Look back through history
Old backups are scanned again as new malware indicators become known.
After ransomware, we find the last recovery point the attacker wasn’t in yet.
Ransomware often sits in your network for days or weeks before it encrypts anything. We use your backup history as a timeline to see when it got in, which recovery points are affected and what is safe to restore.
After a ransomware attack, the newest backup is often the wrong one.
Attackers tend to sit in a network for days before they encrypt anything. We use your backup history to find out when they arrived, so you restore from a point that is actually clean.
01 / 05
New indicators arrive
Threat indicators are published every day. When a new one comes in, we check every recovery point you still have, including last week's, because yesterday's clean result was based on yesterday's knowledge.
02 / 05
Look back through history
The matching runs against our index of your backups, on our own infrastructure, so your production servers carry no extra load. Here the loader turns up in every point from 17 October onwards.
03 / 05
Find when it started
On 20 October at 03:14 more than eighteen thousand files were rewritten and their entropy jumped: the typical signature of encryption. Together with the first match, that gives a timeline: dormant from 17 October, active from the 20th.
04 / 05
Check it in isolation
We start the server as it was on 16 October in an isolated sandbox, with no network connection. No loader, no scheduled task, no calls home. Now we know this point can be trusted.
05 / 05
Restore without the infection
The server comes back from 16 October. Work saved after that date can be added back selectively, and every flagged file stays out of the restore. Your incident lead gives the go.
You don't restore the attacker along with your data. The choice of recovery point rests on what we found in the backups, and that saves a second outage.
Technical detail
- Retrospective matching of new indicators (file hashes, file patterns, network indicators) against all retained recovery points, run on our infrastructure.
- Change analysis across backup history: number of changed files and entropy per point, to date the start of encryption.
- Historical machines can be booted in an isolated environment without network access to confirm a recovery point before it is used.
Example incident. No scan can prove a system is free of every threat. Containment and remediation stay with your incident response team; we deliver the recovery side.
Restore the wrong backup and you restore the attacker too.
Malware or unwanted changes may already be in a recent backup. Before restoring, you need to know when the compromise started and which recovery points you can still use.
Narrow down the timeline
We start historical systems in isolation to see when the suspicious activity began.
Choose on purpose
Affected files are flagged and known malware is kept out of the restore.
The investigation runs on our own infrastructure.
Indexing and scanning backups happen in our data centre. Your team gets extra evidence without putting load on production systems that are already under pressure.
Older recovery points
Scanned again with today’s indicators.
First suspicious change
The investigation window gets smaller.
Recovery decision
Example investigationPick, exclude and verify.
Threat analysis helps you decide what to restore. No scan can prove a system is free of every threat. Containment, clean-up and approval stay part of the joint incident plan.
Managed backup Disaster recovery NIS2 reporting dutiesFor management
After an attack you decide when the business restarts. We give you evidence of which recovery point is safe, so you don’t go down a second time.
For IT partners
Help a client after an attack without pulling your whole team away from other work.
How the partnership worksQuestions we get a lot
Something else? Call us on +31 (0)85 482 3400.
Does this replace incident response?
No, it supports it. We coordinate the recovery with your incident response, security and IT teams. Containment and clean-up are arranged separately.
Can a threat found today be detected in an old backup?
Yes. Re-scanning finds known indicators in historical backups. Results depend on the indicators available, how far back your history goes and the scope of the scan.
Can you pinpoint exactly when the attack started?
We can narrow the window down and show the first signs in the available recovery points. How precise that is depends on backup frequency, retention and what the attack left behind.
Is it happening right now? Call us.
Otherwise we go through your backup history with you and what we can find in it, before anything happens.