Can I turn my External HDD off and on to prevent a ransom attack?

chuckiechan · 12 Oct 2016

I usually leave my external back up drive disconnected except on Sundays when it's backing up. Frequent plugging and unplugging is probably going to cause a problem at some point, plus I have to remember to do it.

If I disable in Device Manager is it disabled enough that ransom ware won't encrypt it?

And is there any program out there that will securely isolate an external drive and turn it on when it is needed for back up and off when it is done?

Am I paranoid, or just "well informed"?

dalchina · 12 Oct 2016

Hi, you could construct a backup schedule which uses this tool:
Drive Tools for Windows
Description here
Use command line to safely remove USB drives

Now how would one reconnect it? A prompt?

Here are some ideas:
5 Ways to Remount Ejected or Safely Removed USB Device Without Unplug and Reinsert â€¢ Raymond.CC

I hope you also use disk imaging (e.g. Macrium Reflect (free)) to protect Windows and your other disks/partitions. If you are concerned about ransomware, having images created before your system is attacked allows you to restore it- no bitcoins involved.

chuckiechan · 12 Oct 2016

I use Windows 20 system image and back up, plus an additional data back up.

I'll look into drive tools.

Again, thanks. I may be back for help on command line.

dalchina · 13 Oct 2016

The repeated view here on Windows Backup and Restore is it's basic, unreliable. Programs like Macrium are maintained, well supported and feature rich. Threads asking for help on Backup and Restore usually remain unresolved.

chuckiechan · 13 Oct 2016

dalchina said:

The repeated view here on Windows Backup and Restore is it's basic, unreliable. Programs like Macrium are maintained, well supported and feature rich. Threads asking for help on Backup and Restore usually remain unresolved.

I was under the impression that ransom wear could encrypted all your drives. So if you had a Macrium back up stored on your external drive and it was connected to your computer and you encountered ransom wear, it too would be encrypted rendering the image/ backup unaccessable.

RolandJS · 13 Oct 2016

chuckiechan said:

I was under the impression that ransom wear could encrypted all your drives. So if you had a Macrium back up stored on your external drive and it was connected to your computer and you encountered ransom wear, it too would be encrypted rendering the image/ backup unaccessable.

Yup! That's exactly why the most important part of security - you the enduser - must have a layered defense strategy in place, to give you the greatest odds in your favor of not getting ransomware.

Bree · 13 Oct 2016

dalchina said:

The repeated view here on Windows Backup and Restore is it's basic, unreliable.

There's no doubt that Macrium Reflect is by far the better and more versatile product. I do find Backup & Restore's system image useful though. Mainly to put a system image on a separate partition of the same HDD - much like an OEM's 'recovery drive' but with my system configuration. I've never had any problems restoring this from the boot up recovery options. Being all 'in-house' MS products it seems to work well.

Where Backup & Restore does get touchy and unpredictable is restoring from an external image. It seems critically important to boot from recovery media created by exactly the same version that created the system image (32/64 bit, W7/W10). I had to go through my collection of recovery CDs to find the right one to restore a W7 system image to a drive I had tested a clean install of W10 on.

Borg 386 · 14 Oct 2016

chuckiechan said:

I usually leave my external back up drive disconnected except on Sundays when it's backing up. Frequent plugging and unplugging is probably going to cause a problem at some point, plus I have to remember to do it.

If I disable in Device Manager is it disabled enough that ransom ware won't encrypt it?

And is there any program out there that will securely isolate an external drive and turn it on when it is needed for back up and off when it is done?

Am I paranoid, or just "well informed"?

It might be, but why take a chance? The new variants of ransomware actively seek out backups & corrupt them also. You're taking the most secure action by keeping the drive disconnected & using it only for back ups. This action ensures that there is no way for it to access your files should your main system be compromised.

"Paranoia is just another level of security" - Unknown

x509 · 14 Oct 2016

Borg 386 said:

It might be, but why take a chance? The new variants of ransomware actively seek out backups & corrupt them also. You're taking the most secure action by keeping the drive disconnected & using it only for back ups. This action ensures that there is no way for it to access your files should your main system be compromised.

"Paranoia is just another level of security" - Unknown

My backup program Retrospect runs several different backup scripts between 8.30 pm and 10 pm. Assuming I backed up to an external drive, is there a tool that would USB-connect to that drive at 8.30 and USB-disconnect at say 10.30?

x509

Borg 386 · 15 Oct 2016

x509 said:

My backup program Retrospect runs several different backup scripts between 8.30 pm and 10 pm. Assuming I backed up to an external drive, is there a tool that would USB-connect to that drive at 8.30 and USB-disconnect at say 10.30?

x509

I honestly couldn't tell you if there is such a program out there. Sorry, Perhaps someone else knows of something like that.

I keep one of my external HDD's connected all the time, but it has an on/off switch (something lacking on a lot of external HDD's nowadays for some reason), so I can turn it off when not in use & still have it connected with no worries about something accessing it since it's off.