Reply to post: Re: There should be no over-ruling this ...

Do you know where your trade secrets are?

Paul Crawford Silver badge

Re: There should be no over-ruling this ...

If you use snapshots in ZFS/GPFS or on NetApp boxes, etc, then you have the "copy on write" model so attempts to re-write files puts the data elsewhere on disk, and the original is still accessible via the previous (snapshot) file tables.

Of course you need to be doing snapshots, and to protect the machine doing so from being done over, and also to have long-term backups elsewhere so you can go back as far as you need when you discover it was infested. Some DB randsomware waited 6 months or so before revealing itself so there would be no viable backup to recover from.

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon

SUBSCRIBE TO OUR WEEKLY TECH NEWSLETTER

Biting the hand that feeds IT © 1998–2019