WORM drives vs Ransomware

hdasdm

Commendable
May 6, 2016
2
0
1,510
Hi first post. If you perform your backups to a Write Once Read Many (WORM) drive would that prohibit Ransomware from propagating to your backups?
 
Solution
Note that CD-R, DVD-R and BD-R are WORM. In their case, subsequent sessions can "delete" or "overwrite" existing data. But the old data is not actually removed. A new file directory is written which either removes the reference to the file (deleted), or points to a new copy of the file instead of the old copy (overwritten). A program which can read previous sessions will allow you to recover data from a WORM disc, even if later sessions have been encrypted by ransomware.

http://www.isobuster.com/multisessions.php

So unless your computer already had the ransomware before you began backing up to DVD-R or BD-R, yes your backups on those media are safe from ransomware.
Note that CD-R, DVD-R and BD-R are WORM. In their case, subsequent sessions can "delete" or "overwrite" existing data. But the old data is not actually removed. A new file directory is written which either removes the reference to the file (deleted), or points to a new copy of the file instead of the old copy (overwritten). A program which can read previous sessions will allow you to recover data from a WORM disc, even if later sessions have been encrypted by ransomware.

http://www.isobuster.com/multisessions.php

So unless your computer already had the ransomware before you began backing up to DVD-R or BD-R, yes your backups on those media are safe from ransomware.
 
Solution

hdasdm

Commendable
May 6, 2016
2
0
1,510


Thank you solandri for this very insightful post. It was very helpful.