I'm hoping that I'm just dense here and that everyone know how to do this: I'm restoring a backup from a ransonware infection. The folders within the share that were hit are numerous, but not all of the share was encrypted, 'cause we caught it about 1500 folders into the process and pulled the infected system off the network.
So - on a share of 225,000+ files, about 8700 were encrypted - these were all changed to *.thor. So what I'd like to do is
-delete anything with .thor extenion
-load up Veeam File Level Restore
-tell it to restore any file missing from last nights' backup, but to skip any file that's already there.
That doesn't seem to be a choice - I can overwrite the entire share, or I can "keep" files that are already in place and have Veeam restore those with "RESTORED" added to the beginning of the file name. That full overwrite will take hours and needlessly overwrite some files people have changed this morning; the "keep" option will put about 215000+ extra files into the share.
Is there a way to tell it "Go through the whole share (or the whole volume), restore missing files, and skip over anything that's already in place?"