5 ms·
Usually the infected computers are running Windows, which doesn't have full filesystem snapshot capability. Storage servers/SANs will have snapshot capability
by SteveNuts 6y ago
Usually the infected computers are running Windows, which doesn't have full filesystem snapshot capability.
Storage servers/SANs will have snapshot capability but it takes a long time to roll back and bring things back up. Also, a lot of companies don't plan for the fact that restoring that snapshot effectively doubles the required amount of storage.
I've heard of storage vendors sending huge amounts of new shelves of disk to customers so they have enough space to expand their snapshots.
- gerdesj 6y agoWindows has "previous versions" or shadow copies. Often, one of the first things ransomeware does is disable that function and delete them. Then it goes after your backups.
- lostmsu 6y agoLet's not put undue blame on Windows here. Not only it is factually incorrect (Windows System Restore has been around for ages, and File History is on by default on recent versions), Windows nags users to set up backup to an external storage, which, for example, Ubuntu does not even suggest.