cancel
Showing results for 
Search instead for 
Did you mean: 

Encryption Ransomware Restore

Techie10
Not applicable

Our server got hit with ransomware, when trying a restore no files are showing up to restore. Did the encryption infect the database that stores the files to restore so nothing can be displayed?

2 REPLIES 2

Ovi_I
Level 4

The backup exec server got hit?

Colin_Weaver
Moderator
Moderator
Employee Accredited Certified

We have seen customers get Backup Exec files hit by RansomWare -

 

if it hits backup to disk data files (BKF and IMG folders) or the Deduplication storage and you do not have copies of Backup Sets on tape or some other un-affacted media location then you won't be able to restore

 

If it hits the catalog folders (which is most likely based on your description) or other files relating to Backup Exec then you should be able to restore given a number of manual steps depending on what is broken first. (re-catalog media, possibly even re-install BE and then recatalog etc)

 

You kind of really need to work out what is affected though - or even consider starting with a clean server and move the backup sets to that so that you are sure that the ransomware is  not still around.