Modern ransomware hunts backups first, because a victim who can restore does not pay. If your image files sit on a drive the infected PC can reach, they are targets like any other file. Three layers decide whether they survive.
An .mrimg file has no magic armour: anything running on your PC with write access can encrypt or delete it. The defence is therefore not a Reflect setting alone - it is reach. Each layer below removes one way for malware on the PC to touch the images, and they stack.
One layer is a hope; two layers are a plan. The offline layer costs nothing but a habit.
An external drive that is unplugged cannot be encrypted, full stop. The working pattern: the backup runs, the drive comes out, and it lives away from the PC. Two drives rotated weekly mean one is always offline and one is always recent.
Yes, this fights with automation - the scheduled daily can target an always-available drive, while the unplugged rotation carries the weekly full. Convenience keeps the habit alive; disconnection keeps the copy alive.
Reflect includes Macrium Image Guardian (MIG), which watches the local volumes you point it at and blocks other processes from modifying or deleting image files - only Reflect itself may touch them. Against ransomware that simply overwrites or deletes every file it finds, that is a real wall.
The honest bounds: MIG guards local image stores it is set to watch, it is a Reflect feature rather than a general antivirus, and it cannot help a copy stored somewhere MIG is not running. It is a strong second layer, not a substitute for the first.
If images live on a NAS, the NAS must not be an open door: give the backup share its own credentials, used only by the backup, not saved as a permanently mapped drive with full rights on the PC. Where the NAS offers snapshots or immutable retention, turn them on - a version the PC cannot rewrite is a version ransomware cannot rewrite either.
And keep an older restore point. Ransomware is sometimes discovered days after it began, so retention that reaches back a few weeks is part of this defence, not just housekeeping.
Password-protecting or encrypting the image protects its contents from being read - a privacy feature. It does nothing against deletion or against the file itself being encrypted by malware. Both are worth having for the right reasons; just never mistake the lock on the diary for a second copy of the diary.
See every click in Macrium Reflect - the image, the settings and the restore - live in the full video.
▶️ Watch Full VideoYes. To ransomware, an image file is just a large file it can reach and write to - and attackers target backups deliberately because restorable victims do not pay. Reachability is the whole question.
No. MIG is a genuine protection for local image stores, but it guards only what it watches and only on that machine. Pair it with an offline or separately-credentialed copy and the two layers cover each other's gaps.
No - encryption protects the image from being read by others, not from being deleted or encrypted again. And guard the password: an encrypted image whose password is lost is unrecoverable by design.