Just to put things in perspective, most (if not all) ransom programs do NOT encrypt image files (of course this could change at any time).  So even if you do get infected, it is likely your backups will still be available to do a restore - even if they are not kept offline.  Remember that MOST people do not back up their computers frequently so even if they had a backup it would not be very relevant.

This article may be of some interest (and may explain why Arvy is so prolific here): https://www.backblaze.com/blog/seniors-are-the-kings-of-data-backup/

@smk, @DSCoe, @johndoe89

Thanks for posting. 

An update for backups to use the Macrium Reflect saved network credentials if the current access is read only will be added to the next update. This is scheduled to be released in the next week.

Hope this helps 

Kind Regards

Nick

Macrium Support

See our reviews on

It's great this is now done.

However one issue though is after the backup a "net use" still shows the connection used for the backup using the specific credentials.    Is this expected?

As Windows has a limitation on one set of credentials per remote server share connection (other than with alternate name/IP address approaches) leaving a connection can be troublesome for a server with other shares.

@smk

Thanks for posting. 


If your share is hosted on Windows then the connection persistence and auto disconnection is controlled by Windows. You can use the following command to set the auto disconnect time by running it in an elevated command prompt on the PC hosting the share:


Where 'n' is the number of idle minutes before disconnection. The default value for Windows is 15 minutes, setting '-1' will disable auto disconnection and '0' will disconnect after a few seconds. 

Note: Running 'net use' on the client to see if the share is connected may cause a connection attempt and restart the counter. 

An alternative is for Macrium Reflect to disconnect shares that it connects to and authenticates when the backup starts. Unfortunately, if Macrium Reflect auto disconnects the share after the backup then it will prevent scripts or other applications from succeeding that require full access to the path directly after the backup completes, however, we intend to make this option configurable and include it in the next update. 

Kind Regards

Nick

Macrium Support

See our reviews on

Some of the Synology NAS boxes have hardware encryption. I remotely mount/unmount the appropriate bundle of HDDs just before scheduling (eg as admin). Yes, the REFLECT user account needs R/W rights but not enough for mounting. It's akin to what I used to do physically with the toaster-style individual single HDD engineering cage but nowadays the NAS box has a bunch more drives. Admin is only used long enough to mount and, REFLECT should only be active on schedule. Use of the newly provided REFLECT config: <net config server /autodisconnect:0> will also reduce the [no pun intended] window of opportunity for the Windows net shares that might be (mis)used by whatever ransomware. My workstation also has two NICs - one for the intranet (which includes the NAS) and one for direct connection workstation to NAS's other NIC using a different subnet. Hopefully complex enough to keep out ransomware...

I'm very sorry for my extremely late (by a full year!) reply, but better late than never they say...
I would like to thank Stephen and the other folks at Macrium for instituting the fix I (and several others) requested. It's great to know that you are listening!
I have tried it and it works as advertised.
Cheers! - DSCoe