Restoring your data

A lot of focus is placed on protecting your devices and preventing incidents before they can happen. But what happens if you are the victim of malware like ransomware? How should you respond?

Responding quickly to a cyber incident means you can reduce the severity of negative impacts and the time it takes to recover.

In the case of ransomware, the ability to restore your files from a backup may mean you never have to worry about paying a ransom to decrypt your data.

The importance of having a backup

It is vital to make full and regular backups of each computer or device used at home, shortly after completing a virus scan.

It’s also important to regularly check that back-ups are available and working.

Backups mean you can restore data when something goes wrong – whether your computer breaks, you make a mistake deleting valuable files, or your system is infected by malware.

Without any backups, you will have to recreate all of your information manually. This is not only difficult and a waste of time – some files, like personal photos or videos, may be lost forever unless you or someone you know has a copy.

Learn more about how to backup your data.

Restore or rebuild?

Following a malware infection on your computer you have two options:

  • Restore your computer to a previous state using features available through your operating system or an application. In short, restoring files from a backup.
  • Wipe your computer and rebuild it from scratch.

          Please note: Both of these options can be technically challenging.  If you are not confident or
          experienced performing these operations, we recommend that you seek the assistance of your
          local computer repairer, retailer, or computer club.

Restoring data from a backup is necessary if you are infected by malware that “locks up” your computer and encrypts all your files. In this situation, you would not have access to anything on your computer.

Having a backup means you don’t have to take the risk of paying a ransom, only to find you still don’t gain access to your data. Having a backup means you can restore all your data without engaging with criminals. Learn more about ransomware.

However, if you experience a significant incident or infection that means your computer or device is no longer functioning properly, you may need to rebuild it from scratch.

Restore your files from backup

Regardless of the type of backup process you have in place, understanding how you go about restoring your data is crucial.

Most recent versions of major operating systems (for example Windows or Mac OS) include a backup and restore application.

Some storage devices or anti-virus software will also come with backup and restore functionality.

If you are using a back-up application it is important you choose to backup your files to a storage device that can be disconnected from your computer, such as an external hard drive or USB storage device. This is because some malware, like ransomware, can find and encrypt (or lock-up) any storage that is connected to your computer at the time of infection.

Automatically backing up your data to cloud services can be a convenient way to protect yourself from ransomware.  If you choose to use a cloud backup service, ensure that it keeps more than one copy of your data.

  • Microsoft provides ‘Backup and Restore’ functionality with some versions of the Windows operating system.
         *     Information about how to use this function is available on the Microsoft Support website.
  • Apple provides a few backup methods to users – one is based in the cloud while the others can choose a different location (such as a USB drive). On the Apple Support website you can find:
         *     How to restore iPhone, iPad and iPod Touch data.
         *     How to backup or restore your Mac

​​​If you are using a backup application from a different product or manufacturer, seek advice on restoring files from backup through the company’s official support centre.

Rebuilding your computer after wiping clean

Any time your computer or device has been affected, that is, an unauthorised program or code was able to run on your computer or device; you can no longer trust its security and integrity.

In situations where you have experienced a significant incident or infection and your computer or device is no longer functioning properly; or where you think there may still be malware running on your computer; you may need to rebuild your computer from scratch.

Wiping your computer and restoring the system to a version before it became infected is one of the only ways to trust that your computer or device is clean and trustworthy.

However, rebuilding a computer in this way is complicated and should only be attempted by someone with some experience and a good understanding of computing. Seek assistance from your local computer repairer, retailer, or computer club.