Files, Disks, and What to Do When It Goes Wrong

Four tools, four different jobs:

• An encrypted archive is for sending a file or parking one somewhere shared. Use a modern format with AES-256 — in practice a .7z archive, which can also encrypt the file names if you turn on 7-Zip's “Encrypt file names” option. Avoid legacy password-protected ZIP: its scheme is broken and falls quickly if any file inside is already known, no matter how strong your password.
• An encrypted container is a file that mounts as a drive. It protects what is inside while it is closed and protects nothing once it is open on a running machine.
• Simple modern file encryption handles encrypt-this-for-this-person cleanly.
• And full-disk encryption, built into both desktop systems and on by default on phones, protects data at rest only after a full shutdown, or hibernate with a pre-boot PIN. A locked or sleeping machine still holds the disk key in memory, and encryption does nothing while the machine is unlocked and running, which is most of the time.

Backups are the control that makes the worst day survivable: three copies, two kinds of media, one off-site or offline. The offline part is the part people skip and the part ransomware depends on — a backup drive permanently attached to the machine gets encrypted along with everything else. And an untested backup is a hope, so restore one file and confirm the chain works.

Browser extensions deserve a line of their own. They see everything you do in the browser, and campaigns compromising millions of users at a time have been documented, including extensions bought from their original developers. Review the list, remove what you do not use, and be suspicious of an extension that changes hands.

When something does go wrong, the order is: change the password on the affected account and everywhere you reused it, strengthen the second factor, check which other accounts share that email, and if financial data was exposed, freeze your credit. Then write down what happened and when, while you still remember. That record is what makes a dispute, a claim or a report possible later.