Skip to main content
BlueXP ransomware protection

Recover from a ransomware attack (after incidents are neutralized)

Contributors amgrissino
PDFs

After workloads have been marked "Restore needed", BlueXP ransomware protection recommends a recovery point actual (RPA) and orchestrates the workflow for a crash-resistant recovery.

  • If the application or VM is managed by SnapCenter, BlueXP ransomware protection restores the application or VM back to its previous state and last transaction using the application-consistent or VM-consistent process. The application or VM-consistent restore adds any data that did not make it into storage, for example, data in cache or in an I/O operation, to the data in the volume.

  • If the application or VM is not managed by SnapCenter and is managed by BlueXP backup and recovery or BlueXP ransomware protection, BlueXP ransomware protection performs a crash-consistent restore, where all the data that was in the volume at the same point of time is restored, for example, if the system crashed.

    You can restore the workload by selecting all volumes, specific volumes, or specific files.

Tip Workload recovery can impact running workloads. You should coordinate recovery processes with the appropriate stakeholders.

A workload can have one of the following restore statuses:

  • Restore needed: The workload needs to be restored.

  • In progress: The restore operation is currently underway.

  • Restored: The workload has been restored.

  • Failed: The workload restore process could not be completed.

View workloads that are ready to be restored

Review the workloads that are in the "Restore needed" recovery status.

Steps

  1. Do one of the following:

    • From the Dashboard, review the "Restore needed" totals in the Alerts pane and select View all.

    • From the menu, select Recovery.

  2. Review the workload information in the Recovery page.

    Recovery page

Restore a workload managed by SnapCenter

Using BlueXP ransomware protection, the storage administrator can determine how best to restore workloads either from the recommended restore point or the preferred restore point.

The application state will change if required for the restore. The application will be restored to its previous state from control files, if they are included in the backup. After the restore finishes, the application opens in READ-WRITE mode.

Steps

  1. From the BlueXP ransomware protection menu, select Recovery.

  2. Review the workload information in the Recovery page.

  3. Select a workload that is in the “Restore needed” state.

  4. To restore, select Restore.

  5. Restore scope: Application-consistent (or for SnapCenter for VMs, the restore scope is "By VM")

  6. Source: Select the down arrow next to Source to see details. Select the restore point that you want to use to restore the data.

    Tip BlueXP ransomware protection identifies the best restore point as the latest backup just before the incident and shows a “Recommended” indication.

  7. Destination: Select the down arrow next to Destination to see details.

    1. Select the original or alternate location.

    2. Select the working environment.

    3. Select the Storage VM.

  8. If the original destination does not have enough space to restore the workload, a "Temporary storage" row appears. You can select the temporary storage to restore the workload data. The restored data will be copied from the temporary storage to the original location. Click on the Down arrow in the Temporary storage row and set the destination cluster, storage VM, and local tier.

  9. Quarantine location: Optionally, select where you want to store potentially infected data before you initiate the restore process for further analysis post recovery.

  10. Select Save.

  11. Select Next.

  12. Review your selections.

  13. Select Restore.

  14. From the top menu, select Recovery to review the workload on the Recovery page where the status of the operation moves through the states.

Restore a workload not managed by SnapCenter

Using BlueXP ransomware protection, the storage administrator can determine how best to restore workloads either from the recommended restore point or the preferred restore point.

The security storage admin can recover data at different levels:

  • Recovery all volumes

  • Recover an application at the volume level or file and folder level.

  • Recover a file share at the volume level, directory, or file/folder level.

  • Recover from a datastore at a VM level.

The process differs slightly depending on the workload type.

Steps

  1. From the BlueXP ransomware protection menu, select Recovery.

  2. Review the workload information in the Recovery page.

  3. Select a workload that is in the “Restore needed” state.

  4. To restore, select Restore.

  5. Restore scope: Select the type of restore you want to complete:

    • All volumes

    • By volume

    • By file: You can specify a folder or single files to restore.

      Tip You can select up to 100 files or a single folder.

  6. Continue with one of the following procedures depending on whether you chose application, volume, or file.

Restore all volumes

  1. From the BlueXP ransomware protection menu, select Recovery.

  2. Select a workload that is in the “Restore needed” state.

  3. To restore, select Restore.

  4. On the Restore page, in the Restore scope, select All volumes.

    Restore by all volumes page

  5. Source: Select the down arrow next to Source to see details.

    1. Select the restore point that you want to use to restore the data.

      Tip BlueXP ransomware protection identifies the best restore point as the latest backup just before the incident and shows a “Safest for all volumes" indication. This means that all volumes will be restored to a copy prior to the first attack on the first volume detected.

  6. Destination: Select the down arrow next to Destination to see details.

    1. Select the working environment.

    2. Select the Storage VM.

    3. Select the aggregate.

    4. Change the volume prefix that will be prepended to all new volumes.

      Tip The new volume name appears as prefix + original volume name + backup name + backup date.

  7. Quarantine location: Optionally, select where you want to store potentially infected data before you initiate the restore process for further analysis post recovery.

  8. Select Save.

  9. Select Next.

  10. Review your selections.

  11. Select Restore.

  12. From the top menu, select Recovery to review the workload on the Recovery page where the status of the operation moves through the states.

Restore an application workload at the volume level

  1. From the BlueXP ransomware protection menu, select Recovery.

  2. Select an application workload that is in the “Restore needed” state.

  3. To restore, select Restore.

  4. On the Restore page, in the Restore scope, select By volume.

    Restore by volume page

  5. On the list of volumes, select the volume you want to restore.

  6. Source: Select the down arrow next to Source to see details.

    1. Select the restore point that you want to use to restore the data.

      Tip BlueXP ransomware protection identifies the best restore point as the latest backup just before the incident and shows a “Recommended” indication.

  7. Destination: Select the down arrow next to Destination to see details.

    1. Select the working environment.

    2. Select the Storage VM.

    3. Select the aggregate.

    4. Review the new volume name.

      Tip The new volume name appears as the original volume name + backup name + backup date.

  8. Quarantine location: Optionally, select where you want to store potentially infected data before you initiate the restore process for further analysis post recovery.

  9. Select Save.

  10. Select Next.

  11. Review your selections.

  12. Select Restore.

  13. From the top menu, select Recovery to review the workload on the Recovery page where the status of the operation moves through the states.

Restore an application workload at the file level

Before you restore an application workload at the file level, you can view a list of impacted files. You can access the Alerts page to download a list of impacted files. Then use the Recovery page to upload the list and choose which files to restore.

You can restore an application workload at the file level to the same or different working environment.

Steps to get the list of impacted files

Use the Alerts page to retrieve the list of impacted files.

Tip If a volume has multiple alerts, you will need to download the CSV list of impacted files for each alert.

  1. From the BlueXP ransomware protection menu, select Alerts.

  2. On the Alerts page, sort the results by workload to show the alerts for the application workload that you want to restore.

  3. From the list of alerts for that workload, select an alert.

  4. For that alert, select a single incident.

    list of impacted files for a specific alert

  5. To see the full list of files, select Click here at the top of the Impacted files pane.

  6. For that incident, select the download icon and download the list of impacted files in CSV format.

Steps to restore those files

  1. From the BlueXP ransomware protection menu, select Recovery.

  2. Select an application workload that is in the “Restore needed” state.

  3. To restore, select Restore.

  4. On the Restore page, in the Restore scope, select By file.

  5. On the list of volumes, select the volume that contains the files that you want to restore.

  6. Restore point: Select the down arrow next to Restore point to see details. Select the restore point that you want to use to restore the data.

    Note The Reason column in the Restore points pane shows the reason for the Snapshot or backup as either "Scheduled" or "Automated response to ransomware incident."

  7. Files:

    • Automatically select files: Let BlueXP ransomware protection select the files to be restored.

    • Upload list of files: Upload a CSV file that contains the list of impacted files that you got from the Alerts page or that you have. You can restore up to 10,000 files at a time.

      Upload CSV file that lists the impacted files for the alert

    • Manually select files: Select up to 10,000 files or a single folder to restore.

      Select files manually to restore

      Note If any files cannot be restored using the selected restore point, a message appears indicating the number of files that cannot be restored and lets you download the list of those files by selecting Download list of impacted files.

  8. Destination: Select the down arrow next to Destination to see details.

    1. Choose where to restore the data: original source location or an alternate location that you can specify.

      Tip While the original files or directory will be overwritten by the restored data, the original file and folder names will remain the same unless you specify new names.

    2. Select the working environment.

    3. Select the Storage VM.

    4. Optionally, enter the path.

      Tip If you don't specify a path for the restore, the files will be restored to a new volume at the top-level directory.

    5. Select whether you want the names of the restored files or directory to be the same names as the current location or different names.

  9. Quarantine location: Optionally, select where you want to store potentially infected data before you initiate the restore process for further analysis post recovery.

  10. Select Next.

  11. Review your selections.

  12. Select Restore.

  13. From the top menu, select Recovery to review the workload on the Recovery page where the status of the operation moves through the states.

Restore a file share or datastore

  1. After selecting a file share or datastore to restore, on the Restore page, in the Restore scope, select By volume.

    Recovery page showing file share recovery

  2. On the list of volumes, select the volume you want to restore.

  3. Source: Select the down arrow next to Source to see details.

    1. Select the restore point that you want to use to restore the data.

      Tip BlueXP ransomware protection identifies the best restore point as the latest backup just before the incident and shows a “Recommended” indication.

  4. Destination: Select the down arrow next to Destination to see details.

    1. Choose where to restore the data: original source location or an alternate location that you can specify.

      Tip While the original files or directory will be overwritten by the restored data, the original file and folder names will remain the same unless you specify new names.

    2. Select the working environment.

    3. Select the Storage VM.

    4. Optionally, enter the path.

      Tip If you don't specify a path for the restore, the files will be restored to a new volume at the top-level directory.

  5. Select Save.

  6. Review your selections.

  7. Select Restore.

  8. From the menu, select Recovery to review the workload on the Recovery page where the status of the operation moves through the states.

Restore a VM file share at the VM level

On the Recovery page after you selected a VM to restore, continue with these steps.

  1. Source: Select the down arrow next to Source to see details.

    Recovery page showing a VM being restored

  2. Select the restore point that you want to use to restore the data.

  3. Destination: To original location.

  4. Select Next.

  5. Review your selections.

  6. Select Restore.

  7. From the menu, select Recovery to review the workload on the Recovery page where the status of the operation moves through the states.