Ransomware Recovery with a Corrupt Client File Index
A finance Windows file server fin-fs01 is encrypted by ransomware at 02:00 Tuesday. NetWorker 19.8 protects it with a daily incremental at 23:00 to AFTD pool Disk, a weekly full on Sunday at 20:00 to the same pool, and a clone workflow that copies the Sunday full to tape pool Offsite. Disk retention is 14 days, tape retention is 8 weeks, and the Offsite clone is kept 1 year. The server team rebuilds the host as fin-fs02 with new disks and the same IP, and asks for D:\Finance as it existed at 10:00 Monday. The NetWorker server's client file index for fin-fs01 is reported corrupted. The media database is intact. The original fin-fs01 client resource still exists; fin-fs02 is not yet a NetWorker client.
1. Which save sets are required, in what order, and why is the latest full alone insufficient?
Read the worked answer
Recover the Sunday 20:00 full first, then the Monday 23:00 incremental. The latest full alone is Sunday's image and does not include Monday's changes. If more than one incremental exists after the full, apply them oldest to newest. Because only D:\Finance is needed, select that save set or path in the recovery tool. If the client file index is corrupt, rebuild it before browsing; otherwise perform save-set recovery by SSID. Verify the recovered files before overwriting production data.
2. What must be configured for a directed recovery from fin-fs01 to fin-fs02, and which privilege is required? Include the client resource fields.
Read the worked answer
fin-fs02 must be installed as a NetWorker client and added to the server. The source client fin-fs01's Remote Access field must list fin-fs02 and/or the consultant's user. The operating user needs the NetWorker privilege Recover Remote Data; an NMC role alone is not sufficient. Use NetWorker User on fin-fs02, choose Recover Remote, select fin-fs01, and target D:\Finance or a staging path. Confirm firewall ports and that fin-fs02 resolves the NetWorker server. Do not simply rename the client resource without checking index and access settings.
3. The client file index is corrupted. How do you restore recoverability, and what would you do if the required tape clone is not in the library?
Read the worked answer
Run nsrck -L7 fin-fs01 to rebuild the client file index from the media database and available volumes. If the required volume is not mounted, mount or import the tape or clone first. If the media database were also lost, use scanner options as appropriate, and for a full server disaster use mmrecov from a bootstrap save set. If the offsite clone's browse period has expired, recover by save-set ID with recover -S <ssid> and the correct volume. Retain the offsite clone for the full 1-year period so recovery is possible even after disk copies expire.