Protection against data hijacking (ransomware)

A ransomware attack is not a disk breaking. It is a program that gets in —almost always through a PC in the house, not through the NAS—, encrypts everything it can write to and leaves a note asking for money. And the first thing every strain going around today does is look for the backups and delete them, because they know that is the only thing that spoils their business.

So this guide is not about "making backups". It is about the backups still being there when it happens.

What protects you and what does not

Measure	Does it save you from encryption?	Why
RAID (mirror, RAID-Z)	No	RAID copies whatever you send it, encrypted files included. It protects you from a disk failing, nothing else.
The shared folder's recycle bin	No	It lives inside the same folder and with the same permissions: whoever encrypts also empties it.
An ordinary snapshot	Halfway	Its contents cannot be modified, but the snapshot can be deleted by anyone who gets root.
A locked snapshot	Yes	ZFS refuses to destroy it while the lock is on. This is the one to use.
A backup on an unplugged USB disk	Yes	What is not plugged in does not get encrypted. It is still the best backup there is.
A backup to the cloud or another server	Halfway	If the NAS can write and delete at the destination, so can the attacker. See below.

1. Locked snapshots (the first thing to do)

Storage → Snapshots. Every snapshot of a ZFS pool has a Protect button. Pressing it puts a ZFS "hold" on it, and from that moment on:

The panel's Delete button will not remove it (it is greyed out).
The scheduled tasks' automatic clean-up by age will not remove it.
zfs destroy from the console will not remove it, not even as root: the filesystem refuses while the lock is on.

To take it off you have to go into the panel, press Protected and confirm. That is deliberately a manual step: if a program could remove it on its own, it would be worthless.

Btrfs has no equivalent. Its snapshots are read-only, but anyone with root deletes them with one command. If you take this seriously, the pool goes on ZFS.

How many to protect. One lock for each point you would want to go back to: the last quiet day, and one per month. The daily ones can keep rotating without a lock. Bear in mind that a protected snapshot takes up room forever —it keeps everything that changed after it—, so check its size in the list now and then and remove the ones you no longer need.

2. Automatic snapshots, and one before the backup

Control Panel → Scheduled tasks → a snapshot task, with its retention. Recommendation for a home: one daily at 3:00 with a retention of 14.

A snapshot is instant and takes up nothing when created (it only grows as the data changes), so being generous is cheap.

3. Making the off-site backup impossible to delete from the NAS

Here is the flaw almost everybody has: the NAS stores the destination's password, so whoever controls the NAS also controls the backup. Your options, best first:

A USB disk you plug in, copy to and unplug. It sounds old-fashioned and it is the most effective thing there is. Once a week is enough.
Cloud storage with its own recycle bin or versions. Google Drive and OneDrive keep deleted files in their own bin for 30 days, and that bin cannot be touched from the NAS: if you get encrypted and the backup uploads encrypted files, you can still recover the previous version from the provider's website. That is why a cloud destination is not a luxury.
A server over SSH at a relative's house with an account that can only write, never delete. That has to be set up at the destination, not from here.

In all three cases the NAS backup keeps previous versions: see Backups.

4. Reducing what an infected PC can reach

One shared folder per thing, and permissions per user. If the living-room laptop only mounts Documents, encryption from there does not reach Photos. Control Panel → Shared folders → permissions.
Guests, read-only. Control Panel → SMB → the folder → read only.
Do not leave SMB open to the internet. Port 445 on the router is the most used way in there is. To get in from outside, use the VPN.
Different passwords for the panel, for SMB and for the Windows user.

5. If it has already happened

Unplug the NAS network cable. Before anything else: while it is connected, the encryption keeps spreading over the network.
Do not pay and do not reboot the infected PC; switch it off.
Get into the panel from the machine's own monitor (kiosk mode) or with a network cable straight to a laptop.
Storage → Snapshots: find the last one before the disaster —the date on the encrypted files tells you when it started— and use Restore.

On ZFS, restoring does a rollback: the dataset goes back to that moment and **later snapshots are deleted**. Protect the one you are about to use first, in case you got the date wrong.
On Btrfs, restoring leaves a separate writable copy that you check before replacing anything.

Clean the PC it came from before connecting the NAS back to the network. Otherwise it happens again.

The full procedure, with the failed-disk and reinstall variants, is in Disaster recovery.

Yearly check (5 minutes)

Is the last locked snapshot from this month? → Storage → Snapshots.
Did the last backup finish cleanly? → Backups → history.
Do you know how to restore? → restore any file at all from a snapshot and open it. A backup you have never restored is not a backup.