Recover from ransomware using CrashPlan for Small Business

This tutorial provides instructions for CrashPlan for Small Business users to recover from a ransomware attack. Ransomware is a form of malware that encrypts files on your computer and demands a ransom to decrypt these files. Instead of paying the criminals behind this attack, use the CrashPlan app to restore files to your device from a date and time before the infection.

This tutorial is a self-service set of instructions that you can follow to recover from ransomware on a single device. 

Work with your internal teams and processes
Work with your designated security team or follow your security processes to quarantine the infected device and recover files. While this article provides instructions for using CrashPlan Cloud or CrashPlan for Small Business to recover from ransomware, it does not account for your organization's defined recovery process.

Step 1: Determine the time of the infection

To recover from ransomware, you must restore files from a date before infection. Work with your security team or follow your security processes to determine the time of the infection. Record when it occurred and what happened when the attack unfolded. This information can tell you at what time you can find the most recent uninfected files and what kind of ransomware attack you have experienced.

Step 2: Prepare a new device

Work with your security team or follow your organization's process to obtain a new device after a ransomware attack.

Rather than attempting to remove the infection from the affected device, quarantine the device, and prepare a new device to replace the old device. As creators of ransomware become more adept at engineering their tools, it is best to ensure that the device you are restoring to is completely free of infection.

Step 3: Restore files from a time before the ransomware infection

Use the CrashPlan app to download files to a new device from a date and time before the ransomware infection by following the device replacement process:

1. Make sure the CrashPlan app is installed on the new device.
2. Sign in to the CrashPlan app on the new device.
   The first time you sign in to the CrashPlan app, it detects whether there are other devices on the account and prompts you to either Add New Device (which starts a new backup for this device) or Replace Existing (adopts the original backup archive).
3. Choose Replace Existing.
   Only choose Add New Device if there are infected files still in the backup archive and you don't want to risk accidentally restoring infected files to the new device.
4. Click Start.
5. Choose the device you want to replace and click Continue.
6. Click Select Files To Transfer to begin the process of transferring files to the new device.
   The file browser opens.
   
7. Click As Of Today.
   The date and time selection dialog opens.
8. Select a date and time from before the time of the infection.

    Important

   Restoring from the most recent date and time stamp may cause the new machine to be infected. Select a time and date before infection based on your testing to determine the time of the infection.

9. Select files to restore to the new device.
10. Click Restore Files.
11. Modify the Files options:
    • From Save selected files to, select original location.
    • From If file already exists, select overwrite.
12. Click Go to download the files.
    The download may take a long time. Do not cancel the restore job.
13. After files are downloaded, click Continue.
14. On the Transfer files to new device dialog, click Continue.
15. On the Transfer settings to new device page, click Continue.
16. After files are transferred, a prompt to sign in to the new device appears. Sign in to the new device and click Finish on the Your device is ready! dialog to complete the device replacement.