Skip to main content

Recover data after a ransomware attack with ONTAP ARP

Contributors netapp-dbagwell
PDFs

Autonomous Ransomware Protection (ARP) creates snapshots to protect against ransomware threats on NAS volumes. You can use ARP snapshots or another snapshot of your volume to restore data.

Note If you are running ONTAP 9.16.1 or later, see Recover data after a ransomware attack with ARP/AI.
About this task

Depending on the potential attack situation, you'll restore data in one of these ways:

ARP creates snapshots with the prepended name Anti_ransomware_backup. For example, Anti_ransomware_backup.2022-12-20_1248.

Before you begin

Choose a recovery method

Depending on the extent of data corruption and your operational requirements, choose one or a combination of these recovery methods.

  • Volume snapshot restore: Rolls back the entire volume to a selected snapshot (ARP or scheduled). This is the fastest method but removes all snapshots created after the restore point.

    Important For ONTAP 9.15.1 and earlier: ARP snapshots are deleted immediately when you run clear-suspect. You must complete volume snapshot restore before clearing. See Understand snapshot behavior when clearing a suspected event.

  • FlexClone from a clean snapshot: Creates a clone volume from the selected snapshot, preserving the original volume and all its snapshots for forensic analysis or additional recovery. It is recommended to split the clone from the parent volume to isolate the infected parent from the clean clone.

    Learn more about creating a FlexClone volume from a snapshot and splitting a FlexClone from its parent.

  • Single-file SnapRestore: Restores individual files from snapshots. Each file can be sourced from a different snapshot. This is practical when the number of affected files is relatively small.

    Learn more about restoring a single file from a snapshot.

  • Data copy from the .snapshot directory: Copies data from the snapshot mount point to a new volume using standard file copy operations. This method preserves the original volume and snapshots for analysis.

  • Hybrid approach: The volume is first rolled back to the closest clean snapshot using SnapRestore, then any remaining corrupted files are restored individually from another snapshot or external backup.

Recovery constraints and considerations

  • In ONTAP 9.15.1 and earlier, ARP snapshots are deleted immediately when you run clear-suspect. This applies regardless of whether you mark the activity as a false positive or a real attack. If you plan to use volume snapshot restore, you must complete the restore before clearing suspected events.

  • Releasing the ARP snapshot lock is only required when you use volume snapshot restore to restore from an earlier snapshot. It is not required for FlexClone, single-file SnapRestore, data copy operations, or similar methods.

  • If you restore an ARP-protected volume from a snapshot while it participates in a SnapMirror asynchronous relationship, manually update all mirror copies after the restore. Otherwise, mirror copies can become unusable and might need to be deleted and recreated.

  • ARP (9.10.1 to 9.15.1) does not support SnapMirror synchronous or SnapMirror active sync. These are ARP/AI-only features (ONTAP 9.19.1 and later).

Restore after a system attack

For volume snapshot restores, choose one of these flows depending on the snapshot source and situation:

Restore from the most recent ARP snapshot

Choose this flow when you can confidently restore from the most recent ARP snapshot, which is the most up-to-date snapshot available for recovery.

System Manager

  1. Select Storage > Volumes, then select the volume and Snapshot Copies.

  2. Select Menu options icon next to the most recent ARP snapshot (Anti_ransomware_backup) you want to restore, then select Restore.

  3. After the restore completes, return to the respond flow to clear suspected files.

CLI

  1. List the snapshots in a volume:

    volume snapshot show -vserver <svm> -volume <volume>

  2. Restore the contents of a volume from a snapshot:

    volume snapshot restore -vserver <svm> -volume <volume> -snapshot <snapshot>

  3. After the restore completes, return to the respond flow to clear suspected files.

Restore from an earlier snapshot

Choose this flow when you want to restore from an earlier snapshot. Release the lock on the most recent ARP snapshot before restoring from the earlier snapshot.

Important

In ONTAP 9.15.1 and earlier, clearing the suspected event deletes ARP snapshots immediately. In this flow, you are intentionally restoring from an earlier snapshot (not the ARP snapshot), so clearing first is required to release the lock. If you need data from the ARP snapshot, use the Restore from the most recent ARP snapshot flow instead.
System Manager

  1. Release the lock on the most recent ARP snapshot:

    1. Select Storage > Volumes.

    2. Select Security then View Suspected File Types.

    3. Mark the files as "Potential ransomware attack".

    4. Select Update and Clear Suspected File Types.

  2. Select Storage > Volumes, then select the volume and Snapshot Copies.

  3. Select Menu options icon next to the earlier snapshot you want to restore, then select Restore.

CLI

  1. Mark the attack as potential ransomware (-false-positive false) and clear suspect files to release the lock:

    Important This immediately deletes ARP snapshots in ONTAP 9.15.1 and earlier. Only run this command when you intend to restore from an earlier (non-ARP) snapshot and do not need the ARP snapshot. 
    security anti-ransomware volume attack clear-suspect -vserver <svm_name> -volume <vol_name> [<extension identifiers>] -false-positive false

  2. List the snapshots in a volume:

    volume snapshot show -vserver <svm> -volume <volume>

    The following example shows the snapshot in vol1:

    clus1::> volume snapshot show -vserver vs1 -volume vol1

Vserver Volume Snapshot                State    Size  Total% Used%
------- ------ ---------- ----------- ------   -----  ------ -----
vs1	    vol1   hourly.2013-01-25_0005  valid   224KB     0%    0%
               daily.2013-01-25_0010   valid   92KB      0%    0%
               hourly.2013-01-25_0105  valid   228KB     0%    0%
               hourly.2013-01-25_0205  valid   236KB     0%    0%
               hourly.2013-01-25_0305  valid   244KB     0%    0%
               hourly.2013-01-25_0405  valid   244KB     0%    0%
               hourly.2013-01-25_0505  valid   244KB     0%    0%

7 entries were displayed.

  3. Restore the contents of a volume from a snapshot:

    volume snapshot restore -vserver <svm> -volume <volume> -snapshot <snapshot>

    The following example restores the contents of vol1:

    cluster1::> volume snapshot restore -vserver vs0 -volume vol1 -snapshot daily.2013-01-25_0010

Restore when no attack is identified

When no attack is identified, first restore from the most recent ARP snapshot and then restore from an earlier snapshot.

System Manager

  1. Select Storage > Volumes, then select the volume and Snapshot Copies.

  2. Select Menu options icon then choose the most recent Anti_ransomware_backup snapshot.

  3. Select Restore.

  4. Return to the Snapshot Copies menu, then choose the earlier snapshot you want to use.

  5. Select Restore.

CLI

  1. Restore from the most recent ARP snapshot first:

    1. List the snapshots in a volume:

      volume snapshot show -vserver <svm> -volume <volume>

    2. Restore the contents of a volume from a snapshot:

      volume snapshot restore -vserver <svm> -volume <volume> -snapshot <snapshot>

  2. Select the earlier snapshot you want to use and repeat the restore.

Learn more about volume snapshot in the ONTAP command reference.