⁦I.⁩ When something goes wrong

The backup stopped because many files look encrypted

What happened

Before writing, the program compares the source with the previous backup. It stops the backup when the changes look like the work of malware that encrypts files (ransomware):

  • a large part of the files from the previous backup has changed or disappeared;
  • changed files have content that does not fit their type, for example a Word document no longer looks like a document, and a text file looks like random data;
  • many files disappeared and reappeared with an extra ending added to the name, for example report.docx turned into report.docx.locked.

Nothing has been written yet. Earlier versions in the backup are untouched.

A backup started manually

The “Suspiciously many changes” window appears with the reasons.

  1. Open a few of the changed files in their usual programs.
  2. If they open normally and the changes are expected, for example after a program update, or after moving or reworking many files, click “Continue anyway”.
  3. If the files do not open, or you do not know where the changes came from, click “Pause the backup” and go to the “If the files really are encrypted” part.

A scheduled backup

The notification “Scheduled backup paused” appears. A scheduled backup does not ask; it waits for a person to decide.

  1. Open a few of the changed files in their usual programs.
  2. If everything is fine, start the backup manually: on the “Templates” page, select the template and click “Run backup”. The “Suspiciously many changes” window appears; click “Continue anyway”.

With the “Live” schedule, top-ups wait until a backup from this template, started manually, finishes successfully.

If the files really are encrypted

  1. Disconnect the backup drive from the computer. Do not run any backup.
  2. Clean the malware off the computer, ideally with the help of a specialist. Until then, do not connect the backup drive.
  3. Restore the files from the backup on the cleaned computer (see “Restoring the whole backup or a single folder”). The newest version in the backup usually dates from before the changes, because the program did not write them. Still, check the restored files: some may have been encrypted before the program noticed.
  4. If the versions have a Sigelith seal, “Last untouched” points to the newest version that matches its seal (see “Checking that nobody has tampered with files in the backup”).

If something goes wrong

  • The window appears after changes you made on purpose, for example after encrypting files with your own program or packing them with a password: this is expected, because the program sees only the content. Click “Continue anyway”.