Finding the newest clean restore point, and recovering with two people

Contents

1. 1Executive summary
2. 2The challenge
3. 3Architecture
4. 4How it works
5. 5Capabilities in detail
6. 6Security and data handling
7. 7Where it fits
8. 8Deployment and system requirements
9. 9Technical specifications
10. 10Getting started

1Executive summary

CyberRecover turns ransomware alerts into a recovery incident, holds the last known-good restore point, checks restore points by bisection for the attacker’s files and rolls the server back with a second person approving — moving the attacker’s files aside, never deleting them.

2The challenge

After ransomware the hard question is not whether a backup exists but which one is clean. Restore too new and the attacker’s files come back; restore too old and days of work are lost.

The TotalHeal approach. CyberRecover turns ransomware alerts into a recovery incident, holds the last known-good restore point, checks restore points for the attacker’s files and rolls the server back with a second person approving.

3Architecture

4How it works

1. HoldThe newest point before detection minus 15 minutes is held for 90 days.
2. CheckCandidate points are checked by bisection for incident indicators.
3. ApproveA second person approves the rollback.
4. Roll backFiles restored; the attacker’s files moved aside.

5Capabilities in detail

• Alert to recoveryRansomware, inhibit-recovery and destruction alerts on a protected server open a recovery incident: the newest committed point before detection minus 15 minutes is held for 90 days and later points are marked suspect.
• Clean check by bisectionUp to 30 candidate points are checked by bisection: a file whose hash is an incident indicator makes a point dirty; ransom notes and encrypted copies mark it for review.
• False positives never delay recoveryName-based hints only mark a point for review; they never push recovery further back.
• One-step rollbackRoll the server back to the chosen point with a second person approving; files the attacker created are moved aside, never deleted.
• Frozen evidenceChanged files are frozen in new backups so evidence survives the clean-up.

6Security and data handling

• Never deletesAttacker files are moved aside for evidence.
• Two peopleRollbacks need a second person.
• No false delaysName-based hints never push recovery back.

7Where it fits

8Deployment and system requirements

9Technical specifications

10Getting started

• TotalHeal RecoveryVault on the servers to recover

Start a 30 days trial in the TotalHeal console with a Sttiz account. For a quote, an on-premises installation or the procurement dossier (compliance matrix, bill of materials, architecture and hardening, SLA, OEM authorisation letter), write to business@totalhealsecurity.com.