Look back through history
Old backups are scanned again as new malware indicators become known.
The newest backup isn’t always the right one. We find the last clean one.
Ransomware often sits in your network for days or weeks before it encrypts anything. We use your backup history as a timeline to see when it got in, which recovery points are affected and what is safe to restore.
After a ransomware attack, the newest backup is often the wrong one.
Attackers tend to sit in a network for days before they encrypt anything. We use your backup history to find out when they arrived, so you restore from a point that is actually clean.
01 / 05
New indicators arrive
Threat indicators are published every day. When a new one comes in, we don't only check today's backup: we check every recovery point you still have, because yesterday's clean result was based on yesterday's knowledge.
02 / 05
Look back through history
The matching runs against our index of your backups, on our own infrastructure, so your production servers carry no extra load. Here the loader turns up in every point from 17 October onwards.
03 / 05
Find when it started
On 20 October at 03:14 more than eighteen thousand files were rewritten and their entropy jumped: the typical signature of encryption. Together with the first match, that gives a timeline: dormant from 17 October, active from the 20th.
04 / 05
Check it in isolation
We start the server as it was on 16 October in an isolated sandbox, with no network connection. No loader, no scheduled task, no calls home. Now we know this point can be trusted.
05 / 05
Restore without the infection
The server comes back from 16 October. Work saved after that date can be added back selectively, and every flagged file stays out of the restore. Your incident lead gives the go.
In short
You don't restore the attacker along with your data. The choice of recovery point is backed by evidence instead of guesswork, and that saves a second outage.
Technical detail
- Retrospective matching of new indicators (file hashes, file patterns, network indicators) against all retained recovery points, run on our infrastructure.
- Change analysis across backup history: number of changed files and entropy per point, to date the start of encryption.
- Historical machines can be booted in an isolated environment without network access to confirm a recovery point before it is used.
Example incident. No scan can prove a system is free of every threat. Containment and remediation stay with your incident response team; we deliver the recovery side.
Restore the wrong backup and you restore the attacker too.
Malware or unwanted changes may already be in a recent backup. Before restoring, you need to know when the compromise started and which recovery points you can still use.
Narrow down the timeline
We start historical systems in isolation to see when the suspicious activity began.
Choose on purpose
Affected files are flagged and known malware is kept out of the restore.
A clearer view of the incident, and a better restore.
Re-scanning old backups
We check historical backups against malware indicators that weren’t known when the backup was made.
Ransomware change analysis
We look for the patterns ransomware leaves behind across backup history, such as sudden mass changes to files.
Flagged content
Suspicious files and affected recovery points are marked, so they can be left out of the restore.
Isolated historical systems
We start old versions of machines in an isolated environment without network access to investigate.
Integrity checks
Restored data is compared with the selected backup to confirm it is what you intended.
The investigation runs on our own infrastructure.
Indexing and scanning backups happen in our data centre. Your team gets extra evidence without putting load on production systems that are already under pressure.
Older recovery points
Scanned again with today’s indicators.
First suspicious change
The investigation window gets smaller.
Recovery decision
Example investigationPick, exclude and verify.
Threat analysis helps you decide what to restore. No scan can prove a system is free of every threat. Containment, clean-up and approval stay part of the joint incident plan.
For management
After an attack you decide when the business restarts. We give you evidence of which recovery point is safe, so you don’t go down a second time.
For IT partners
Help a client after an attack without pulling your whole team away from other work.
How the partnership worksQuestions we get a lot
Something else? Call us on +31 (0)85 482 3400.
Does this replace incident response?
No, it supports it. We coordinate the recovery with your incident response, security and IT teams. Containment and clean-up are arranged separately.
Can a threat found today be detected in an old backup?
Yes. Re-scanning finds known indicators in historical backups. Results depend on the indicators available, how far back your history goes and the scope of the scan.
Can you pinpoint exactly when the attack started?
We can narrow the window down and show the first signs in the available recovery points. How precise that is depends on backup frequency, retention and what the attack left behind.
Let’s make the scope concrete.
Tell us about your environment and what you need. We’ll agree what is covered, who does what and the next step.