Overview
The Ransomware Recovery page (/backups/ransomware) is the guided workflow for the worst day: a client has been hit, and you need to recover to a clean point fast — without restoring the infection along with the data. It works hand-in-hand with Anomaly Detection (which flags the encryption event) and Forensic Recovery (which finds the last-known-good point).
How To: Run a Ransomware Recovery
- Open Backups → Ransomware.
- Identify the affected devices. Anomaly Detection (
/backups/anomaly) usually flags the event first — a sudden mass change or size spike consistent with encryption. - Use Forensic Recovery (
/backups/forensic) to pinpoint the last clean restore point — the snapshot taken before the encryption began, so you don't reintroduce the payload. - Initiate the recovery to that clean point for the affected devices (restore the clean point onto the affected device or an alternate clean target; recovered files land in a staging tree, not over the live copy).
- Track each restore to completion and verify the recovered data is clean before returning the device to service.
Key Principle: Restore Clean, Not Compromised
The whole point of forensic/ransomware recovery is choosing the right point in time. Restoring the most recent backup may restore encrypted files or the malware itself. Always recover to the last point before the anomaly, then verify.
How To: Catch It Early
- Anomaly Detection watches for size drops/spikes and sudden behavior changes — the early signature of ransomware.
- Tune an alert rule (size anomaly type) to page on-call when it fires, so you start recovery in minutes, not the next morning.
Troubleshooting
Not sure which point is clean. Use Forensic Recovery's timeline — it correlates the anomaly window with backup history to recommend the last-good snapshot. Verify against the client's report of when symptoms started.
Anomaly didn't fire. Confirm anomaly detection is enabled and that the device has enough backup history to establish a baseline. A brand-new device has no baseline to deviate from yet.