Re:Ransomware maker TeslaCrypt shuts down after releasing ma...
by sokoloff on Friday May 20, 2016 @09:00AM
(#11737395)
No.
The attack happens on a file-by-file basis, within the free space that you have allocated on the live filesystem. foo.txt, bar.pdf, and baz.jpg are all encrypted in place, consuming only marginal free space during the operation.
Then, when the incremental backup happens, THAT will notice that ALL the non-OS files have changed and the backup consumption will explode.
The attack happens on a file-by-file basis, within the free space that you have allocated on the live filesystem. foo.txt, bar.pdf, and baz.jpg are all encrypted in place, consuming only marginal free space during the operation.
Then, when the incremental backup happens, THAT will notice that ALL the non-OS files have changed and the backup consumption will explode.