Synthetic Snapshots for Rapid Recovery Against Ransomware
A method may include a data protection system determining that files stored within a storage system are possibly targeted by a security threat; identifying, in response to the determining and within a plurality of snapshots of the files, a most recent good version of each of the files; and creating a synthetic snapshot that includes the most recent good version of each of the files.
1 . A method comprising:
determining, by a data protection system, that files stored within a storage system are possibly targeted by a security threat;
identifying, by the data protection system in response to the determining and within a plurality of snapshots of the files, a most recent good version of each of the files; and
creating, by the data protection system, a synthetic snapshot that includes the most recent good version of each of the files.
2 . The method of claim 1 , wherein:
the files include a first file and a second file;
the identifying comprises:
identifying a most recent good version of the first file in a first snapshot included in the plurality of snapshots, and
identifying a most recent good version of the second file in a second snapshot included in the plurality of snapshots; and
the creating the synthetic snapshot comprises:
obtaining the most recent good version of the first file from the first snapshot for inclusion in the synthetic snapshot, and
obtaining the most recent good version of the second file from the second snapshot for inclusion in the synthetic snapshot.
3 . The method of claim 1 , wherein the plurality of snapshots are created prior to the determining that the files stored within the storage system are possibly targeted by the security threat.
4 . The method of claim 1 , wherein the plurality of snapshots includes a snapshot generated subsequent to the determining that the files stored within the storage system are possibly targeted by the security threat.
5 . The method of claim 1 , wherein the identifying the most recent good version of a particular file included in the files comprises identifying, within the plurality of snapshots, a most recent version of the particular file that is not encrypted.
6 . The method of claim 1 , wherein the identifying the most recent good version of a particular file included in the files is based on at least one of a library-based file processing operation performed with respect to one or more versions of the particular file within the plurality of snapshots, a malware scanning operation performed with respect to the one or more versions of the particular file within the plurality of snapshots, a file type validation procedure performed with respect to the one or more versions of the particular file within the plurality of snapshots, or an entropy analysis performed with respect to the one or more versions of the particular file within the plurality of snapshots.
7 . The method of claim 1 , wherein the identifying the most recent good version of a particular file included in the files comprises:
attempting to process a first version of particular file within a most recent snapshot included in the plurality of snapshots using a format-specific library; and
designating the first version of the particular file as the most recent good version of the particular file if the format-specific library successfully processes the first version of the particular file.
8 . The method of claim 7 , wherein the identifying the most recent good version of the particular file included in the files further comprises:
attempting, if the format-specific library fails to successfully processes the first version of the particular file, to process a second version of the particular file within a second-most recent snapshot included in the plurality of snapshots using the format-specific library; and
designating the second version of the particular file as the most recent good version of the particular file if the format-specific library successfully processes the second version of the particular file.
9 . The method of claim 1 , wherein the identifying the most recent good version of a particular file included in the files comprises:
scanning a first version of the particular file within a most recent snapshot included in the plurality of snapshots for one or more known malware signatures; and
designating the first version of the particular file as the most recent good version of the particular file if the scanning does not identify any known malware signatures.
10 . The method of claim 9 , wherein the identifying the most recent good version of the particular file included in the files further comprises:
scanning, if the scanning the first version of the particular file within the most recent snapshot included in the plurality of snapshots does not identify any known malware signatures, a second version of the particular file within a second-most recent snapshot included in the plurality of snapshots for the one or more known malware signatures; and
designating the second version of the particular file as the most recent good version of the particular file if the scanning the second version of the particular file does not identify any known malware signatures.
11 . The method of claim 1 , wherein the identifying the most recent good version of a particular file included in the files comprises:
performing a file type validation procedure with respect to a first version of the particular file within a most recent snapshot included in the plurality of snapshots; and
designating the first version of the particular file as the most recent good version of the particular file if the file type validation procedure validates a file type of the first version of the particular file.
12 . The method of claim 11 , wherein the identifying the most recent good version of the particular file included in the files further comprises:
performing, if the file type validation procedure does not validate the file type of the first version of the particular file, the file type validation procedure with respect to a second version of the particular file within a second most recent snapshot included in the plurality of snapshots; and
designating the second version of the particular file as the most recent good version of the particular file if the file type validation procedure validates a file type of the second version of the particular file.
13 . The method of claim 1 , further comprising using the synthetic snapshot to perform a file restoration operation within the storage system.
14 . The method of claim 1 , further comprising preventing the synthetic snapshot from being deleted or modified without one or more conditions being satisfied.
15 . A system comprising:
a memory storing instructions; and
one or more processors communicatively coupled to the memory and configured to execute the instructions to perform a process comprising:
determining that files stored within a storage system are possibly targeted by a security threat;
identifying, in response to the determining and within a plurality of snapshots of the files, a most recent good version of each of the files; and
creating a synthetic snapshot that includes the most recent good version of each of the files.
16 . The system of claim 15 , wherein:
the files include a first file and a second file;
the identifying comprises:
identifying a most recent good version of the first file in a first snapshot included in the plurality of snapshots, and
identifying a most recent good version of the second file in a second snapshot included in the plurality of snapshots; and
the creating the synthetic snapshot comprises:
obtaining the most recent good version of the first file from the first snapshot for inclusion in the synthetic snapshot, and
obtaining the most recent good version of the second file from the second snapshot for inclusion in the synthetic snapshot.
17 . The system of claim 15 , wherein the plurality of snapshots are created prior to the determining that the files stored within the storage system are possibly targeted by the security threat.
18 . The system of claim 15 , wherein the identifying the most recent good version of a particular file included in the files comprises identifying, within the plurality of snapshots, a most recent version of the particular file that is not encrypted.
19 . The system of claim 15 , wherein the identifying the most recent good version of a particular file included in the files is based on at least one of a library-based file processing operation performed with respect to one or more versions of the particular file within the plurality of snapshots, a malware scanning operation performed with respect to the one or more versions of the particular file within the plurality of snapshots, a file type validation procedure performed with respect to the one or more versions of the particular file within the plurality of snapshots, or an entropy analysis performed with respect to the one or more versions of the particular file within the plurality of snapshots.
20 . A computer program product comprising instructions that, when executed, cause a computing device to perform a process comprising:
determining that files stored within a storage system are possibly targeted by a security threat;
identifying, in response to the determining and within a plurality of snapshots of the files, a most recent good version of each of the files; and
creating a synthetic snapshot that includes the most recent good version of each of the files.