Restore only non existing files

Availability for the Always-On Enterprise

Restore only non existing files

Veeam Logoby getzjd » Sat Dec 13, 2014 12:00 am

We had a file server get hit with ransomware to the tune of several thousand files. How could I utilize Veeam to recover from this while not overwriting the files that changed between 10pm last night and 5pm today? The ransomware has changed all the affected files to the same file extension WANRPRJ . If I were using Backup Exec, I could simply delete all of the WANRPRJ files, run a restore in Backup Exec and select the option to "Skip if the file exists". This would leave all unaffected files in place and replace only those affected. This is what I am doing at one site where we still use tape backup.

The only idea I have for the other site where the file server is backed up with veeam is to restore the full VM, pull a tape backup, then initiate a restore. As you can imagine, this would take several hours just to take the backup, then several hours to restore etc.

Ideas to speed this up?
getzjd
Influencer
 
Posts: 21
Liked: 3 times
Joined: Mon Mar 12, 2012 3:10 am
Location: Cincinnati, OH
Full Name: Jay

Re: Recovering from ransomware

Veeam Logoby getzjd » Sat Dec 13, 2014 12:31 am

Or... I reckon I could just copy to from restore guest files and skip existing files.. duh.. this will probably work just fine :-)
getzjd
Influencer
 
Posts: 21
Liked: 3 times
Joined: Mon Mar 12, 2012 3:10 am
Location: Cincinnati, OH
Full Name: Jay

Re: Recovering from ransomware

Veeam Logoby getzjd » Sat Dec 13, 2014 12:55 am

Well.. that gives me the option to overwrite or keep. Keep places a prefix of RESTORED on the folders. I need these things to go back to the original directory paths, skipping existing files and copying missing files.
getzjd
Influencer
 
Posts: 21
Liked: 3 times
Joined: Mon Mar 12, 2012 3:10 am
Location: Cincinnati, OH
Full Name: Jay

Re: Recovering from ransomware

Veeam Logoby getzjd » Sat Dec 13, 2014 1:09 am 2 people like this post

Got it... just open the backup in explorer, copy past and skip the duplicates :-)
getzjd
Influencer
 
Posts: 21
Liked: 3 times
Joined: Mon Mar 12, 2012 3:10 am
Location: Cincinnati, OH
Full Name: Jay

Re: Recovering from ransomware

Veeam Logoby dellock6 » Sat Dec 13, 2014 8:35 am

Jay, you can also mount the data disk as a slave disk into the VM using Instant VM recovery. There's a trick to change the UUID of the vmdk in VMware (I explained it here: http://www.virtualtothecore.com/en/rest ... -recovery/).
Once it's mounted you can use robocopy with proper switch options, I think /mir flag should work, it compares source and destination and copies only the differences.
Better test it first with a subset...
Luca Dell'Oca
EMEA Cloud Architect @ Veeam Software

@dellock6
http://www.virtualtothecore.com
vExpert 2011-2012-2013-2014-2015-2016
Veeam VMCE #1
dellock6
Veeam Software
 
Posts: 5055
Liked: 1336 times
Joined: Sun Jul 26, 2009 3:39 pm
Location: Varese, Italy
Full Name: Luca Dell'Oca

Re: Recovering from ransomware

Veeam Logoby getzjd » Sat Dec 13, 2014 1:38 pm

Thanks Luca. The only issue I ran into was that the explorer browser had troubles copying over a tb of files (windows issue, not a veeam issue) as it wouldn't prompt to skip duplicates. I had to copy the folders in smaller chunks.

Maybe Veeam could add this to the wish list... restore files to SAME directory, not one labeled RESTORED, but skip duplicates and/or modified after x time.
getzjd
Influencer
 
Posts: 21
Liked: 3 times
Joined: Mon Mar 12, 2012 3:10 am
Location: Cincinnati, OH
Full Name: Jay

Re: Recovering from ransomware

Veeam Logoby J222 » Mon Dec 15, 2014 6:40 pm

Thought.

Start a file level recovery, drop to a command prompt and do an xcopy from c:\veeamflr, leveraging the switches that xcopy brings to the table (i.e. - xcopy /d:12-15-2014)
J222
Veeam Software
 
Posts: 38
Liked: 6 times
Joined: Fri Apr 20, 2012 8:43 pm
Full Name: Jason Acord

Re: Recovering from ransomware

Veeam Logoby getzjd » Mon Dec 15, 2014 7:42 pm

Thanks J222. I got through it by copying them in smaller chunks. Just stunk that Veeam wouldn't only restore the missing files and skip the existing.
getzjd
Influencer
 
Posts: 21
Liked: 3 times
Joined: Mon Mar 12, 2012 3:10 am
Location: Cincinnati, OH
Full Name: Jay

Re: Recovering from ransomware

Veeam Logoby larimerE » Tue Aug 11, 2015 10:12 pm

I also vote for enhancement to not overwrite existing files in the folder and do this recursively through all subsequent folders down the chain. Otherwise this process is unbelievably tedious even using robocopy for a 7 TB file server. It is actually shocking to me that Veeam does not have this option. It is a very common restore request even when ransomware is not involved.
larimerE
Novice
 
Posts: 4
Liked: never
Joined: Tue Jan 06, 2015 4:20 pm
Full Name: Elaine den Hoed

Re: Recovering from ransomware

Veeam Logoby Gostev » Tue Aug 11, 2015 11:44 pm

If it was, we would probably hear this request more than once in 8 years ;)
Gostev
Veeam Software
 
Posts: 21396
Liked: 2350 times
Joined: Sun Jan 01, 2006 1:01 am
Location: Baar, Switzerland

[MERGED] Restore only non existing files

Veeam Logoby frvw » Wed Aug 26, 2015 8:52 am

Hello,

Several customers have had the crypto virus. Therefor I remove all encyrpted files and want only to restore the missing files to their original location.
Existing files may not be overwrited since they may have been changed.

Copy to...: overwites
Restore > Keep: Is in another folder, this takes too much place on the disk.
Restore > Replace: overwrites

I don't want to restore to another disk. If you have lots of VM's where you have files to restore, this takes way too much time and manual effort.

Has anyone got an idea?

Thanks in advance,
Frédéric
frvw
Lurker
 
Posts: 2
Liked: never
Joined: Wed Aug 26, 2015 7:59 am
Full Name: Frédéric Van Walle

Re: Restore only non existing files

Veeam Logoby frvw » Wed Aug 26, 2015 10:20 am

Hello,

Even more: as administrator you don't have access to personal folders by default. Changing ownership and security of all folders would include a security risk. Doing that for each folder individually would take too much time. So the best thing would be to restore from Veeam directly into the right folder.

Thanks for the tips.
Kind regards,
Frédéric
frvw
Lurker
 
Posts: 2
Liked: never
Joined: Wed Aug 26, 2015 7:59 am
Full Name: Frédéric Van Walle

Re: Recovering from ransomware

Veeam Logoby foggy » Wed Aug 26, 2015 11:10 am

Frédéric, there's currently no "skip existing files" option in file-level restore, so you'd have to use one of the workarounds mentioned in this thread (I'd personally go with a copy/paste from Backup Browser with "skip duplicates" option).
foggy
Veeam Software
 
Posts: 14765
Liked: 1083 times
Joined: Mon Jul 11, 2011 10:22 am
Full Name: Alexander Fogelson

Re: Recovering from ransomware

Veeam Logoby lando_uk » Thu Aug 27, 2015 11:34 am

I've had this same issue and I find the Veeam File Explorer very limiting with the lack of advanced options. All our main file serves are still backed up by Commvault because of this - its annoying. For example we often use the `replace permissions only` restore option when people muck up folder permissions

We shouldn't have to use any of these workarounds that involve robocopy etc. IMO, this is basic stuff that should be part of the restore process.

Also the speed of restores is abysmal for restores 50,000+ files, took us hours to recover from a ransomware hit last month, Commvault could restore a million files in the same timeframe.

(hey, don't get me wrong, I dislike Commvault and I'd like to get rid, but until these limitations of Veeam are dealt with, then we are stuck with using 2 systems)
lando_uk
Expert
 
Posts: 236
Liked: 17 times
Joined: Thu Oct 17, 2013 10:02 am
Full Name: Mark

Re: Recovering from ransomware

Veeam Logoby foggy » Thu Aug 27, 2015 4:00 pm

Mark, thanks for this feedback. We are working on some improvements in FLR performance in v9.
foggy
Veeam Software
 
Posts: 14765
Liked: 1083 times
Joined: Mon Jul 11, 2011 10:22 am
Full Name: Alexander Fogelson

Next

Return to Veeam Backup & Replication



Who is online

Users browsing this forum: Yahoo [Bot] and 53 guests