Friday, August 18, 2017

Backup Basics...

One of the most troubling types of computer problems involves the loss of data

 Personal files, photos, important documents, music, videos, and the like are all things that can be disturbing to lose.  And yet many people have no plans to protect these important, irreplaceable files from loss.  But there are plenty of things that can go wrong that affect these files.
 

Hard drive failures: Mechanical hard drives are an amazingly complex piece of machinery, capable of storing large amounts of data in a small physical space, and at a relatively low cost.  Not surprisingly, the mechanics inside a mechanical hard drive can fail, plus they are sensitive to shock (being dropped, bumped, etc.), so they are not invulnerable.
 

Flash memory failure: SD cards, USB drives and internal memory for tablets and phones use a non-volatile memory (meaning that the memory does not require electrical energy to store data).  This type of memory is pretty reliable, (not shock-sensitive) but still failures can happen, and they can fail without warning.
 

Virus or Ransomware: This type of threat can corrupt files, or encrypt them to prevent access to the files at all.  Payment can be demanded to release the files, with an implied threat to delete the files if payment is not made.



What do all of these have in common?  If you have a backup which contains your backup files, then you will be able to recover your system and your files.

Windows 7 and above include a backup utility for creating and maintaining backup copies of your files and can also backup your operating system (OS) in case of a virus or hardware failure.  You can access it by typing backup in your search bar.  Using it, you can select which files you want to back up (often called the source data) , where you want to store them (the target) and when you want to perform the backup (and if it is to repeat).  If you run it immediately, it will take minutes or hours depending on how many files, the relative speed of the computer, and the type of backup storage.
There are also many programs that will perform backups for you; naturally, they feature some additional options not found in the Windows backup utility.  I am currently using one called AOMEI Backupper, which has can do partition resizing, disk cloning and disk imaging as well.
I have been using disk cloning software* for several years.  It has proven as easy way to prevent redundant activities when prepping and repairing computer systems.  I really appreciate the ease with which this type of software can give a layer of protection to a user.  In fact, I recently did a full backup of my primary system last week, a process that took (in its entirety) about 4 hours.  This was a backup of over 300GB of data files, pictures, music etc., and I fully verified that the backup will boot into windows.
Disk imaging software** takes a slightly different approach, where the target of the imaging is a larger storage device that can hold many images.  Usually a server (a network computer with vast amounts of storage) will be utilized in this environment, and usually in an enterprise operation.
* Disk cloning software-a utility program which makes an exact copy of the drive, essentially duplicating the source drive sector by sector.
**Disk imaging software- a utility program that can store an image, or a full copy of a disk or partition, for later use during a recovery operation.

Thursday, June 8, 2017

My take on ransomware...Causes, prevention, & dealing with these threats.

There has been a pretty steep uptick in ransom-ware activity the last few months, and the seriousness of this particular type of threat has grown to near epidemic proportions.

 Any software which can take administrative control of a computing device, prevents removal/detection/deletion, and hold control of it until a monetary amount is paid (the ransom), is considered ransomware.
Probably most disturbing is the amount of money that ransom-ware is generating to the criminal element.  The FBI estimates over $200 million has been spent already in 2016 to release personal, business, and even file servers that have been compromised.
The other frightening aspect of all this is that the "ransom" rates are also on the rise.  Where ransoms from a few years ago might have been merely a couple hundred dollars, I have now heard of ransoms going into the thousands of dollars.  Yikes!

So what can someone do (to prevent and/or recover) from a ransomware attack? 

The fast answer (the best one in my opinion) is prevention.  If you have been around computers for awhile, you have probably heard,
  • "Don't try to get stuff (that costs money) for free", 
  • "Don't open email with attachments from people you don't know",
  • "Don't download unknown programs", 
  • "Don't click on links in web pages, or email unless you know where the link is taking you".

These are good suggestions, but there are some other things that can also be done:

1. Back up files, especially personal files, pictures, and any financial/business software.  A full backup should also be run, and the backup media should ideally NOT be regularly connected to the computer (any connected device could be compromised in the event of a ransomware attack)  Removable storage like DVD's, external hard drives, and USB drives, are good examples.

2. Keep your antivirus current.  And have a second line of defense.  Malwarebytes has a free scanner, but the paid version has an active component that monitors and will block malicious content.  While nothing can truly block against every threat, a good solution will have consistent updates to its detection engine, and make those updates available in a timely manner.

3. Know how Microsoft operates.  They will never call you to offer assistance.  If you get a call like this you can rest assured that it is some type of scam attempt.

 Q: "OK, these are good suggestions, but I already have a popup telling me that I need to pay.  What do I do?"

A: some of these threats can be removed.  So the first thing to do is NOT panic.  Next, terminating the process in hand is important.  Shutting down the PC is a good first step.  If you are locked out when it restarts, you could try to start the PC in safe mode.  (When the PC is first booting, you can bring up your startup options by tapping the F8 key.  Select safe mode, and see if your computer can start.

If it can start in safe mode, download and run Malwarebytes.  It may be able to root out and remove the problem.  If it comes back clean, your system may not have been infected by the threat (this is where quickly shutting the PC down can help).  If it does find any threats it may ask to restart your system after it removed them.  I would recommend a follow up scan after that to ensure nothing is left behind.
Also run a scan with whatever your other virus/malware scanner is.  If you don't have one, Windows defender (Win 8,10) or Microsoft Security Essentials. (Win 7) are good basic protection.