I restored a VMDK for one of our VMs that got infected with cryptolocker. That part worked great. The problem I ran into was when the off-site backup copy job ran, it sees the restored VMDK as new data (I assume), and it starts backing up the entire thing instead of changes. Is there any way to prevent this in the future? It would save an extra day of driving back and forth to the data center and doing a local sync of the off-site job.