Ransomware Recovery Demo

The Importance of a Reliable Ransomware Recovery Solution

Ransomware is a prominent and real threat that has become a major problem for organizations across all industries. It can bring daily business operations to a halt and disrupt business continuity, leading to prolonged downtime and reputational damage. This can result in loss of revenue and customers. To combat this threat, many organizations are turning to data protection solutions like Commvault.

How does Commvault Cloud work in the event of a ransomware attack?

In the demo above, we showcase how Commvault performs a complete restore and recovers all files in the event of a ransomware attack. The demo begins with a typical scenario of a corporate laptop user. The user opens a few files to show essential content in their file system. However, most ransomware attacks occur when a user unknowingly opens an attachment from a suspicious email while browsing the web. The user launched Google Chrome and opened an email that appeared to be from a colleague. The user clicked on the attachment, assuming it was a file they needed to download for collaboration. However, the attachment contained ransomware that immediately started encrypting their data.

Next, the demo shifted to the perspective of an administrator. The administrator launched their email and noticed a file activity anomaly alert. Commvault provides administrators with various ways to detect potential security events, and in this case, an alert was sent via email. The administrator could see the details of the alert, including when it occurred and the number of files that were impacted.

The administrator then navigated to the Commvault Command Center dashboard, which provides a comprehensive view of all data and its management. Under the monitoring section, the administrator could drill down into any alerts and events and any unusual activity that may be affecting the files. By clicking on the unusual file activity, the administrator could see when the files were impacted, how many were affected, and where they were located. They could also see how the files were impacted, such as whether they were created, renamed, deleted, or modified.

What data recovery and restore options are available with Commvault Cloud?

Commvault offers various recovery options for administrators, including setting a recovery target and selecting which volumes need to be recovered. This is particularly useful for out-of-place recovery, where data needs to be recovered quickly while forensic investigations continue on the original systems. Additionally, administrators can perform a mass restore and recover all the last known good copies of data by restoring them as virtual machines.

After navigating back to the machine impacted by the ransomware, the administrator could see the encrypted files in the download section. By clicking on the affected files, they could confirm they were encrypted. In the Command Center, the administrator returned to the unusual file activity section and initiated the recovery process for the affected files. They could also navigate to the C drive and delete the malware from the downloads folder to prevent reinfection. Commvault automatically collected the last good copy of the affected files, making the recovery process faster and more efficient. The progress of the restore can be viewed in the job section, and the restore job was completed successfully.

Finally, the demo returned to the user’s machine, where they launched the previously affected files. To their relief, the data was back in its original state before the ransomware attack. This is just one example of how Commvault provides comprehensive protection against ransomware attacks. With the ransomware threat rising, organizations need a reliable data protection solution like Commvault to ensure their data is safe and recoverable during an attack.

How does Commvault help after a ransomware attack?

Commvault not only provides real-time monitoring and alerts but also allows IT teams to start their recovery plan immediately and mitigate the impacts of downtime associated with attacks. With Commvault, organizations can have peace of mind knowing that their data is protected and recoverable, even in the face of a ransomware attack.