Recovery point determination for data restoration in a storage system

1. A method comprising:

accessing, by a data protection system, a first set of one or more metrics of a storage system, the first set of one or more metrics including a first compressibility metric indicating an amount of storage space saved if write traffic processed by the storage system is compressed;

accessing, by the data protection system, a second set of one or more metrics of an additional storage system configured to replicate data stored by the storage system, the second set of one or more metrics including a second compressibility metric indicating an amount of storage space saved if write traffic processed by the additional storage system is compressed;

comparing, by the data protection system, the first set of one or more metrics with the second set of one or more metrics, the comparing comprising comparing the first compressibility metric with the second compressibility metric;

determining, by the data protection system based on the comparing of the first set of one or more metrics with the second set of one or more metrics, that the storage system is possibly being targeted by a security threat that causes a potential data corruption; and

determining, by the data protection system based on the comparing of the first set of one or more metrics with the second set of one or more metrics, a corruption-free recovery point for potential use by the storage system to recover from the potential data corruption.

2. The method of claim 1 , further comprising:

selecting, by the data protection system based on the corruption-free recovery point, a recovery dataset corresponding to the corruption-free recovery point; and

restoring, by the data protection system based on the selected recovery dataset, data stored by the storage system to an uncorrupted state.

3. The method of claim 2 , wherein the recovery dataset comprises one or more of a recovery dataset generated prior to the determining that the storage system is possibly being targeted by the security threat or a recovery dataset generated after the determining that the storage system is possibly being targeted by the security threat.

4. The method of claim 2 , wherein the restoring is further based on a version of the data stored by the storage system that resides on a system other than the storage system.

5. The method of claim 3 , wherein the recovery dataset generated prior to the determining that the storage system is possibly being targeted by the security threat comprises a provisional ransomware recovery structure that can only be deleted or modified in accordance with one or more ransomware recovery parameters.

6. The method of claim 5 , wherein the one or more ransomware recovery parameters specify a number or type of authenticated entities that have to approve a deletion or modification of the provisional ransomware recovery structure before the provisional ransomware recovery structure can be deleted or modified.

7. The method of claim 5 , wherein the one or more ransomware recovery parameters specify a retention duration before which the provisional ransomware recovery structure can be deleted or modified.

8. The method of claim 1 , further comprising:

receiving, by the data protection system, user input;

wherein the determining that the storage system is possibly being targeted by the security threat is further based on the user input.

9. The method of claim 1 , further comprising presenting, by the data protection system, a visualization of at least one metric included in at least one of the one or more metrics of the storage system or the one or more metrics of the additional storage system.

10. The method of claim 9 , further comprising:

receiving, by the data protection system, user input based on the visualization;

wherein the determining of the corruption-free recovery point is further based on the user input.

11. The method of claim 1 , wherein the data protection system is implemented by a controller within the storage system.

12. The method of claim 1 , wherein the data protection system is implemented by a computing system communicatively coupled to the storage system by way of a network.

13. A system comprising:

a memory storing instructions;

a physical processor communicatively coupled to the memory and configured to execute the instructions to:

access a first set of one or more metrics of a storage system, the first set of one or more metrics including a first compressibility metric indicating an amount of storage space saved if write traffic processed by the storage system is compressed;

access a second set of one or more metrics of an additional storage system configured to replicate data stored by the storage system, the second set of one or more metrics including a second compressibility metric indicating an amount of storage space saved if write traffic processed by the additional storage system is compressed;

compare the first set of one or more metrics with the second set of one or more metrics, the comparing comprising comparing the first compressibility metric with the second compressibility metric;

determine, based on the comparing of the first set of one or more metrics with the second set of one or more metrics, that the storage system is possibly being targeted by a security threat that causes a potential data corruption; and

determine, based on the comparing of the first set of one or more metrics with the second set of one or more metrics of the storage system and the one or more metrics of the additional storage system, a corruption-free recovery point for potential use by the storage system to recover from the potential data corruption.

14. The system of claim 13 , wherein the processor is further configured to execute the instructions to:

select, based on the corruption-free recovery point, a recovery dataset corresponding to the corruption-free recovery point; and

restore, based on the selected recovery dataset, data stored by the storage system to an uncorrupted state.

15. The system of claim 14 , wherein the recovery dataset comprises one or more of a recovery dataset generated prior to the determining that the storage system is possibly being targeted by the security threat or a recovery dataset generated after the determining that the storage system is possibly being targeted by the security threat.

16. The system of claim 15 , wherein the recovery dataset generated prior to the determining that the storage system is possibly being targeted by the security threat comprises a provisional ransomware recovery structure that can only be deleted or modified in accordance with one or more ransomware recovery parameters.

17. A non-transitory computer-readable medium storing instructions that, when executed, direct a processor of a computing device to:

access a first set of one or more metrics of a storage system, the first set of one or more metrics including a first compressibility metric indicating an amount of storage space saved if write traffic processed by the storage system is compressed;

access a second set of one or more metrics of an additional storage system configured to replicate data stored by the storage system, the second set of one or more metrics including a second compressibility metric indicating an amount of storage space saved if write traffic processed by the additional storage system is compressed;

compare the first set of one or more metrics with the second set of one or more metrics, the comparing comprising comparing the first compressibility metric with the second compressibility metric;

determine, based on the comparing of the first set of one or more metrics with the second set of one or more metrics, that the storage system is possibly being targeted by a security threat that causes a potential data corruption; and

determine, based on the comparing of the first set of one or more metrics with the second set of one or more metrics of the storage system and the one or more metrics of the additional storage system, a corruption-free recovery point for potential use by the storage system to recover from the potential data corruption.