Comprehensive data protection for all workloads
getzjd
Enthusiast
Posts: 25
Liked: 3 times
Joined: Mar 12, 2012 3:10 am
Full Name: Jay
Location: Cincinnati, OH
Contact:

Restore only non existing files

Post by getzjd »

We had a file server get hit with ransomware to the tune of several thousand files. How could I utilize Veeam to recover from this while not overwriting the files that changed between 10pm last night and 5pm today? The ransomware has changed all the affected files to the same file extension WANRPRJ . If I were using Backup Exec, I could simply delete all of the WANRPRJ files, run a restore in Backup Exec and select the option to "Skip if the file exists". This would leave all unaffected files in place and replace only those affected. This is what I am doing at one site where we still use tape backup.

The only idea I have for the other site where the file server is backed up with veeam is to restore the full VM, pull a tape backup, then initiate a restore. As you can imagine, this would take several hours just to take the backup, then several hours to restore etc.

Ideas to speed this up?
getzjd
Enthusiast
Posts: 25
Liked: 3 times
Joined: Mar 12, 2012 3:10 am
Full Name: Jay
Location: Cincinnati, OH
Contact:

Re: Recovering from ransomware

Post by getzjd »

Or... I reckon I could just copy to from restore guest files and skip existing files.. duh.. this will probably work just fine :-)
getzjd
Enthusiast
Posts: 25
Liked: 3 times
Joined: Mar 12, 2012 3:10 am
Full Name: Jay
Location: Cincinnati, OH
Contact:

Re: Recovering from ransomware

Post by getzjd »

Well.. that gives me the option to overwrite or keep. Keep places a prefix of RESTORED on the folders. I need these things to go back to the original directory paths, skipping existing files and copying missing files.
getzjd
Enthusiast
Posts: 25
Liked: 3 times
Joined: Mar 12, 2012 3:10 am
Full Name: Jay
Location: Cincinnati, OH
Contact:

Re: Recovering from ransomware

Post by getzjd » 2 people like this post

Got it... just open the backup in explorer, copy past and skip the duplicates :-)
dellock6
Veeam Software
Posts: 6137
Liked: 1928 times
Joined: Jul 26, 2009 3:39 pm
Full Name: Luca Dell'Oca
Location: Varese, Italy
Contact:

Re: Recovering from ransomware

Post by dellock6 »

Jay, you can also mount the data disk as a slave disk into the VM using Instant VM recovery. There's a trick to change the UUID of the vmdk in VMware (I explained it here: http://www.virtualtothecore.com/en/rest ... -recovery/).
Once it's mounted you can use robocopy with proper switch options, I think /mir flag should work, it compares source and destination and copies only the differences.
Better test it first with a subset...
Luca Dell'Oca
Principal EMEA Cloud Architect @ Veeam Software

@dellock6
https://www.virtualtothecore.com/
vExpert 2011 -> 2022
Veeam VMCE #1
getzjd
Enthusiast
Posts: 25
Liked: 3 times
Joined: Mar 12, 2012 3:10 am
Full Name: Jay
Location: Cincinnati, OH
Contact:

Re: Recovering from ransomware

Post by getzjd »

Thanks Luca. The only issue I ran into was that the explorer browser had troubles copying over a tb of files (windows issue, not a veeam issue) as it wouldn't prompt to skip duplicates. I had to copy the folders in smaller chunks.

Maybe Veeam could add this to the wish list... restore files to SAME directory, not one labeled RESTORED, but skip duplicates and/or modified after x time.
J222
Veeam Software
Posts: 89
Liked: 11 times
Joined: Apr 20, 2012 8:43 pm
Full Name: Jason Acord
Contact:

Re: Recovering from ransomware

Post by J222 »

Thought.

Start a file level recovery, drop to a command prompt and do an xcopy from c:\veeamflr, leveraging the switches that xcopy brings to the table (i.e. - xcopy /d:12-15-2014)
getzjd
Enthusiast
Posts: 25
Liked: 3 times
Joined: Mar 12, 2012 3:10 am
Full Name: Jay
Location: Cincinnati, OH
Contact:

Re: Recovering from ransomware

Post by getzjd »

Thanks J222. I got through it by copying them in smaller chunks. Just stunk that Veeam wouldn't only restore the missing files and skip the existing.
larimerE
Novice
Posts: 4
Liked: 1 time
Joined: Jan 06, 2015 4:20 pm
Full Name: Elaine den Hoed
Contact:

Re: Recovering from ransomware

Post by larimerE » 1 person likes this post

I also vote for enhancement to not overwrite existing files in the folder and do this recursively through all subsequent folders down the chain. Otherwise this process is unbelievably tedious even using robocopy for a 7 TB file server. It is actually shocking to me that Veeam does not have this option. It is a very common restore request even when ransomware is not involved.
Gostev
Chief Product Officer
Posts: 31459
Liked: 6648 times
Joined: Jan 01, 2006 1:01 am
Location: Baar, Switzerland
Contact:

Re: Recovering from ransomware

Post by Gostev »

If it was, we would probably hear this request more than once in 8 years ;)
frvw
Lurker
Posts: 2
Liked: never
Joined: Aug 26, 2015 7:59 am
Full Name: Frédéric Van Walle

[MERGED] Restore only non existing files

Post by frvw »

Hello,

Several customers have had the crypto virus. Therefor I remove all encyrpted files and want only to restore the missing files to their original location.
Existing files may not be overwrited since they may have been changed.

Copy to...: overwites
Restore > Keep: Is in another folder, this takes too much place on the disk.
Restore > Replace: overwrites

I don't want to restore to another disk. If you have lots of VM's where you have files to restore, this takes way too much time and manual effort.

Has anyone got an idea?

Thanks in advance,
Frédéric
frvw
Lurker
Posts: 2
Liked: never
Joined: Aug 26, 2015 7:59 am
Full Name: Frédéric Van Walle

Re: Restore only non existing files

Post by frvw »

Hello,

Even more: as administrator you don't have access to personal folders by default. Changing ownership and security of all folders would include a security risk. Doing that for each folder individually would take too much time. So the best thing would be to restore from Veeam directly into the right folder.

Thanks for the tips.
Kind regards,
Frédéric
foggy
Veeam Software
Posts: 21069
Liked: 2115 times
Joined: Jul 11, 2011 10:22 am
Full Name: Alexander Fogelson
Contact:

Re: Recovering from ransomware

Post by foggy »

Frédéric, there's currently no "skip existing files" option in file-level restore, so you'd have to use one of the workarounds mentioned in this thread (I'd personally go with a copy/paste from Backup Browser with "skip duplicates" option).
lando_uk
Veteran
Posts: 371
Liked: 32 times
Joined: Oct 17, 2013 10:02 am
Full Name: Mark
Location: UK
Contact:

Re: Recovering from ransomware

Post by lando_uk » 1 person likes this post

I've had this same issue and I find the Veeam File Explorer very limiting with the lack of advanced options. All our main file serves are still backed up by Commvault because of this - its annoying. For example we often use the `replace permissions only` restore option when people muck up folder permissions

We shouldn't have to use any of these workarounds that involve robocopy etc. IMO, this is basic stuff that should be part of the restore process.

Also the speed of restores is abysmal for restores 50,000+ files, took us hours to recover from a ransomware hit last month, Commvault could restore a million files in the same timeframe.

(hey, don't get me wrong, I dislike Commvault and I'd like to get rid, but until these limitations of Veeam are dealt with, then we are stuck with using 2 systems)
foggy
Veeam Software
Posts: 21069
Liked: 2115 times
Joined: Jul 11, 2011 10:22 am
Full Name: Alexander Fogelson
Contact:

Re: Recovering from ransomware

Post by foggy »

Mark, thanks for this feedback. We are working on some improvements in FLR performance in v9.
nathanael.duke
Influencer
Posts: 10
Liked: 3 times
Joined: Apr 28, 2014 4:28 pm
Full Name: Nathanael JonCroft Duke
Contact:

Re: Recovering from ransomware

Post by nathanael.duke »

I'm posting this on behalf of a gentleman with case# 01099261 who also wanted to see if it would be possible to integrate more granular restore options like "Copy only missing". This was also related to Cryptowall.

Currently, we're using robocopy with the /xo /xc and /xn switches from the C:\VeeamFLR mount, and it seems to be working well. The documentation for Robocopy from Server 2008/2008r2/2012 refers to the /xc option as "/xct", but I'm not sure if this is a typo on Microsoft's part, or if it's just for a different version of the robust copy tool.

https://technet.microsoft.com/en-us/lib ... 33145.aspx
caroot
Novice
Posts: 3
Liked: 1 time
Joined: Nov 18, 2015 11:43 am
Full Name: Dominic Holz
Contact:

[MERGED] feature request: restore only deleted items

Post by caroot » 1 person likes this post

Hello.

I miss the following feature:

If a folder is selected for restore it would be nice if only the missing content could be restored.
At the moment I need to restore a folder and copy the missing content to the original folder and delete the restored folder.

How does the rest of you guys solve this or don´t you have this problem?
foggy
Veeam Software
Posts: 21069
Liked: 2115 times
Joined: Jul 11, 2011 10:22 am
Full Name: Alexander Fogelson
Contact:

Re: Restore only non existing files

Post by foggy »

Dominic, thank your for the feedback. I'm merging your post into existing discussion with similar requests, assuming you're also talking about FLR, right?
caroot
Novice
Posts: 3
Liked: 1 time
Joined: Nov 18, 2015 11:43 am
Full Name: Dominic Holz
Contact:

Re: Restore only non existing files

Post by caroot »

Hello.
Yes I am talking about FLR.
I did not see this topic and I opened a feature request ticket.
They told me I should/ could open a topic here to see whether I am the only one with this issue or others also miss that.
Now I know I am not the only one. :)

In my case I have several restores in a week and it is much easier to click this option than to open a FLR and go to the folder and make a manual copy of files..
Would be ok as workaround but I think it should be an option in the restore menu.
foggy
Veeam Software
Posts: 21069
Liked: 2115 times
Joined: Jul 11, 2011 10:22 am
Full Name: Alexander Fogelson
Contact:

Re: Restore only non existing files

Post by foggy »

I see the case, thanks for explanation.
Fiskepudding
Expert
Posts: 213
Liked: 26 times
Joined: Feb 01, 2012 7:24 am
Full Name: Espen Dykesteen
Contact:

Re: Restore only non existing files

Post by Fiskepudding »

I guess this is not a vote post, but I found myself in need of this function today as well.
Because of the amout of files involved i ended up restoring to temp location and robocopy to target, to only transfer missing files.

In addition to "Overwrite" and "Keep" a restore option "Missing files only" would be handy.
bleyers
Influencer
Posts: 22
Liked: 1 time
Joined: Nov 10, 2014 1:39 pm
Contact:

Re: Restore only non existing files

Post by bleyers »

THe missing files option would come in handy some times...
Steen
Service Provider
Posts: 51
Liked: 3 times
Joined: Mar 13, 2015 1:20 pm
Full Name: Steen
Contact:

Re: Recovering from ransomware

Post by Steen »

Gostev wrote:If it was, we would probably hear this request more than once in 8 years ;)
We could use the option to only restored deleted files....
Regards Steen
dguidry
Novice
Posts: 4
Liked: never
Joined: Sep 30, 2016 4:57 pm
Contact:

Re: Restore only non existing files

Post by dguidry »

Has this feature ever been added or addressed by Veeam? Like the others, we've had an employee open a bad attachment this morning and encrypt around 15000 files. It would be EXTREMELY HANDY to have the ability to restore only missing files. I'm dreading the process in front of me to do it manually. I just attempted to do a restore and the only options appear to still be Overwrite or Keep, which means I'm going to have to restore a huge amount of data to a temporary location before I can then robocopy it over or something along those lines.

With the rise of ransomware, you guys really need to get this feature added to Veeam.
tbwalkeriii
Lurker
Posts: 2
Liked: 1 time
Joined: Oct 03, 2016 6:17 pm
Full Name: Ted Walker
Contact:

Re: Restore only non existing files

Post by tbwalkeriii »

I sure wish I had the feature/option in Veeam to restore only missing files also.

We were just hit with ransomware on Friday that encrypted and renamed about 12,000 files before we caught and stopped it. All of those files that were encrypted were renamed as .ODIN type files. The files that were overwritten were thousands of small .xls and .doc files, along with a handful of .key files.

The total size of all of the files that were destroyed is less than 1GB, however these files are scattered throughout our file server in folders that contain hundreds of AutoCAD engineering files that are on average 100MB each. If I try and do a full restore, I will be overwriting alot of unnecessary files, and my restore will go from less than 1GB of data being restored to over 1.2TB of data being restored. Not to mention that alot of the files that I could be restoring over might have just been updated/changed in the last hour.

So now I go folder by folder, spending my entire day manually recovering only the missing files I need. Not having a "restore only missing files" feature really sucks, Veeam. It really does.

Ted
dguidry
Novice
Posts: 4
Liked: never
Joined: Sep 30, 2016 4:57 pm
Contact:

Re: Restore only non existing files

Post by dguidry »

Sounds like you got the exact same one we did. After a bit of research, it appears to be a new variant of the Locky ransomware. A lot of our employees received .doc and .xls attachments with filenames in the format of "Receipt ###-###". Our Barracuda spam filter and every AV program I threw it at let it through with no warning or quarantine of any sort, so it's apparently a very new variant.

It ended up taking me a few days to get this sorted. I had to open a restore session in Veeam and then explore the folders connected to the affected file shares, then build a Robocopy command line to copy the missing files, THEN build another Robocopy command line to re-iterate through and fix the file ownership (which for some reason Robocopy wouldn't do on the first pass). This ended up being quite a headache and was compounded by Veeam timing out the restore operation during my testing if I let it sit for too long while researching.

If only Veeam supported a "restore missing" option, then this could have been fixed within 30 minutes. I plan to submit an enhancement request to support, I'd advise anyone and everyone else do the same. The more that are submitted, the more likely that they'll address this.
alanbolte
Veteran
Posts: 635
Liked: 174 times
Joined: Jun 18, 2012 8:58 pm
Full Name: Alan Bolte
Contact:

Re: Restore only non existing files

Post by alanbolte » 1 person likes this post

dguidry wrote:If only Veeam supported a "restore missing" option, then this could have been fixed within 30 minutes. I plan to submit an enhancement request to support, I'd advise anyone and everyone else do the same. The more that are submitted, the more likely that they'll address this.
This forum is the correct place for feature requests, no need to open a support case.
tbwalkeriii
Lurker
Posts: 2
Liked: 1 time
Joined: Oct 03, 2016 6:17 pm
Full Name: Ted Walker
Contact:

[MERGED] FEATURE REQUEST: Restore only missing files

Post by tbwalkeriii » 1 person likes this post

Hello Dev Team,

I’d like to request a restore option that would restore only files that are “missing”. This would come in extremely handy in the event of a ransomware attack. We just had such an attack that encrypted and renamed over 5000+ files on our main fileserver, scattered across about 1000+ folders.

If a “restore only missing files” feature existed, I would have been able to quickly restore the 5000+ files without jumping through a lot of extra hoops (like restoring 100% of the 1000+ folders to an alternate location and using robocopy to copy only missing files).

Ransomware attacks are on the rise, and being able to automatically restore only the files that now appear “missing” (because they were renamed by the ransomware), would be a great feature to have.

If there are other Veeam users that believe this would be a good feature, please reply and chime in.

Thanks

TBWalker
lando_uk
Veteran
Posts: 371
Liked: 32 times
Joined: Oct 17, 2013 10:02 am
Full Name: Mark
Location: UK
Contact:

Re: Restore only non existing files

Post by lando_uk » 1 person likes this post

I second - like a said a year ago, we have to use Commvault for our home folders as Veeam doesn't work for ransomware restores. Lets hope v9.5 is better.
csinetops
Expert
Posts: 113
Liked: 16 times
Joined: Jun 06, 2014 2:45 pm
Full Name: csinetops
Contact:

Re: Restore only non existing files

Post by csinetops » 1 person likes this post

Add me to the list of customers that this would help tremendously.
Post Reply

Who is online

Users browsing this forum: ante_704, Bing [Bot] and 159 guests