ShadowProtect is a disk-to-disk backup and recovery solution from Arcserve (formerly StorageCraft).
It stands out for its speed, flexibility and reliability, but it is not without its challenges…
At SOS Ransomware, we’ve noticed a number of recurring problems among our customers.
This article details these problems and suggests solutions, while explaining how our service can help you as a last resort.
Common problems with Arcserve ShadowProtect backups
- Corrupt SPF/SPI files: SPF (ShadowProtect Full image) and SPI (ShadowProtect Incremental image) files can be damaged by a variety of factors. These include disk failures, software errors or power cuts occurring during backup creation.
- Ransomware attacks: cyber-attacks represent a significant threat, as they can encrypt or destroy your SPX files, rendering your backups inaccessible and compromising rapid data recovery. Hackers methodically target backups, paralyzing your systems in a matter of hours.
- Loss of metadata: malfunctions in indexes or backup logs can prevent access to backed-up files.
- Human error: accidental deletion or mishandling of backup files can also lead to loss of access.
How to regain control? Our tips for restoring Arcserve backups
Don’t panic, there are solutions to limit the damage and keep your data safe:
- Offline backups: ShadowProtect lets you back up to media such as USB disks, which can be stored off-site for added security.
- Frequent backups: incremental backups, possible every 15 minutes, reduce data loss.
- Remote replication: backup images can be sent to a remote location via the Internet, avoiding the need for physical transport of media.
- Targeted recovery: mount a backup image for rapid recovery of specific files via Windows Explorer.
- Regular verification: periodic testing of backups guarantees their integrity and ability to restore data.
- Enhanced security: tools such as up-to-date antivirus software, firewalls and risk awareness (e.g. phishing) protect against ransomware.
SOS Ransomware’s help in a crisis
If an attack compromises your ShadowProtect backups, SOS Ransomware can intervene:
- Specialized tools: we use tools developed in-house to recover data encrypted by ransomware.
- File repair: our solutions repair damaged virtual disks (VHDX, VMDK), databases (SQL, MDB) and backup files.
- Extensive compatibility: we support various media (NAS, servers, LTO tapes, etc.) and backup formats.
- Free analysis: an initial assessment of a corrupt file is offered free of charge.
- Rapid response: our experts are available 24/7, with options to suit the urgency of the situation (immediate, rapid or standard).
- Proven experience: with over 250 ransomware cases handled, we have the skills to optimize recovery.
Concrete examples of Arcserve backup restoration
- SPX backup encrypted by ransomware: an accounting firm contacted us after an attack. We were able to recover 95% of the data thanks to a desynchronized disk.
- SPX backup failure: an architecture firm sent us a hard disk containing corrupted SPF files. Despite the errors, we recovered over 90% of the data.
The final word
Arcserve ShadowProtect is a key tool for protecting your data, but it requires attention to potential risks and appropriate measures.
In the event of a ransomware attack, SOS Ransomware can support you with its expertise and tools. For a free evaluation or more information, please contact us.
FAQ
How can I restore individual files from a ShadowProtect backup?
Restoring files is simple:
– Locate the backup files (.SPF or .SPI). Double-click the appropriate backup file to launch the image mounting wizard.
– Choose a drive letter to mount the image.
– Once the image is mounted, access it via Windows Explorer.
– Copy the desired files or folders to another location.
– Unmount the image once the restoration is complete by right-clicking on the drive and selecting “Quick Dismount.”
– Locate the backup files (.SPF or .SPI). Double-click the appropriate backup file to launch the image mounting wizard.
– Choose a drive letter to mount the image.
– Once the image is mounted, access it via Windows Explorer.
– Copy the desired files or folders to another location.
– Unmount the image once the restoration is complete by right-clicking on the drive and selecting “Quick Dismount.”
What is a “staged restore,” and how can it be performed with ShadowProtect?
A staged restore, also known as “Manual HeadStart Restore” (Manual HSR), is a technique designed to minimize downtime during a planned migration or imminent hardware failure. The process is as follows:
– Boot from the Windows Recovery Environment.
– Connect to the backup repository.
– Restore an incremental image chain without finalizing the restoration.
– Restore the necessary subsequent ShadowProtect images.
Finally, complete the restoration.
– Boot from the Windows Recovery Environment.
– Connect to the backup repository.
– Restore an incremental image chain without finalizing the restoration.
– Restore the necessary subsequent ShadowProtect images.
Finally, complete the restoration.
How does ShadowProtect handle disaster recovery, particularly in cases of ransomware attacks?
ShadowProtect provides disaster recovery capabilities by quickly restoring systems from backups, including in temporary virtual environments.
In case of a ransomware attack or data corruption, the solution enables:
– Fast restoration of files, disks, and partitions.
– Offsite replication of backups for additional protection.
– Cloud-based recovery (StorageCraft Cloud Services) with advanced network configuration options.
In case of a ransomware attack or data corruption, the solution enables:
– Fast restoration of files, disks, and partitions.
– Offsite replication of backups for additional protection.
– Cloud-based recovery (StorageCraft Cloud Services) with advanced network configuration options.
What are the risks of losing access to SPF/SPI files, and how can SOS Ransomware help recover data?
SPF/SPI files can become inaccessible due to:
– SPF file corruption (disk failure, software errors, power outages).
– Ransomware attacks (encryption or destruction of files).
– Metadata loss (issues with indexes or backup logs).
– Human errors (accidental deletion or mishandling).
SOS Ransomware provides specialized data recovery services, including decryption, file repair, and volume recovery, to help restore data from corrupted or encrypted ShadowProtect backups.
– SPF file corruption (disk failure, software errors, power outages).
– Ransomware attacks (encryption or destruction of files).
– Metadata loss (issues with indexes or backup logs).
– Human errors (accidental deletion or mishandling).
SOS Ransomware provides specialized data recovery services, including decryption, file repair, and volume recovery, to help restore data from corrupted or encrypted ShadowProtect backups.
