Abstract: Examples of a computer system for malware detection and recovery include a computer having a processor and a memory having untrusted partition having untrusted data files and a trusted partition connected to the untrusted partition and having a backup application. The trusted partition may not be modifiable by the untrusted partition. The computer may be configured to detect whether a malware attack of the untrusted partition has occurred. In accordance with detecting that the malware attack has not occurred, the computer creates a trusted backup by storing at least some untrusted data files to a backup memory that is not modifiable by the untrusted partition. In accordance with detecting that the malware attack has occurred, the computer may prevent the creation of an additional trusted backup and may restore compromised files from the trusted backup.