Solved

Restoring files from Windows Server Backup

Posted on 2016-09-23
7
69 Views
Last Modified: 2016-09-23
Hi,
  I have SBS2011 server where all the files on it have been encrypted by Zepto virus.
  So I can't open any of the files. Kaspersky said that they don't have any tool to decry-pt the files.
  I have been doing Windows Server Backup on an external USB hard drive.
  I wanted to start restoring process, but  Kaspersky technician recommended that I wait for the hard drive scan is completed (I am currently running Kaspersky virus scan on SBS2011)  and it may take hours.
  So I am thinking about setting up Windows 2008 Server OS on a separate computer and perhaps try to restore files from the backup USB drive.
  Since this computer (that I install W2008) does not have a record/log for all the backups done on the USB drive, how can I (1) check to see what has been backed up and (2) restore files from this USB hard drive to the local computer hard drive?
  I personally prefer to restore files from backup ext. USB drive directly to SBS2011 server, if that is a good idea.
  Thank you.
0
Comment
Question by:sglee
  • 3
  • 3
7 Comments
 
LVL 87

Accepted Solution

by:
rindi earned 250 total points
ID: 41812894
It is very unlikely that the server is infected by the virus. Much more likely is that one of the connected PC's is. So remove all your PC's from the LAN, then either scan them for the virus, or better, just re-image them so they are clean. People usually shouldn't work on the server directly, so it shouldn't have been infected. Just restore the data from the backups.
0
 

Author Comment

by:sglee
ID: 41812909
I understand your point, but for abundance of caution...
Is there a way to duplicate external USB hard drive that has a server back up?  Before I reconnect the external USB hard drive to the server, I want to make sure that I have a duplicate  USB hard drive of a production.
0
 
LVL 78

Assisted Solution

by:David Johnson, CD, MVP
David Johnson, CD, MVP earned 250 total points
ID: 41812910
you can restore from the recovery image or the installation disk. The backup is a vhd file.. Note: backup files are a target of many ransomeware engines.
0
Why You Should Analyze Threat Actor TTPs

After years of analyzing threat actor behavior, it’s become clear that at any given time there are specific tactics, techniques, and procedures (TTPs) that are particularly prevalent. By analyzing and understanding these TTPs, you can dramatically enhance your security program.

 
LVL 87

Expert Comment

by:rindi
ID: 41812937
You could use some cloning or imaging tool to make a copy of your backup disk.
0
 

Author Comment

by:sglee
ID: 41812939
Xcopy or Robocopy is not recommended?
0
 
LVL 87

Assisted Solution

by:rindi
rindi earned 250 total points
ID: 41812946
I don't think they would work on a server backup USB device. Use GParted, that makes an exact copy.
0
 

Author Comment

by:sglee
ID: 41812961
OK. I will use Paragon Drive Copy then.
0

Featured Post

What Should I Do With This Threat Intelligence?

Are you wondering if you actually need threat intelligence? The answer is yes. We explain the basics for creating useful threat intelligence.

Join & Write a Comment

Because virtualization becomes more and more common, and, with Microsoft Hyper-V included in Windows Server at no additional costs, and, most server hardware nowadays is more than capable of running a physical Small Business Server (SBS) 2008 or 201…
AWS Glacier is Amazons cheapest storage option and is their answer to a ‘Cold’ storage service.  Customers primarily use this service for archival purposes and storage of infrastructure backups.  Its unlimited storage potential and low storage cost …
This tutorial will walk an individual through the process of installing the necessary services and then configuring a Windows Server 2012 system as an iSCSI target. To install the necessary roles, go to Server Manager, and select Add Roles and Featu…
This Micro Tutorial will teach you how to reformat your flash drive. Sometimes your flash drive may have issues carrying files so this will completely restore it to manufacturing settings. Make sure to backup all files before reformatting. This w…

708 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

18 Experts available now in Live!

Get 1:1 Help Now