. Now, in order to install malwarebytes, I needed to exit safe mode and boot normally. I knew this would re-enable the ransomware for a few minutes, and perhaps encrypt the entire d-drive. I wasn't bothered by that, because I was gonna need to restore the backup anyway. So that's what I did, and yes, those few minutes were sufficient to corrupt all files on D. So my question: In safe mode, is there any way to safely disable an internal drive without having to remove it? Of course in between shutting down from safe mode and rebooting in normal mode I could have opened the laptop and removed the NVMe physically. But I'd like to know whether or not there is a solution on the software side of things. Cheers, Seb Thinkpad P53, i9 RTX4000, Intel NVMe boot drive, Samsung 970 Evo Plus NVMe storage drive, Win 10 Pro [/QUOTE]

Verification