Performance Considerations for Ransomware Remediation

Hello,

I'm trying to decide whether to activate the Ransomware Remediation (RR) feature on a Windows 11 system. Performance is critical my use of the system, which is installed on an AMD Ryzen 7 with 16G RAM and a 500G SSD (less than 20% used).

Where does RR make its copies of files? In separate protected folder?
Does RR make a copy whenever the file is updated? Is this done asynchronously (lazy write), or is it synchronous with the file operation (resulting in real-time performance delays)?
Does RR operate at the filesystem driver level? If so, are there any cautions against use with other software that operates at the driver level?
How does RR interoperate with OneDrive?

I appreciate any guidance from Bitdefender support and/or the community.

Find more posts tagged with

Accepted answers

All comments

Gjoksi

Hello.

According to @Alexandru_BD, who works for Bitdefender:

"Ransomware remediation is not a replacement for a proper backup solution. The way ransomware remediation works is by monitoring which applications access/modify your files, and backing up those files, until a verdict is given for the application. If the application is deemed safe, the backup is deleted. If the application is deemed unsafe, their actions are blocked, and the files are restored to the original. The backups are only kept locally."

Anyway, i believe that @camarie , who works at Bitdefender as Principal Software Developer and/or @Alexandru_BD, can give you more insights on this matter.

Regards.

Alexandru_BD

Hello,

In short, enabling the Ransomware Remediation feature adds an extra layer of protection for your files, helping to prevent data loss in the event of a ransomware attack. I'll address your questions below.

Where does RR make its copies of files? In separate protected folders?
Ransomware Remediation protects your files by creating copies in secure locations, safeguarding them from ransomware attacks.

Does RR make a copy whenever the file is updated? Is this done asynchronously or synchronously?
Copies are made when files are modified, with minimal impact on performance.

Does RR operate at the filesystem driver level? Are there any cautions against use with other software that operates at the driver level?
The feature operates at the system level and should be compatible with most software.

How does RR interoperate with OneDrive?
There have been no significant reported incompatibilities with other software, including OneDrive, ensuring smooth operation and file synchronization.

I hope this brings more clarity.

Regards,

Alex