Look back through history
Reassess older backups as new malware indicators become available.
Cyber recovery
Before you restore,
understand what happened.
Backup history is a timeline of your environment. We use that history to investigate suspicious changes, identify affected recovery points and support better recovery decisions.
See how it works
Look back through time.
Make a better recovery decision.
A threat discovered today can change how you assess yesterday’s backup. Explore how history helps the investigation.
01 / 04
Reassess the history
We compare retained backup information with newly available malware indicators and analyse changes that may point to ransomware activity.
02 / 04
Flag the affected points
Suspicious content and affected recovery points are flagged. Comparing earlier and later points helps locate the first observed signs in the available history.
03 / 04
Investigate in isolation
Boot a historical machine in an isolated environment to inspect its behaviour and support the investigation without reconnecting it to production.
04 / 04
Define the restore scope
Use the evidence to choose an appropriate recovery point, exclude identified malware from the selected restore scope and validate the agreed recovery.
For the person accountable
Get evidence to support recovery decisions, with historical investigation carried out on our infrastructure.
For the engineer
- Retrospective threat checks reassess retained backup information when new indicators become available.
- Use change patterns and isolated historical boots to narrow the first observed activity in the available history.
- Confirm exclusions and restore integrity alongside incident containment, remediation and authorisation.
Illustrative timeline, not live scan results. First observed evidence is not necessarily the start of compromise. Analysis supports recovery decisions; it cannot prove the absence of every threat.
The problem we help you solve
The latest backup
is not always the right one.
Malware or unwanted changes may already be present in a recent image. Recovery planning needs to consider when compromise began and which points remain appropriate to use.
Narrow the incident timeline
Investigate historical systems in isolation to understand when suspicious activity appeared.
Choose deliberately
Flag affected content and exclude identified malware from the selected restore scope.
What the service makes possible
A wider view of the incident.
A more informed recovery.
Retrospective threat checks
Compare historical backup information with newly available malware indicators to identify previously unrecognised threats.
Ransomware change analysis
Analyse changes across backup history for patterns that may indicate ransomware activity.
Flagged recovery content
Mark suspicious content and affected recovery points to inform restore selection and exclusion decisions.
Isolated historical systems
Boot and inspect historical machines in an isolated environment to support investigation.
Restore integrity checks
Compare restored content with the selected backup to help confirm that the restore matches the intended data.
Investigation without loading the client estate
Use the history.
Reduce the guesswork.
Backup indexing and assessment run on our infrastructure. Your team gains another source of evidence without placing that analysis workload on production systems.
Earlier recovery points
Reassess historical content.
Suspicious change appears
Narrow the investigation window.
Recovery decision
Illustrative investigation sequenceSelect, exclude and validate.
Threat analysis supports recovery decisions. No scan can prove that a system is free of every threat; incident containment, remediation and authorisation remain part of the coordinated plan.
Good questions
Clear answers.
Before you commit.
Is this a replacement for incident response?
It supports the recovery and investigation work. We coordinate the agreed recovery scope with your incident response, security and production IT teams. Containment and remediation responsibilities are defined separately.
Can a threat discovered today be found in an older backup?
Yes. Retrospective checks can identify known indicators in historical backup information. Results depend on available indicators, retained history and the scope of analysis.
Can you identify the exact start of every ransomware incident?
Historical investigation can narrow the window and identify the first observed signs in available recovery points. The precision depends on backup frequency, retained evidence and what the incident left behind.
Let’s make it concrete
Let’s make the scope clear.
Tell us about your environment and the outcome you need. We’ll agree coverage, responsibilities and the next practical step.