How do I safely back up an infected drive,
Hi everyone, Leo Notenboom here
for Askleo.com. You get malware, you get an infection of some sort,
and you want to back up to recover your data, but you don't want the infection.
What do you do?
Here's today's question.
"My hard disk got infected with the virus.
I am planning to format it.
So is there a way to back up all of the data without carrying the virus?"
No.
No, there is not there's no way to back up everything without backing up everything.
What's worse is that what does it mean to be just your data?
There's a good chance that if you don't back up literally everything,
you'll miss something important that you would have considered as your data.
So there are three alternatives that I will walk you through.
We'll discuss,
but the bottom line is that
there really is not a way to do exactly what you're looking for.
Here's what to do instead.
Option number one is back up knowing that it's infected.
There's no harm in backing up.
There's never any harm in backing up, right.
Create a back up full image, back up of the infected drive and know,
maybe even mark somewhere, that that backup has an infection included with it.
The reason we're backing it up,
the reason that it's really almost fundamentally the very first step,
no matter what we do, even with some of the other options here,
is that this way you're guaranteed to have backed up absolutely everything.
You don't have to think about what is and is not a data file.
You don't have to worry about having missed something.
What you do have to worry about, of course, is restoring. Making sure
that you're not restoring the malware, the infection.
The best way to do that is to once again using the image that you've backed up.
You can then later pick and choose
which data files you need and restore them one at a time.
95 percent of the time,
the malware that you got is not in one of your data files,
but even if you're concerned that it is, you now have the option of individually, as
you restore these files, scan them with your anti malware tool.
That way, again, you've got everything.
And as you're restoring it, you're not restoring the malware
and you're making sure that your data files don't themselves contain malware
by scanning them as you carefully restore each of them.
Option number two is a slightly,
basically, a variation on that theme. Rather than restoring individual files,
what you can do is restore that image, the entire image,
to a different drive a non-system drive so that nothing starts running
but to... An external drive actually is a wonderful option for this.
Restore the entire backup image to this
other drive, then run your anti malware tool on that external drive.
Let it then scrub and remove whatever it finds there.
That way, you know that great.
The backup that was infected I've now
restored and that restored copy does not have the malware that caused me
the problem in the first place because I ran anti malware tools on it.
That's a fine, fine approach as well.
It's a little bit more time consuming, in a sense of setup.
But it's one of those things where you can just run the scan on everything rather
than scanning each individual file as you restore it from the drive.
Option number three.
Is to back up only data and this one,
I throw it out more for completeness, it's definitely not my preferred approach,
but I know that for some people, they really do prefer this, and that is OK.
Just back up your data, make copies of your data,
use whatever tool you want to copy, just your data files off of the drive,
make sure you get them all, but just copy your data files.
Honestly, option number three should really be
prefaced with option number one as a safety net.
Again, there's no reason not to make a complete image backup of the drive.
So do so. Set that aside.
Mark it as being infected,
maybe never use it again, because now we come back to option number
three, say, OK, fine. We'll now start copying off the individual
data files that we care about so that when we restore, after we've
reformat it, and reinstall everything, we've got a collection of data files
that we can then just copy back if we missed anything.
Great.
You still got that original image back up that we did with option number one.
You can go back in there and carefully
select the individual file that you may have missed.
But if you got everything up front, maybe you won't have to do that very often.
Maybe you won't have to do that at all.
So what do you do next, right?
Well, if you're not backing up your
computer start. And I say that because that's really option number zero,
the idea is that if you're backing up your
computer regularly and I'm talking at least every day,
then when you find yourself faced with malware, you have another option.
And that option is to throw away
whatever's on the hard disk right now, restore the most recent uninfected image.
If that's yesterday,
you grab yesterday's image, restore it and you're back in business.
You don't have to reinstall anything.
You don't have to,
you know, carefully recover things.
All you're really doing is
setting back the clock to the state your system was in yesterday.
Yeah.
You might use lose a little bit of work, the work you were doing today.
And if that's important, I go all the way back to option number
one, take an image of the machine as it is infected and save that somewhere.
Then you could restore to the image that you took yesterday and you're not.
Hope that helps. Hope that helps, clarify what you could do.
If you find yourself with an infected machine for updates, for links,
for related comments and more, visit Askleo.com/130295.
I'm Leo Notenboom.
This is Askleo.com.Thanks for watching.