Ransomware and backup: what a backup can and cannot do

A good backup is the most reliable way to get your files back after ransomware, because it means you do not have to negotiate for them. But a backup does not stop an infection, and a backup that is not set up carefully can end up holding damaged files too. This guide explains how backups help recovery, where the limits are, and what to do if it happens. It also states plainly what Tornova does and does not do today: Tornova does not detect or block ransomware.

What ransomware does to your files

Ransomware is malicious software that makes your files unusable, usually by encrypting them, and then demands payment for the key. It can affect files on the PC, on external drives that are plugged in, and on shared or network locations the PC can write to. Folders that are synced to a cloud drive can carry the damage with them.

The key point for backup is that the damage is a change to your files. Anything that stores a clean earlier copy somewhere the malware cannot reach gives you a way out. Anything that simply mirrors your current files will mirror the damage.

Where a backup helps

Backup is the recovery layer. It does not prevent ransomware; it lets you recover from it. The things that make a backup useful in this situation are:

A copy that is separate from the PC. A backup stored in a different place, reached only by a controlled process, is harder for malware on the PC to alter than a folder sitting beside your documents.
More than one point in time. If you can go back to a version from before the infection, you can recover clean files even if the latest copy is damaged.
An offline or off-site copy. A drive kept disconnected, or a cloud copy, adds distance between the malware and your recovery option. See the 3-2-1 backup strategy.
A restore you have tested. Knowing that a restore works, and how long it takes, matters when you are under pressure.

Even so, a backup is not a guarantee. It reduces the damage and the pressure, and how well it does that depends on how it was configured before the incident.

The limits you should know about

Honest limits are worth understanding before you need the backup, not after.

A backup can copy the damage. If the backup runs after files have been encrypted, the encrypted files can be backed up as a new version of the file. If only the latest version is kept, the good copy can be replaced.
Retention windows are finite. Versions are kept up to a limit. If the infection goes unnoticed for long enough, the older clean versions may no longer be there.
It only covers what you chose. Files outside your backup are not protected.
It does not remove the malware. Restoring files onto a PC that is still infected can simply lead to a second round of encryption.
Stolen data stays stolen. Some attacks also copy data before encrypting it. A backup helps you recover access to your files; it does not undo a data leak.

Why versions matter Versions are what turn a backup into a time machine. If you can keep several earlier versions of a file, an encrypted latest version is a problem you can step around. If you cannot, the damaged copy may be the only copy. The guide File versions and Trash explained covers the trade-offs, including the storage that versions use.

Habits that make a backup more useful against ransomware

Keep at least one copy that is not permanently connected to the PC.
Turn on versions for the folders that matter, and decide how many you can afford.
Protect the backup account itself with a strong, unique password and two-step verification.
Look at the backup results regularly, so you notice if something stopped working.
Test a restore of real files, and practise restoring to a separate folder rather than over the originals.
Keep Windows, your browser and your security software up to date: see How to protect important files on Windows.

What Tornova does today, and what it does not

This section is deliberately separate from the general advice above, so you can see exactly what is Tornova-specific.

Tornova does not detect or block ransomware (see Features for what it does offer). There is no ransomware scanning, anomaly alert or blocking in the product today. Detection is planned for a later release, and nothing here should be read as a claim that it exists now. Tornova is the recovery layer. You still need your own security software on the PC.

What Tornova does provide that is relevant to recovery:

Optional versioning. Off by default. When you turn it on you can keep 3, 10 or 50 versions, and versions use backup storage.
Trash. When cloud backup data is deleted, it stays in Trash for 1 day and can be restored within that day, after which it is permanently deleted. Smart Cleanup never deletes anything until you tick files, type CLEAN UP and confirm.
Deleting on the PC does not delete in the cloud. A file that disappears from your PC keeps its cloud copy.
A failed backup does not damage the last good one. An interrupted or partial backup never overwrites the last known-good backup.
Controlled storage access. Backup storage is never publicly accessible and access uses short-lived authorization. Each Windows Agent has its own device credential, separate from your sign-in.
Optional two-step verification. If it is on, extra verification is needed before a restore can start.
Restore controls. In an Organization, Restore permission is separate from Backup permission, a Restore Lock can block restores, and Emergency Stop lets an administrator halt backup activity.

Limits that apply to Tornova specifically: there is no continuous or real-time backup, so changes since the last backup are not protected; a backup run after files have been encrypted can back up the encrypted files as a new version; and versions are only kept up to the number you choose. Signing out of the Tornova App does not stop scheduled backup, so do not rely on it as a way to pause.

See the security page for the published security details.

If you think ransomware has hit a PC: a calm checklist

Disconnect the PC from the network and unplug external drives
Do not restart repeatedly or delete anything
Stop scheduled backups from that PC
Get the PC cleaned or reset
Change passwords from a clean device
Check which backup versions are clean
Restore to a separate folder first

Isolate. Switch off Wi-Fi, unplug the network cable and disconnect any external or backup drives. This limits spread.
Do not pay in a hurry. Payment does not guarantee you get working files back, and it can mark you as a target. Seek advice from a trusted IT professional or your national cyber-security authority.
Stop backups from the infected PC. You do not want fresh backups made of damaged files to push older clean versions out of retention. Check what your backup software lets you pause. In Tornova, signing out of the App does not stop scheduled backup.
Clean the PC. Restoring onto a machine that still has malware can lead to a repeat. A professional clean-up or a fresh Windows installation is the safe route.
Change passwords from a different, clean device. This includes email, your backup account and anything else the infected PC was signed in to.
Find a clean point in time. Choose a version from before the files were changed.
Restore a few files to a separate folder and open them to confirm they are good, then restore the rest. Tornova offers Keep both, Skip or Replace when a file with the same name exists; Keep both is the default.

The full restore walkthrough is in How to restore files from a cloud backup.

Frequently asked questions

Does Tornova Backup protect against ransomware?

Tornova is a recovery layer, not a ransomware shield. It does not detect or block ransomware today. It helps you recover by keeping cloud copies of the files you chose, with optional versions.

Can ransomware encrypt my cloud backup too?

Backup that is separate from the PC and reached only through controlled access is harder to reach than local files, but no one can promise it is untouchable. A backup run after infection can store encrypted files as a new version, which is why versions and a clean point in time matter.

Should I pay the ransom if I have no good backup?

That is your decision, but payment does not guarantee you will get working files back. Seek advice from an IT professional or your national cyber-security authority before deciding.

How many versions should I keep?

Enough to reach back to a time before an infection would have gone unnoticed, balanced against the storage versions use. Tornova lets you keep 3, 10 or 50 versions.

Is an external drive a safe ransomware backup?

Only if it is not connected when the malware runs. A drive that is always plugged in can be encrypted along with the PC. Keep one copy disconnected.

Keep reading

JavaScript is needed to sign in, buy a plan or use the dashboard.