Ransomware recovery

---

Digital999 wrote:

 

To recover my idea is to restore the periodic backup first for the case of Ransomware

Then select the appropriate (most recent) snapshot and recover data. 

---

There is an option to Allow Snapshot Access, and you need to make sure that option is disabled.  For some reason (totally unfathomable), Netgear decided to give the users write permissions for the snapshots when you use that option.  So ransomware infecting the PC can encrypt the snapshots also.  You can still Allow access to Windows Previous Versions.

As Sandshark says, one limitation here is that the NAS will automatically start deleting snapshots when the volume gets too full.  By default, this happens when the volume reaches 90% full.  While you can adjust that threshold, you do need to understand that if the volume does get completely full, then BTRFS starts misbehaving (which can result in the volume failing). So I don't recommend raising that threshold (and raising it doesn't help much anyway).

As a result, you do need to keep an eye on the amount of free space.  If you kept the volume at no more then 40% full, then even if ransomware encrypts the entire volume you'd still end up at < 80%.  Then you should always be able to restore the most recent un-encrypted snapshot. 

Of course encrypting the entire volume over the network will take some time, so if you know the attack is happening you can disconnect the NAS from the network before the volume fills.  In that case you could survive the ransomware attack with less free space.  If the ransomware has infected the NAS OS itself, you'd probably end up needing your off-site backup (rebuilding the NAS from scratch).