Ransomware Recovery

NAKIVO Backup & Replication is a comprehensive data protection solution that makes recovery after a ransomware attack possible without data loss or paying the ransom. With the rise of ransomware, it’s just a matter of time before your organization becomes the next target. Antivirus software alone isn’t enough to fend off malicious attacks. What you need is a reliable all-in-one data protection solution to minimize the impact of ransomware attacks, recover your data and ensure business continuity.

Leading Brands Trust NAKIVO


Key Features at a Glance

Robust Backups

Robust Backups

Apply the 3-2-1 backup rule to protect all workloads across multiple platforms

Immutable Backup Data

Immutable Backup Data

Prevent backup data overwriting and encryption by ransomware with S3 Object Lock

Instant Verification

Instant Verification

Test backup and replica validity instantly, and be prepared for ransomware recovery

Faster Ransomware Recovery

Faster Ransomware Recovery

Instantly restore full physical and virtual machines, or recover files and application objects

Flexible Retention Policies

Flexible Retention Policies

Create thousands of recovery points using the GFS data retention scheme for effective ransomware recovery

Site Recovery

Site Recovery

Automate and orchestrate ransomware data recovery to ensure continuous availability and business resilience

Why Use NAKIVO Backup & Replication for Ransomware Recovery

An Efficient Data Protection Strategy

NAKIVO Backup & Replication allows you to store backup copies in multiple locations, following the 3-2-1 backup strategy to ensure ransomware recovery after attacks. You can keep backup copies onsite for faster and simpler ransomware recovery. Moreover, NAKIVO Backup & Replication allows you to send backup copies to a remote site or the cloud (Amazon S3, Azure and Wasabi) to eliminate a single point of failure. Along with native tape support to meet compliance requirements and archival needs. This way, if your primary backup gets encrypted, you can still recover from ransomware and resume operations with minimum downtime and data loss.

Recover from Ransomware Attacks with Immutable Backups

With NAKIVO Backup & Replication, you can add another layer of ransomware protection for your backup data stored in the cloud with S3 Object Lock support. The software solution allows you to make your backup data stored in Amazon S3 buckets immutable for a specified period of time. This way, your backup and backup copies cannot be compromised by ransomware. They cannot be modified, overwritten or deleted until that period expires. With your backups locked, you can rest assured that your backups are ransomware-free and you can recover from ransomware quickly if a malicious attack hits your systems.

Instant Ransomware Recovery of Data

NAKIVO Backup & Replication is equipped with instant recovery capabilities, enabling you to instantly boot VMs , recover physical machines as VMware VMs, and recover files and application objects in just a few minutes in case of a malware attack. The Instant File Recovery allows for fast and easy ransomware recovery of corrupted files and folders to their original location (or any custom location) in a single click directly from deduplicated and compressed backups. You can also use Cross-Platform Recovery to migrate your VMs to different platforms and even perform physical to virtual machine recovery in mixed physical and virtual environments.

Ransomware Recovery Orchestration and Automation

With the Site Recovery functionality, NAKIVO Backup & Replication can protect your critical data and ensure the continuity of operations in the event of a ransomware attack. The flexible VM replication feature together with Site Recovery allow you to automate and orchestrate the entire recovery process, ensuring 24/7 availability of your data and systems. You can create multiple site recovery jobs of any complexity, which can also be tailored for recovery from ransomware. In case of a ransomware attack, you can perform a one-click switch to a secondary location and rapidly resume your business operations without paying the ransom.


Advanced Backup Verification

NAKIVO Backup & Replication allows you to instantly verify that your backups and backup copies can be recovered when the need arises, ensuring the success of your ransomware recovery process. The instant verification feature automatically verifies the functionality of your VMs by running the VM directly from the newly-created backup in a test mode environment (with the networking turned-off). The software solution can also capture a screenshot of the test-recovered VM OS before discarding it and send you the verification results via email or display them in the interface. Regularly checking backup data integrity is your safety net for if and when a ransomware attack hits.

Flexible Retention for Ransomware Recovery

NAKIVO Backup & Replication provides a full range of approaches to recover from ransomware and ensure minimum data loss and reduced business downtime. The solution allows you to save up to 4,000 recovery points for every backup and replication job and rotate them daily, weekly, monthly and yearly. The retention policy follows the grandfather-father-son (GFS) scheme, providing you with multiple recovery options and a large ransomware data recovery window. Having thousands of recovery points covering different points in time allows a fast ransomware data recovery before the ransomware infection (or the encryption event following the infection).

How to Recover from Ransomware with NAKIVO Backup & Replication

Back Up on a Regular Basis

Developing a robust backup strategy and creating regular backups of essential data and applications are key components to get over a ransomware attack with no data loss and payoffs. Use NAKIVO Backup & Replication to perform incremental, application-aware backups of your data as often as is necessary, saving your important files from inevitable data loss situations and facilitating the ransomware data recovery process. The software solution provides you with peace of mind that your backups contain the most recent clean version of data, resulting in minimal data loss and ensuring the continuity of your business operations after a ransomware attack.

Apply the 3-2-1 Backup Rule

Ransomware can even infect and encrypt or delete your backups, making your ransomware data recovery challenging, if not impossible. Ransomware recovery best practices dictate you to follow the 3-2-1 backup rule. NAKIVO Backup & Replication allows you to create copies of your backups and send them to a remote site or the cloud (Amazon S3, Azure or Wasabi), thus helping you comply with the 3-2-1 rule. Once your backup copy job is created, all backups and recovery points of the primary backup repository are automatically sent to the secondary repository, allowing for fast data recovery using a ransomware-free backup at any time and with minimum loss of productivity.

Verify That Your Backups Are Recoverable

Sophisticated ransomware is now targeting backups and replicas because they are the central pool of all business data and to maximize the chances of getting paid.To reduce the risk of failed ransomware recovery, NAKIVO Backup & Replication includes an Instant Verification , which can automatically verify that your backups and replicas are functional and can be used for ransomware data recovery. The verification results can be displayed in the product’s interface or sent via email. Screenshot Verification can be run on demand or on a schedule, making the verification procedure easy, flexible and efficient.

Perform Granular Recovery with a Few Clicks

If any of your files or application objects (in Active Directory, Microsoft SQL, etc.) become infected with ransomware, you can isolate the threat and use the Instant File Recovery or the Instant Object Recovery feature to recover your data in no time. With just a single click, you can recover the needed files or objects directly from compressed and deduplicated backups. When a file is retrieved to the source location, file permissions are restored as well. The instant granular recovery features in NAKIVO Backup & Replication work over LAN and WAN, allowing you to easily search for individual files and objects, and instantly restore them to where you need them.


Create an automated workflow

Automating your environment’s data protection process can reduce management overhead and increase your business resiliency to ransomware attacks. NAKIVO Backup & Replication allows you to set policy rules that automatically scan your environment and protect the VMs, physical machines and EC2 instances that match the criteria (based on name, size, location, etc.) using the Policy-Based Data Protection functionality. Moreover, the flexible job scheduler allows you to create and automate backup, replication and backup copy jobs to run as often as every minute. This ensures that your backups contain the most recent clean version of data and results in minimal data loss if ransomware strikes.

Control Access to Backup Data

Make sure you follow the principle of least privilege when granting user permissions. Use the role-based access control (RBAC) feature to ensure that your backup, replication and backup copy jobs in NAKIVO Backup & Replication cannot be created or altered by unauthorized users. With RBAC, you can grant users particular roles for each part of the backup and recovery process, ensuring that employees have no more permissions than what is strictly needed to get their job done. Moreover, you can delegate data protection tasks between admins to reduce bottlenecks and increase efficiency. This way, you can limit access to your data protection operations and ensure that ransomware-infected users cannot access or corrupt your backups.

Frequently Asked Questions

How do I plan ransomware recovery?

By backing up your data regularly, you can ensure smooth ransomware recovery and avoid paying ransoms. Determine the time of the ransomware infection so you could restore your machines to the specific point in time before the incident. Isolate the infection by using a new device to restore the data from backups.

How long does it take to recover from ransomware?

It varies from one business to another and depends on several factors, including the company’s size, ransomware type, amount of data to be restored, etc. According to a survey conducted by Vanson Bourne, it might take up to 33 hours to recover from ransomware as long as there is a valid backup available.

How does the S3 Object Lock feature protect data from ransomware?

The S3 Object Lock can be used to make your backup data immutable and thus make it resistant to encryption and overwriting by ransomware for a user-defined retention period. NAKIVO Backup & Replication enables you to set object locks on your backups that reside in Amazon S3 buckets.

What types of ransomware recovery can I perform?

NAKIVO Backup & Replication can help you restore your ransomware-infected files and application objects from deduplicated and compressed backups with Instant File Recovery and Instant Object Recovery . You can also instantly boot VMs from backups or perform P2V recoveries of your physical machines as VMware VMs.

How quickly does ransomware spread?

Ransomware is usually spread using stolen credentials or phishing emails that include malicious attachments or links. The harmful malware holds the ability to be deployed in a matter of seconds once the attachment is opened or the link clicked. Conduct anti-malware training your staff to help them detect and avoid malicious links and phishing emails.

Why is it recommended not to ever pay ransoms to hackers?

Paying the ransom doesn’t guarantee that you will regain access to your encrypted data. Moreover, your readiness to pay may encourage ransomware hackers to carry out more attacks in the future. You should also check the laws in your jurisdiction, as paying out ransoms can incur sanctions in some countries (note the U.S. Department of Treasury advisories, for example).

“In NAKIVO Backup & Replication, we found a stable VM backup solution that lets us back up VMs faster and recover VMs in minutes, which is extremely helpful in order to keep our business operations available at all times.”
Steven Schmidt, System Administrator at One World Direct
“With NAKIVO Backup & Replication, the university saved time and money, while gaining peace of mind. I now spend the majority of my time not on backup administration, but on other IT-related tasks.”.
Edwardson A. Pedragosa Jr., Network Administrator at the Asia-Pacific International University
Boise cascade
“NAKIVO’s fast VM backup and VM replication keep our critical VMs running at all times. If our VMware VMs failed, we would only need a couple of minutes to recover with VM failover and failback.”
Noel Peden, Applications Development Supervisor at Boise Cascade
“With NAKIVO Backup & Replication installed on QNAP NAS, the backup is 2.5X faster! We found a professional solution that covers all our needs, saves money, and provides reliability.”
Mickaël Masquelin, IT Department Manager at the IEMN
“With NAKIVO Backup & Replication, every hour that we save on VM backup administration can be translated into cost savings. NAKIVO Backup & Replication is resource-efficient in terms of installation and configuration. NAKIVO Backup & Replication is just what we needed.”
Samuel Riley, IT Manager at MyoKardia

Need Help?

NAKIVO’s Support Team is always here to help if you encounter any issues. If you need assistance:
  • Give us a call

    Americas: +1 702 605 4495

    Europe: +44 207 193 1230

    Asia: +886 2 2656 5927

  • Contact us by email: support@nakivo.com
  • Contact us via the chat in the product interface
  • Browse the online knowledge base, anytime and anywhere


NAKIVO Community Forum is a valuable information resource where you can:
  • Share your ideas with tech experts and fellow users
  • Discuss the latest news and upcoming product releases
  • Ask and answer questions about NAKIVO Backup & Replication
  • Learn more about the software capabilities

Free Trial of NAKIVO
Backup & Replication