Recovery Force® Data Recovery Forum

Just saw my first Cryptolocker 3.0 drive for recovery...or at least an attempt to do so. Not only is the shadow copy disabled, but it seems as though they go further and erase the slack space, making a RAW recovery of any deleted files impossible too.

Nice. And if your NAS is mapped to a drive letter, will even encrypt the files there too. So you might even lose your backup. I think the only sure way to be safe from such a virus is to either have cold backups, or a NAS which saves back versions of files like my Synology does.

The last customer I had with Cryptolocker eneded up paying the criminals the $500 worth of bitcoin. And they did get their data back.