Automatic generation of recovery plans specific to individual storage elements

1. A method comprising:

identifying, by a data protection system and within a storage system subjected to a data corruption event, a storage element and an additional storage element that store data impacted by the data corruption event;

identifying, by the data protection system, one or more attributes associated with the storage element and one or more additional attributes associated with the additional storage element;

determining, by the data protection system based on the one or more attributes associated with the storage element, a recovery plan for the storage element, the recovery plan specifying one or more operations configured to recover impacted data in the storage element that is impacted by the data corruption event to an uncorrupted state; and

determining, by the data protection system based on the one or more additional attributes associated with the additional storage element, an additional recovery plan for the additional storage element, the additional recovery plan of the additional storage element being distinct from the recovery plan of the storage element.

2. The method of claim 1 , further comprising:

automatically executing, by the data protection system, the recovery plan to recover the impacted data in the storage element to the uncorrupted state.

3. The method of claim 1 , further comprising:

presenting, by the data protection system, the recovery plan to a user;

receiving, by the data protection system from the user, a user input based on the recovery plan; and

executing, by the data protection system based on the user input, one or more of the one or more operations specified by the recovery plan.

4. The method of claim 1 , further comprising:

receiving, by the data protection system, a verification from another system that the data protection system is unimpacted by the data corruption event.

5. The method of claim 1 , wherein the identifying of the one or more attributes includes one or more of:

identifying a detection time of the data corruption event;

identifying a start time of the data corruption event;

identifying a source of an operation request associated with the data corruption event; or

identifying a data amount impacted by the data corruption event in the storage element relative to a total data amount of the storage element or a total data amount of the storage system.

6. The method of claim 1 , wherein the identifying of the one or more attributes includes:

identifying one or more creation timestamps of one or more recovery datasets associated with the storage element.

7. The method of claim 1 , wherein the identifying of the one or more attributes includes one or more of:

identifying an access pattern associated with the storage element;

identifying a downtime threshold of an application that uses data stored within the storage element;

identifying one or more data items impacted by the data corruption event in the storage element; or

identifying one or more access patterns of the one or more data items.

8. The method of claim 1 , wherein the determining of the recovery plan for the storage element includes:

identifying, based on a start time of the data corruption event and one or more creation timestamps of one or more recovery datasets associated with the storage element, one or more particular recovery datasets unimpacted by the data corruption event to be used to recover the impacted data in the storage element.

9. The method of claim 8 , wherein:

the one or more recovery datasets includes one or more snapshots, one or more ransomware protection snapshots, one or more replicas, or one or more backups of data stored within the storage element; and

the one or more recovery datasets are stored in one or more of a cloud-based storage system or a local storage system that are separate from the storage system.

10. The method of claim 1 , wherein the determining of the recovery plan for the storage element includes:

determining a time window to start recovering the impacted data in the storage element based on one or more of:

a detection time of the data corruption event;

a source of an operation request associated with the data corruption event;

an access pattern associated with the storage element;

a downtime threshold of an application that uses data stored within the storage element; or

a data amount impacted by the data corruption event in the storage element relative to a total data amount of the storage element or a total data amount of the storage system.

11. The method of claim 1 , wherein the determining of the recovery plan for the storage element includes:

determining a sequence of operations to recover the impacted in the storage element based on one or more access patterns of one or more data items impacted by the data corruption event in the storage element.

12. The method of claim 1 , further comprising:

preserving, by the data protection system based on a detection of the data corruption event, one or more copies of data stored within the storage element.

13. The method of claim 12 , wherein preserving the one or more copies of the data stored within the storage element includes:

generating a copy of one or more data items that are stored in the storage element between a start time and a detection time of the data corruption event; and

generating another copy of one or more data items that are stored in the storage element prior to the recovery plan being executed.

14. The method of claim 12 , further comprising:

analyzing the data corruption event based on the one or more preserved copies.

15. The method of claim 1 , further comprising:

executing, by the data protection system, the additional recovery plan to recover impacted data in the additional storage element.

16. A system comprising:

a memory storing instructions; and

a processor communicatively coupled to the memory and configured to execute the instructions to:

identify, within a storage system subjected to a data corruption event, a storage element and an additional storage element that store data impacted by the data corruption event;

identify one or more attributes associated with the storage element and one or more additional attributes associated with the additional storage element;

determine, based on the one or more attributes associated with the storage element, a recovery plan for the storage element, the recovery plan specifying one or more operations configured to recover impacted data in the storage element that is impacted by the data corruption event to an uncorrupted state; and

determine, based on the one or more additional attributes associated with the additional storage element, an additional recovery plan for the additional storage element, the additional recovery plan of the additional storage element being distinct from the recovery plan of the storage element.

17. The system of claim 16 , wherein the processor is further configured to execute the instructions to:

automatically execute the recovery plan to recover the impacted data in the storage element to the uncorrupted state.

18. The system of claim 16 , wherein the processor is further configured to execute the instructions to:

present the recovery plan to a user;

receive, from the user, a user input based on the recovery plan; and

execute, based on the user input, one or more of the one or more operations specified by the recovery plan.

19. A non-transitory computer-readable medium storing instructions that, when executed, direct a processor of a computing device to:

identify, within a storage system subjected to a data corruption event, a storage element and an additional storage element that store data impacted by the data corruption event;

identify one or more attributes associated with the storage element and one or more additional attributes associated with the additional storage element;

determine, based on the one or more attributes associated with the storage element, a recovery plan for the storage element, the recovery plan specifying one or more operations configured to recover impacted data in the storage element that is impacted by the data corruption event to an uncorrupted state; and

determine, based on the one or more additional attributes associated with the additional storage element, an additional recovery plan for the additional storage element, the additional recovery plan of the additional storage element being distinct from the recovery plan of the storage element.