Ransomware backup and restore drill
Ransomware hit at 01:40. Choose a clean, intact restore point for a domain controller, a file server, and a database, within each recovery time objective.
Goal
It is Sunday morning, 1 November 2026. Ransomware encrypted the file server and the finance database at 01:40 UTC. Containment is done, and the incident lead asks you for the restore plan.
For each system, choose the restore point to use. A good point is intact, taken before anything the attacker touched on that system, restorable within the system’s recovery time objective (RTO), and as recent as possible.
- •
2026-10-21 22:05VPN sign-in with a stolen contractor password (found later in VPN logs) - •
2026-10-24 03:10Scheduled task and a new account svc-health created on DC01 - •
2026-11-01 01:22NAS snapshots deleted with the domain backup admin account - •
2026-11-01 01:40Encryption starts on FS01 and ERP-DB; ransom note appears - •
2026-11-01 01:45Sync replica copies encrypted files from FS01
| Use | Copy | Taken | State | Restore time |
|---|---|---|---|---|
| NAS snapshot | 2026-10-31 23:00 | deleted | 2 h | |
| Immutable object storage (system state, nightly) | 2026-10-31 23:00 | intact | 3 h | |
| Immutable object storage (system state, weekly) | 2026-10-25 20:00 | intact | 3 h | |
| Immutable object storage (system state, weekly) | 2026-10-18 20:00 | intact | 3 h |
| Use | Copy | Taken | State | Restore time |
|---|---|---|---|---|
| Sync replica | 2026-11-01 01:45 | encrypted | 1 h | |
| NAS snapshot | 2026-11-01 01:00 | deleted | 2 h | |
| Immutable object storage (nightly) | 2026-10-31 23:00 | intact | 7 h | |
| Offline tape (weekly, offsite) | 2026-10-25 20:00 | intact | 30 h |
| Use | Copy | Taken | State | Restore time |
|---|---|---|---|---|
| Standby replica (domain-joined) | 2026-11-01 01:41 | encrypted | 1 h | |
| Immutable nightly full + hourly log backups | 2026-11-01 01:00 | intact | 5 h | |
| Immutable nightly full only | 2026-10-31 23:00 | intact | 4 h | |
| Offline tape (weekly, offsite) | 2026-10-25 20:00 | intact | 26 h |
0 of 3 systems planned.
Steps
01Choose one restore point for each system: clean, intact, within the recovery time objective, and with the least data loss.
Do this in the workbench above. This step completes itself when the condition is met.
02With the best FS01 restore point, how much file server data is lost? Answer in hours and minutes.
03Why not restore DC01 from last night’s backup and delete svc-health?
04In which order should the three systems come back?
05Which change after the incident does the most for the next one?