0

This question already has an answer here:

Can time machine or iCloud backups overcome ransomeware encryption of your hard drive?

marked as duplicate by Tetsujin, bmike Apr 5 '17 at 21:55

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

2

Well, if your Time Machine or iCloud backup was done before some ransomeware encrypted your hard drive, and assuming that the ransomeware didn't also encrypt your backup, then yes, you can restore from backup once you got rid of the ransomeware (probably by restoring your Mac from scratch).

0

Update: I've just answered the question that this is marked as a duplicate of, and will maintain that answer, rather than this one.

Probably not.

Ransomware will have a relatively hard time deleting or encrypting online Time Machine backups. Even as root/superuser, it's hard to delete Time Machine backups:

sudo rm /Volumes/BK1/Backups.backupdb/Orion/2017-03-18-184155/BOOT/var/du--sortedALLk.13224.bak
Password:
override rw-r--r--  root/wheel for /Volumes/BK1/Backups.backupdb/Orion/2017-03-18-184155/BOOT/var/du--sortedALLk.13224.bak? y
rm: /Volumes/BK1/Backups.backupdb/Orion/2017-03-18-184155/BOOT/var/du--sortedALLk.13224.bak: Operation not permitted

But it's far from an insurmountable problem. I think folks should assume that the additional step that the ransomware would have to go through (which I'm familiar with but choosing not to publicize - I'd rather not help script kiddies) to be able to delete or encrypt TM backups is something most Mac ransomware you're likely to become infected with will be programmed to take.

Time Machine users are encouraged to allow backups to run often, which makes them vulnerable to ransomware.

Therefore some backup drives should be connected less often and kept more secure - not fully accessible to the system - specifically to protect from ransomware.

Typically, victims realize they've been infected with ransomware only when the ransomware announces its presence. So it's likely you won't be able to tell that the computer is infected with ransomware before it has a chance to encrypt the data on a frequently or continuously connected external drive. Assuming otherwise is far from a safe assumption. The ransomware threat makes better disaster preparedness, including having more numerous physical backups, more important.

  • I'm reading the OPs question as wanting to know if their hard drive is encrypted by ransomware, can they overwrite that drive with a backup from TM or iCloud. I don't see the question as asking if TM or iCloud backups can be encryped by ransomware, which is what your answer addresses. – fsb Apr 4 '17 at 20:55
  • Thanks. I would remove virus or reformat HD prior to using time machine. I see my best course of action would be an external drive only attached for backups and then disconnected. – Davis Newman Apr 5 '17 at 1:33
  • @fsb I don't think one can answer the first question you raise without answering the second. If the backup has been encrypted by ransomware, then the backup is not useful; the answer to the the first question you raise becomes 'No.' Davis, you're assuming you'll be able to tell that the computer is infected with ransomware before it has a chance to encrypt the data on the external drive. I'm saying that's far from a safe assumption. The ransomware threat makes better disaster preparedness, including having more numerous physical backups, more important. – Matthew Elvey Apr 7 '17 at 3:45

Not the answer you're looking for? Browse other questions tagged .