TotalHealCyberRecover

How it works

1. HoldThe newest point before detection minus 15 minutes is held for 90 days.
2. CheckCandidate points are checked by bisection for incident indicators.
3. ApproveA second person approves the rollback.
4. Roll backFiles restored; the attacker’s files moved aside.

Reference architecture

Key capabilities

• Alert to recoveryRansomware, inhibit-recovery and destruction alerts on a protected server open a recovery incident: the newest committed point before detection minus 15 minutes is held for 90 days and later points are marked suspect.
• Clean check by bisectionUp to 30 candidate points are checked by bisection: a file whose hash is an incident indicator makes a point dirty; ransom notes and encrypted copies mark it for review.
• False positives never delay recoveryName-based hints only mark a point for review; they never push recovery further back.
• One-step rollbackRoll the server back to the chosen point with a second person approving; files the attacker created are moved aside, never deleted.
• Frozen evidenceChanged files are frozen in new backups so evidence survives the clean-up.

Deployment options

System requirements

Technical specifications