WORM drives vs Ransomware

[hdasdm]

Hi first post. If you perform your backups to a Write Once Read Many (WORM) drive would that prohibit Ransomware from propagating to your backups?

 

[Someone Somewhere]

Not necessarily. It would prevent your backups being modified/deleted after they had been written, but if the ransomware stays on your PC for a while before making itself known, it could probably include itself in the backups as you make them.

 

[Solandri]

Note that CD-R, DVD-R and BD-R are WORM. In their case, subsequent sessions can "delete" or "overwrite" existing data. But the old data is not actually removed. A new file directory is written which either removes the reference to the file (deleted), or points to a new copy of the file instead of the old copy (overwritten). A program which can read previous sessions will allow you to recover data from a WORM disc, even if later sessions have been encrypted by ransomware.

http://www.isobuster.com/multisessions.php

So unless your computer already had the ransomware before you began backing up to DVD-R or BD-R, yes your backups on those media are safe from ransomware.

 

[hdasdm]

Note that CD-R, DVD-R and BD-R are WORM. In their case, subsequent sessions can "delete" or "overwrite" existing data. But the old data is not actually removed. A new file directory is written which either removes the reference to the file (deleted), or points to a new copy of the file instead of the old copy (overwritten). A program which can read previous sessions will allow you to recover data from a WORM disc, even if later sessions have been encrypted by ransomware.

http://www.isobuster.com/multisessions.php

So unless your computer already had the ransomware before you began backing up to DVD-R or BD-R, yes your backups on those media are safe from ransomware.

Thank you solandri for this very insightful post. It was very helpful.