Ask Leo! #615 – Windows Subscriptions, Apps versus Applications, Space on Reserved Partitions, and more…

Would file encryption work to thwart Ransomware? How about encryption on a Mac or Linux?

No. If you use file encryption, that would only mean that your encrypted files would be encrypted a second time by the ransomware.

"Would file encryption work to thwart Ransomware?" - No. Not at all.

Actually it's not quite that black and white. Or, as my most common answer goes, "it depends".

MOST ransomware encrypts only certain file types, typically based on the extension of the file name. So it might encrypt ".docx" files, along with a lengthy list of other commonly valuable file types. (One of the variables in ransomware is, indeed, the length of that list - the number of different types of files that it'll attempt to encrypt.)

IF your encryption technique involves renaming the file - for example renaming "important.docx" to "important.docx.axx", and ".axx" is not on the of file types encrypted by the particular ransomware variant encountered, then the file will not be impacted by that ransomware. And yes, this implies that simply renaming a file to a non-targetted extension would also cause that ransomware to bypass it.

As you can tell, whole disk encryption, as discussed in this article, doesn't change file names, so Ray's and Mark's answers stand: whole disk encryption has no effect on ransomware. HOWEVER other recently discussed encryption techniques - specifically TrueCrypt/VeraCrypt vaults, individual file encryption and so on - do stand a reasonable chance of bypassing most (though not all) ransomware threats.

It's worth noting that ".zip" files are likely to be targeted simply because they're ubiquitous - thus using .zip for some kind of ransomware protection is not particularly useful.

In fact, I'll go one step further: relying on your own encryption is not a way to plan for, mitigate, or otherwise "protect yourself from" ransomware. Do all the things you do to protect yourself from all malware - including those all important backups. The topic remains interesting, though, for those folks who have been impacted by ransomware - some of the files on their machine may have dodged a bullet depending on the encryption they may have used, and the specific attack targets of the specific ransomware encountered.