Devices, systems, and methods for ransomware protection and mitigation

Abstract

Disclosed herein are devices, systems, and methods for detecting, mitigating, and protecting against malicious actions and/or malicious computer software, including malware and ransomware. Specifically, disclosed embodiments mitigate the threat of ransomware across a wide range of devices including, for example, servers, storage systems, computers, and portable storage devices. At least one embodiment stealthily detects malicious actions by interposing when a file is opened for writing, creating a temporary checkpoint, comparing existing data in the file to what will be written to determine if it is destructive, and, if the behavior is malicious and/or destructive, preserving the checkpoint. At least a further embodiment can be implemented on, and/or ported in, a portable storage device (e.g., a USB device).