Anti Ransomware Script

#! /bin/bash

###################################################
# DESCRIPTION
###################################################
# COPYRIGHT (C) applehelpwriter.com / Phil Stokes 2016
# For more info go to:

# http://applehelpwriter.com/how-to-stop-ransomware-infecting-backup-disk


# This script is for use with a CARBON COPY CLONER (BOMBICH SOFTWARE / www.bombich.com)
# Scheduled backup task
# Tested on CCC v4.1.7, Mac OS X 10.11.4


# This script aims to abort the scheduled backup if the percentage
# of changed files in a given 'Canary' directory exceeds a user-defined threshold.



###################################################
# USAGE
###################################################


# 1.
# In the USER PREFERENCES section below, alter the following THREE paths names:

# i. BACKUPDISK="<path to your /Volumes/[destination drive]/Users/user_name/some folder>"
# ii. HOMEVOL="<path to your source vol home folder>"
# iii. LOGFILE="<make up a name>" #we suggest something inconspicuous

# 2.
# Set the threshold to as low as you can reliably get away with


# 3.
# Save the script to a local folder
# Recommended: give the script an inconspicuous name
# like NOT**** "anti-ransomware.sh" ****
# (i.e., make it harder for an attacker to identify and find)
# Recommended: do NOT locate the script in the CCC default Scripts folder
# (i.e., make it harder for an attacker to identify and find)
# Recommended: locate the script outside of your Home folder


# 4.
# Open CCC, select the task from the sidebar
# Locate the 'BEFORE TASK RUNS' section.
# Select the script from the location in 3. above



###################################################
# USER PREFERENCES
###################################################

# path to the home folder on the BACKUP DESTINATION disk, e.g:
BACKUPDISK="/Volumes/MYBACKUP DISK 500GB/Users/phil/MyFolder"

# path to the home folder on your internal SOURCE drive
HOMEVOL="/Users/phil/MyFolder"

# invent a filename here, it doesn't need to exist initially:
LOGFILE="My Family Stuff"

# threshold in percent
Threshold=10

###################################################
# SCRIPT LOGIC
###################################################

LOGPATH="$HOMEVOL"/"$LOGFILE"

# get the total file count on the destination
if cd "$BACKUPDISK"; then
        DestHomeFileCount=$(ls -Rl | grep -v ^l | wc -l)
    else
    exit 0
fi

# get the total number of changes btw src & dest
SrcDestDiffCount=$(
    diff -rqN "$HOMEVOL" "$BACKUPDISK" | wc -l
)

# find the percentage of change
ChangeLimit=$(
    echo $(((DestHomeFileCount / 100) * Threshold))
)

# determine if task should run
if ((SrcDestDiffCount < ChangeLimit)); then
        MSG="run"
    else
        MSG="be aborted"

fi

# log and write to the Canary to update the modification time
printf "\n%s" `date` >> "$LOGPATH"
printf "\nDestination %s has %d files in the canary folder\nThere are %d changes between it and the source %s.\nThe threshold for aborting the backup task is approx %d percent, or %d not more than changes.\nResult: task will %s." "$BACKUPDISK" "$DestHomeFileCount" "$SrcDestDiffCount" "$HOMEVOL" "$Threshold" "$ChangeLimit" "$MSG" >> "$LOGPATH"


if [ "$MSG" == "be aborted" ]; then

        # abort scheduled backup
        /Applications/Carbon\ Copy\ Cloner.app/Contents/MacOS/ccc -x

fi

exit 0