Protection from ransomware

---

alexofindy1 wrote:

It looks like only restore is possible from windows, 

---

Correct.  But the snapshots will be deleted from the NAS if the file system gets too full.

---

alexofindy1 wrote:

so I'm hoping the answer is that as long as there is sufficient disk space for the snapshots on the readynas, that the previous versions should be OK..

---

That basically is the answer, but the followup is how much free space do you need on the NAS?  The snapshots are deleted automatically when the file system becomes >= 90% full.  You don't want to increase that threshold, as btrfs will misbehave if the file system gets too full.

If a single PC is infected, then every file on the NAS would be encrypted once.  If you want enough free space to preserve the snapshots througout the attack, then you'd need to maintain at least 55% free space on the NAS.  That would ensure that you'd have at least 10% free space after the attack.

However, if you have multiple PCs being infected, then there is a chance that the ransomware on all the PCs will encrypt the files on the NAS.   If an already-encrypted file is encrypted again, then you could end up needing even more free space. It would depend on how often the snapshots are made (and how long it takes you to disconnect the NAS from the network after an attack).

What I've done myself is back up the main NAS to secondary NAS that don't have SMB enabled.  Those backups are done daily, so I have a reasonable time to disconnect them from the network if the PCs are infected.  I augment that with cloud backup, which ought to allow me to recover the original files even if I don't react quickly enough to the attack.