Can ransomware affect an external hard disk on Windows that has been ejected using "Safely remove" feature while keeping the drive plugged into my PC?
8
-
2Do you eventually mean to say that the disk has been successfully ejected but still physically connected to the USB port? If so, I believe there are programmatic ways to reinitialize the USB hub and make the USB storage device reconnect itself to the OS without the need to physically remove and reinsert the same.– rajeevCommented May 3, 2020 at 11:58
-
@rajeev to my understanding, that is not possible. If so, please let me know how...– LPChipCommented May 3, 2020 at 12:12
-
2@LPChip - There's a Windows app called Zentimo zentimo.com that does exactly that. How it does may be propitiatory however it can programatically reinitialize the ejected device. If required it can even reinitialize the underlying USB hub to get back the device that is ejected but still plugged in. You may try the 30 days eval version and explore it further. Since a software can do it, it should be possible by ways of a software program. Disclaimer - I am not affiliated with Zentimo in any way. I just tried it out for some of my needs.– rajeevCommented May 3, 2020 at 12:22
-
@rajeev but I bet you need administrative privileges t do that. I mean you are interacting with hardware, and malware/ransom ware does not have administrative privileges. So I think we're safe here. I'm only not sure what happens if you reboot a pc. I think the attached drive is initialized upon boot.– LPChipCommented May 3, 2020 at 12:34
-
I think you should edit your question to avoid the very obvious confusion. Physically connected drives can be compromised by ransomware.– anonCommented May 3, 2020 at 13:50
|
Show 3 more comments
1 Answer
Your external hard drive has been ejected be the Safely remove feature in Windows, however it is still physically connected to the computer, and any program that has administrative access can remount it like in these examples including malicious software. Air gapping the external hard drive is a stronger way of preventing malware from accessing it.
-
It may not be as easy as simple remounting, but basically you're right. Commented May 4, 2020 at 6:35