Asking the IT guys ,
If you had a cyber attack that locked your hard drive , would it be smart to make a byte by byte copy that might be able to be unlocked later with better computers (Super computer) or better anti cyber attack software ?
Many of these attackers do not unlock the hard drive even if you pay them !
And no this is not my problem , just interested in knowing if its a good idea
Thanks
Implementing a backup solution after a disaster is kinda the backwards way to do things. But sure, taking an image of the drive with the encrypted files would allow you to decrypt it later. You don't typically need to brute force decrypt a drive. Often times one of the following eventually happens:
- The malware authors made an implementation mistake, making it possible to break the encryption. That was the case with the Petya ransomware and with the CryptXXX ransomware.
- The malware authors feel sorry about their actions and publish the keys, or a "master key", as in the TeslaCrypt case.
- Law enforcement agencies seize a server with keys on it and share them. One such example is CoinVault.
https://www.nomoreransom.org/en/index.html