Forums
New posts
Search forums
News
Security News
Technology News
Giveaways
Giveaways, Promotions and Contests
Discounts & Deals
Reviews
Users Reviews
Video Reviews
Support
Windows Malware Removal Help & Support
Inactive Support Threads
Mac Malware Removal Help & Support
Mobile Malware Removal Help & Support
Blog
Log in
Register
What's new
Search
Search titles only
By:
Search titles only
By:
Reply to thread
Menu
Install the app
Install
JavaScript is disabled. For a better experience, please enable JavaScript in your browser before proceeding.
You are using an out of date browser. It may not display this or other websites correctly.
You should upgrade or use an
alternative browser
.
Forums
Security
Malware Analysis
Safely disable internal drive (non-boot)
Message
<blockquote data-quote="sebazzo" data-source="post: 883519" data-attributes="member: 87681"><p>Hi there,</p><p></p><p>my laptop recently got infected by a ransomware. I was able to recoup everything bar a few recent files, so all good. </p><p></p><p>The lead-up to my question: I noticed the infection straight away, shut the laptop down and rebooted in safe mode. There I could see that I caught the ransomware red-handed, the data on D: was only partly encrypted yet.</p><p></p><p>Now, in order to install malwarebytes, I needed to exit safe mode and boot normally. I knew this would re-enable the ransomware for a few minutes, and perhaps encrypt the entire d-drive. I wasn't bothered by that, because I was gonna need to restore the backup anyway. So that's what I did, and yes, those few minutes were sufficient to corrupt all files on D.</p><p></p><p>So my question: In safe mode, is there any way to safely disable an internal drive without having to remove it? </p><p></p><p>Of course in between shutting down from safe mode and rebooting in normal mode I could have opened the laptop and removed the NVMe physically. But I'd like to know whether or not there is a solution on the software side of things.</p><p></p><p>Cheers,</p><p></p><p>Seb</p><p></p><p>Thinkpad P53, i9 RTX4000, Intel NVMe boot drive, Samsung 970 Evo Plus NVMe storage drive, Win 10 Pro</p></blockquote><p></p>
[QUOTE="sebazzo, post: 883519, member: 87681"] Hi there, my laptop recently got infected by a ransomware. I was able to recoup everything bar a few recent files, so all good. The lead-up to my question: I noticed the infection straight away, shut the laptop down and rebooted in safe mode. There I could see that I caught the ransomware red-handed, the data on D: was only partly encrypted yet. Now, in order to install malwarebytes, I needed to exit safe mode and boot normally. I knew this would re-enable the ransomware for a few minutes, and perhaps encrypt the entire d-drive. I wasn't bothered by that, because I was gonna need to restore the backup anyway. So that's what I did, and yes, those few minutes were sufficient to corrupt all files on D. So my question: In safe mode, is there any way to safely disable an internal drive without having to remove it? Of course in between shutting down from safe mode and rebooting in normal mode I could have opened the laptop and removed the NVMe physically. But I'd like to know whether or not there is a solution on the software side of things. Cheers, Seb Thinkpad P53, i9 RTX4000, Intel NVMe boot drive, Samsung 970 Evo Plus NVMe storage drive, Win 10 Pro [/QUOTE]
Insert quotes…
Verification
Post reply
Top