A storage device is divided into a trusted storage region (TSR) and a standard storage region (SSR). A backup and recovery tool (BRT) is used to generate a public/private key pair and provide the public key to the storage device. The BRT detects a trigger to back up a file from the SSR to the TSR and sends a write instruction to the storage device to perform the backup. The BRT signs the write instruction with the private key. The storage device uses the public key to verify the write instruction and performs the backup based on the verification. The TSR cannot be accessed without the private key, therefore if a malware attack is detected in the storage device, the device may be formatted to delete infected files. A fresh operating system may be installed on the formatted storage device and the file may be recovered from the TSR.