DATA RECOVERY METHOD AND DATA RECOVERY SYSTEM
When the latest data and a backup of the latest data are infected, the data is recovered from the backup older than the data. Therefore, it is necessary to eliminate a difference from the latest data, leading to loss of business opportunities. A data recovery system that recovers data stored in a storage system includes a storage device that holds original data, an analyzing server that holds a copy of the original data, and generates formatted data by formatting the copy data for analysis, a managing server that holds the copy data and data history management information storing a history of the formatted data, and a data recovery unit that refers to the data history management information, selects the copy data or the formatted data as recovery data, and recovers the data from the selected recovery data when a security threat is detected in the data.
1 . A data recovery method for recovering data stored in a storage system,
the data recovery method comprising:
causing a storage device to hold original data;
causing an analyzing server including a data analyzing unit to hold copy data that is a copy of the original data, and generate formatted data obtained by formatting the copy data for analysis;
causing a managing server to hold the copy data and data history management information storing a history of the formatted data; and
causing a data recovery unit to refer to the data history management information, select the copy data or the formatted data as recovery data, and recover the data from the selected recovery data when a security threat is detected in the data.
2 . The data recovery method according to claim 1 , wherein it is determined that the security threat is detected when an error occurs in a process of formatting the data or a process of analyzing the data.
3 . The data recovery method according to claim 1 , wherein
the data history management information includes flag information indicating that data processed without an error is normal, and
the data recovery unit uses, as the recovery data, data for which the flag information indicates normal.
4 . The data recovery method according to claim 2 , wherein
the storage device performs a backup process of backing up data to other storage,
the data history management information includes time information indicating a time when the data is processed, and
the data recovery unit selects data as the recovery data based on time information indicating a time when a copy process and the backup process are performed.
5 . The data recovery method according to claim 1 , wherein
process types of the data history management information include types of copy, formatting, and analysis, and
the data recovery unit selects data as the recovery data in order of copying, formatting, and analysis.
6 . The data recovery method according to claim 5 , wherein
the data history management information includes similarity information indicating a difference from the unprocessed data,
when a process type of the data history management information is formatting or analysis, an output unit outputs a similarity of the selected data, and
when an input unit receives information indicating approval of use of the selected recovery data, the data recovery unit uses the selected data as the recovery data.
7 . A data recovery system that recovers data stored in a storage system, the data recovery system comprising:
a storage device that holds original data;
an analyzing server that holds copy data that is a copy of the original data, and generates formatted data obtained by formatting the copy data for analysis;
a managing server that holds the copy data and data history management information storing a history of the formatted data; and
a data recovery unit that refers to the data history
management information, selects the copy data or the formatted data as recovery data, and recovers the data from the selected recovery data when a security threat is detected in the data.