What are the most common data recovery mistakes after a malware infection?

I “lived” through one of these. If systems were off of the corporate network because they were shutdown, or a laptop at home and not connected to the network via VPN - they were safe until they connected. Keeping them off of the corporate network was critical. Ours was a ransomware attack. First the VPN was intentionally reconfigured. At the facilities it was a physical check to see who was shutdown then unplugging data and power. Every piece of equipment had to be fixed, software moved to a third party server, and technicians all getting third party accounts. We were lucky that data on drives was being backed up automatically and a secure offsite storage over and above the data center was in place. I will never forget this episode

Having restored networks at the corporate and individual levels, the biggest mistake people make is in thinking they don't need to have a backup solution in place. Or putting EVERYTHING they need for their business or home on ONE computer and running everything from the local computer rather than subscribing to a SAAS and letting THEM worry about it. IF you have a good backup routine, the worst you can do is go back to your "last known good". Hopefully, that wasn't too long ago, especially if you are in a production environment! I think having several different backups is critical and have them done at different intervals so you MIGHT never lose an entire day's work! In some businesses, that can KILL you!!! But HAVE a backup solution!

Malware can wreak some serious havoc on an operating system Delete files Encrypt files Steal data and passwords Read your keystrokes Display malicious ads From worms to trojans and adware. Ransomware, in particular, is one of the major cyber threats out there and a contributing factor to data loss. decryption key, often through hardly-traceable means cryptocurrency. The problem is, even if the victim complies, nothing guarantees the hacker will honor their end. doing any of the things listed below can put you at an increased risk of malware : Using outdated antivirus software (or none at all) Pirating software from dubious sources Clicking on links or opening attachments you don’t recognize Surfing websites of questionable origin

The most common data recovery mistakes after a malware infection are given below: 1) Not Disconnect from the Internet. 2) Not Scanning the Whole Computer. 3) Not Backing up the Data. 4) Not Using Proper Data Recovery Software. 5) Not Seeking Experts Help.

It's more helpful if you have an endpoint detection and response application that isolates the infected endpoint, preventing it from connecting to anything *except* your response tool. This allows you to continue investigating and remediating the infection while safeguarding the rest of the endpoints on the network and preventing C2 communication. Both Carbon Black and CrowdStrike have this feature.

Before running any anti virus software besure to remove the device from the network and boot to safe mode. If possible have a specific machine off the network in quarantine so to speak to perform these activities.

A malware scanning application may not remove malware that is being hosted on write-protected media such as infected USBs, CDs, or malicious ISO files. It may not even reliably detect malware on these mediums. You will need to do some of this investigating yourself.

There is a lot of different methods, and opinions when it comes to scanning for malware. My tried and true method is to have a set of tools that I can load via USB, or baked into a PE Environment. (If you do this, update regularly, or update before you run them) Running multiple is key to success. Some scans are better at finding certain types of malware and viruses than others. You might run one or two scanners, and miss something, and re-introduce the malware when you release the infected workstation. If you do have an AV/EDR solution installed, and the malware got past it. You should report the malware to the vendor, so they can add it for the future.

A sophisticated attacker will likely target your backups, so monitoring for interruptions or deletions of backups should be a part of your overall security strategy.

Depending on your method of backing up normally, you may need to choose an alternate method for your backup before you try recovering. Since some forms of malware can infect a backup, and also the other backups in their storage location, it's important to be sure that you will not corrupt known good backups. This could mean using an External Drive that you don't normally use for backups, or a Cloud location that you know will not spread the infection. If you attempt to recover using a backup, you need to find out if your existing backups are also infected, so you don't put the malware back onto the workstation.

This is a valid point regarding the significance of selecting the appropriate data recovery software, particularly in the event of a malware infection-related data loss. Keep in mind that data recovery, particularly when malware is involved, can be a delicate and frequently urgent procedure. To increase your chances of recovering your data effectively and protect the security of your system, take the time to investigate and choose the best data recovery software.

I recommend that any entity that has fallen victim to a ransomware attack keep all archives and encrypted archives and alike. With the help of Cyber security professionals and industry experts, that data may be recoverable, and for a fraction of what the ransom is.

All the Above are great recovery tips for a more experienced user and any user for that matter but what I run into more times than anything is that people haven't made Timely backups when they make changes to their computer whether it be new software or updates. This more times than anything seems to be the biggest problem to get back to their working configuration. I also see that people don't test their backups especially with software changes and updates. Backups without testing them is pretty much a useless tool.

If possible, rather store your data on a cloud and avoid keeping files on the hard disk itself. Keeping your data on the local hard disk not only puts your data at risk, but storing huge amounts of data can slow your computer down over time. Keeping your data on a cloud or using a backup cloud solution can at least ensure most or all of your data is kept safe in the event of a malware or ransomeware attack