0
I'm doing some PC maintenance/repair for some clients, sometimes I have to deal with HDDs to recover lost data, or even backup. The problem is that most of them are infected with different malware types. Now how to deal with a HDD without getting my PC infected?
Because no Antivirus is 100% effective, I thought about:
1- Disabling any autorun
2- Using Sandboxie to explore the HDD (open it sandboxed)
3- If running a recovery software, run that software sandboxed
I even thought about running the HDD on a Linux machine, but no good Antivirus for Linux, and the software I use for recovery is only available for Windows.
Now is that the right way to prevent infection?
1You could always put the drive into a read-only state and disallow any executions from it (freeze it) – Jon – 2015-05-31T02:49:23.817
2as long as you don't execute or copy anything from the drive the infection is not likely to hop to another drive or system, I always disable autorun on all my PC's. Best bet is to have a stand alone PC that is only used for disinfecting drives, keep a known clean image of the OS for your bench PC, so you can re-image it if it does get infected, I did PC disinfection for over 10 years and never had a virus hop over to my bench machine while scanning/cleaning drives. – Moab – 2015-05-31T02:53:42.453
1Sandboxie isn't 100% malware can still escape, there are known vulerabilities, to say there are not good anti-virus software for linux isn't true. Furthermore you can scan the hdd using boot solutions of Windows programs before you do anything. – Ramhound – 2015-05-31T03:14:04.400