New restoration options

Following the increase in ransomware attacks among your customers, Beemo Technologie’s technical teams have worked on improving the recovery process to make it easier and faster to recover encrypted data.

As a reminder, once executed on the machine (via an email containing a downloadable attachment), the ransomware encrypts the files making them unusable.

In order to be able to restore the infected files, it is first necessary to assess the extent of the infection :

Identifying encrypted files : often the file extension has been changed to .locky or .mp3. The file name may also have been changed,
By assessing the scope of the infection: it is necessary to identify the beginning and end of the infection as well as the file extensions affected by the attack, bearing in mind that the virus works alphabetically.

Until now, if you wanted to restore only a subset of your data, you had to select the files or folders to restore one by one. It is now possible to make a multiple selection by using the shift key on your keyboard. A single operation will allow you to select all the files to be restored and save time.

The second improvement allows to restore only what is necessary by allowing to restore differently depending on whether :

the file already exists :

the file doesn’t exist :

Here are the types of restorations we recommend depending on the type of ransomware you are facing :

The ransomware modifies the name or extension of the file (Locky, MP3,…) :

If the file already exists : keep it,
If the file doesn’t exist : create it.

The ransomware modifies the content of the file – if the period of the attack could be identified :

If the file already exists : replace it if it has been modified between [date de début d’infection] and [date de fin d’infection],
If the file doesn’t exist : don’t create it.

The ransomware changes the content of the files – if the time of the attack is not well known :