Restore only non existing files

[getzjd]

We had a file server get hit with ransomware to the tune of several thousand files. How could I utilize Veeam to recover from this while not overwriting the files that changed between 10pm last night and 5pm today? The ransomware has changed all the affected files to the same file extension WANRPRJ . If I were using Backup Exec, I could simply delete all of the WANRPRJ files, run a restore in Backup Exec and select the option to "Skip if the file exists". This would leave all unaffected files in place and replace only those affected. This is what I am doing at one site where we still use tape backup.

The only idea I have for the other site where the file server is backed up with veeam is to restore the full VM, pull a tape backup, then initiate a restore. As you can imagine, this would take several hours just to take the backup, then several hours to restore etc.

Ideas to speed this up?

[getzjd]

Or... I reckon I could just copy to from restore guest files and skip existing files.. duh.. this will probably work just fine

[getzjd]

Well.. that gives me the option to overwrite or keep. Keep places a prefix of RESTORED on the folders. I need these things to go back to the original directory paths, skipping existing files and copying missing files.

[getzjd]

Got it... just open the backup in explorer, copy past and skip the duplicates

[dellock6]

Jay, you can also mount the data disk as a slave disk into the VM using Instant VM recovery. There's a trick to change the UUID of the vmdk in VMware (I explained it here: http://www.virtualtothecore.com/en/rest ... -recovery/).
Once it's mounted you can use robocopy with proper switch options, I think /mir flag should work, it compares source and destination and copies only the differences.
Better test it first with a subset...

[getzjd]

Thanks Luca. The only issue I ran into was that the explorer browser had troubles copying over a tb of files (windows issue, not a veeam issue) as it wouldn't prompt to skip duplicates. I had to copy the folders in smaller chunks.

Maybe Veeam could add this to the wish list... restore files to SAME directory, not one labeled RESTORED, but skip duplicates and/or modified after x time.

[J222]

Thought.

Start a file level recovery, drop to a command prompt and do an xcopy from c:\veeamflr, leveraging the switches that xcopy brings to the table (i.e. - xcopy /d:12-15-2014)

[getzjd]

Thanks J222. I got through it by copying them in smaller chunks. Just stunk that Veeam wouldn't only restore the missing files and skip the existing.

[larimerE]

I also vote for enhancement to not overwrite existing files in the folder and do this recursively through all subsequent folders down the chain. Otherwise this process is unbelievably tedious even using robocopy for a 7 TB file server. It is actually shocking to me that Veeam does not have this option. It is a very common restore request even when ransomware is not involved.

[Gostev]

If it was, we would probably hear this request more than once in 8 years

[frvw]

Hello,

Several customers have had the crypto virus. Therefor I remove all encyrpted files and want only to restore the missing files to their original location.
Existing files may not be overwrited since they may have been changed.

Copy to...: overwites
Restore > Keep: Is in another folder, this takes too much place on the disk.
Restore > Replace: overwrites

I don't want to restore to another disk. If you have lots of VM's where you have files to restore, this takes way too much time and manual effort.

Has anyone got an idea?

Thanks in advance,
Frédéric

[frvw]

Hello,

Even more: as administrator you don't have access to personal folders by default. Changing ownership and security of all folders would include a security risk. Doing that for each folder individually would take too much time. So the best thing would be to restore from Veeam directly into the right folder.

Thanks for the tips.
Kind regards,
Frédéric

[foggy]

Frédéric, there's currently no "skip existing files" option in file-level restore, so you'd have to use one of the workarounds mentioned in this thread (I'd personally go with a copy/paste from Backup Browser with "skip duplicates" option).

[lando_uk]

I've had this same issue and I find the Veeam File Explorer very limiting with the lack of advanced options. All our main file serves are still backed up by Commvault because of this - its annoying. For example we often use the `replace permissions only` restore option when people muck up folder permissions

We shouldn't have to use any of these workarounds that involve robocopy etc. IMO, this is basic stuff that should be part of the restore process.

Also the speed of restores is abysmal for restores 50,000+ files, took us hours to recover from a ransomware hit last month, Commvault could restore a million files in the same timeframe.

(hey, don't get me wrong, I dislike Commvault and I'd like to get rid, but until these limitations of Veeam are dealt with, then we are stuck with using 2 systems)

[foggy]

Mark, thanks for this feedback. We are working on some improvements in FLR performance in v9.

[nathanael.duke]

I'm posting this on behalf of a gentleman with case# 01099261 who also wanted to see if it would be possible to integrate more granular restore options like "Copy only missing". This was also related to Cryptowall.

Currently, we're using robocopy with the /xo /xc and /xn switches from the C:\VeeamFLR mount, and it seems to be working well. The documentation for Robocopy from Server 2008/2008r2/2012 refers to the /xc option as "/xct", but I'm not sure if this is a typo on Microsoft's part, or if it's just for a different version of the robust copy tool.

https://technet.microsoft.com/en-us/lib ... 33145.aspx

[caroot]

Hello.

I miss the following feature:

If a folder is selected for restore it would be nice if only the missing content could be restored.
At the moment I need to restore a folder and copy the missing content to the original folder and delete the restored folder.

How does the rest of you guys solve this or don´t you have this problem?

[foggy]

Dominic, thank your for the feedback. I'm merging your post into existing discussion with similar requests, assuming you're also talking about FLR, right?

[caroot]

Hello.
Yes I am talking about FLR.
I did not see this topic and I opened a feature request ticket.
They told me I should/ could open a topic here to see whether I am the only one with this issue or others also miss that.
Now I know I am not the only one.

In my case I have several restores in a week and it is much easier to click this option than to open a FLR and go to the folder and make a manual copy of files..
Would be ok as workaround but I think it should be an option in the restore menu.

[foggy]

I see the case, thanks for explanation.

[Fiskepudding]

I guess this is not a vote post, but I found myself in need of this function today as well.
Because of the amout of files involved i ended up restoring to temp location and robocopy to target, to only transfer missing files.

In addition to "Overwrite" and "Keep" a restore option "Missing files only" would be handy.

[bleyers]

THe missing files option would come in handy some times...

[Steen]

If it was, we would probably hear this request more than once in 8 years

We could use the option to only restored deleted files....

[dguidry]

Has this feature ever been added or addressed by Veeam? Like the others, we've had an employee open a bad attachment this morning and encrypt around 15000 files. It would be EXTREMELY HANDY to have the ability to restore only missing files. I'm dreading the process in front of me to do it manually. I just attempted to do a restore and the only options appear to still be Overwrite or Keep, which means I'm going to have to restore a huge amount of data to a temporary location before I can then robocopy it over or something along those lines.

With the rise of ransomware, you guys really need to get this feature added to Veeam.

[tbwalkeriii]

I sure wish I had the feature/option in Veeam to restore only missing files also.

We were just hit with ransomware on Friday that encrypted and renamed about 12,000 files before we caught and stopped it. All of those files that were encrypted were renamed as .ODIN type files. The files that were overwritten were thousands of small .xls and .doc files, along with a handful of .key files.

The total size of all of the files that were destroyed is less than 1GB, however these files are scattered throughout our file server in folders that contain hundreds of AutoCAD engineering files that are on average 100MB each. If I try and do a full restore, I will be overwriting alot of unnecessary files, and my restore will go from less than 1GB of data being restored to over 1.2TB of data being restored. Not to mention that alot of the files that I could be restoring over might have just been updated/changed in the last hour.

So now I go folder by folder, spending my entire day manually recovering only the missing files I need. Not having a "restore only missing files" feature really sucks, Veeam. It really does.

Ted

[dguidry]

Sounds like you got the exact same one we did. After a bit of research, it appears to be a new variant of the Locky ransomware. A lot of our employees received .doc and .xls attachments with filenames in the format of "Receipt ###-###". Our Barracuda spam filter and every AV program I threw it at let it through with no warning or quarantine of any sort, so it's apparently a very new variant.

It ended up taking me a few days to get this sorted. I had to open a restore session in Veeam and then explore the folders connected to the affected file shares, then build a Robocopy command line to copy the missing files, THEN build another Robocopy command line to re-iterate through and fix the file ownership (which for some reason Robocopy wouldn't do on the first pass). This ended up being quite a headache and was compounded by Veeam timing out the restore operation during my testing if I let it sit for too long while researching.

If only Veeam supported a "restore missing" option, then this could have been fixed within 30 minutes. I plan to submit an enhancement request to support, I'd advise anyone and everyone else do the same. The more that are submitted, the more likely that they'll address this.

[alanbolte]

If only Veeam supported a "restore missing" option, then this could have been fixed within 30 minutes. I plan to submit an enhancement request to support, I'd advise anyone and everyone else do the same. The more that are submitted, the more likely that they'll address this.

This forum is the correct place for feature requests, no need to open a support case.

[tbwalkeriii]

Hello Dev Team,

I’d like to request a restore option that would restore only files that are “missing”. This would come in extremely handy in the event of a ransomware attack. We just had such an attack that encrypted and renamed over 5000+ files on our main fileserver, scattered across about 1000+ folders.

If a “restore only missing files” feature existed, I would have been able to quickly restore the 5000+ files without jumping through a lot of extra hoops (like restoring 100% of the 1000+ folders to an alternate location and using robocopy to copy only missing files).

Ransomware attacks are on the rise, and being able to automatically restore only the files that now appear “missing” (because they were renamed by the ransomware), would be a great feature to have.

If there are other Veeam users that believe this would be a good feature, please reply and chime in.

Thanks

TBWalker

[lando_uk]

I second - like a said a year ago, we have to use Commvault for our home folders as Veeam doesn't work for ransomware restores. Lets hope v9.5 is better.

[csinetops]

Add me to the list of customers that this would help tremendously.