On 2017-02-18 16:58, RayLopez99 wrote:
> They always say when discussing ransomware to disconnect your backup from
your PC (ie an air gap), but to me it don't make sense why.  Suppose you mirror
your C: drive to your D: drive, how is that image file going to be infected by
ransomware?  Can't you just wipe the C: drive, then reinstall the image from
the D: drive to get back to a point before the ransomware infected your system?

> As a precaution, I do backup to a USB drive as well, but I don't know why
they suggest doing this.
>
> RL

Easy: Write the ransomware to attack all partitions ("drives").


Good luck,

-- 
Best,
Wolf K
https://kirkwood40.blogspot.com
It's called "opinion" because it's not knowledge.
--- NewsGate v1.0 gamma 2