Preventing storage destruction with corruptd
corruptd is a super-light system daemon I wrote that detects if the storage has been tempered by a malware.
If it detects a destruction, it tells the system app that manages btrfs snapshots to alert the user.
corruptd can detect deletion and modification(e.g. encryption). The video only demos deletion.
User can then restore to an older snapshot and recover all of the lost files.
After selecting a snapshot, users just have to do a regular reboot to rollback to the older state.
(The video was trimmed to exclude the rebooting process)
This will become useful in the events of ransomware getting more and more of a threat.
corruptd, btrfs backport and Snapshot manager app is planned to be open-sourced soon.
If it detects a destruction, it tells the system app that manages btrfs snapshots to alert the user.
corruptd can detect deletion and modification(e.g. encryption). The video only demos deletion.
User can then restore to an older snapshot and recover all of the lost files.
After selecting a snapshot, users just have to do a regular reboot to rollback to the older state.
(The video was trimmed to exclude the rebooting process)
This will become useful in the events of ransomware getting more and more of a threat.
corruptd, btrfs backport and Snapshot manager app is planned to be open-sourced soon.
همه توضیحات ...