Corruption-free recovery point determination for ransomware attacks against storage systems

A system comprising:

• a memory storing instructions;
• and
• one or more processors communicatively coupled to the memory and configured to execute the instructions to perform a process comprising:
• accessing a first compressibility metric indicating an amount of storage space saved if write traffic processed by a storage system is compressed and a second compressibility metric indicating an amount of storage space saved if write traffic processed by an additional storage system is compressed, the additional storage system configured to replicate data stored by the storage system;
• determining, based on the first and second compressibility metrics, that the storage system is possibly being targeted by a security threat that causes a potential data corruption;
• creating or locking down one or more recovery datasets for use in restoring the data stored by the storage system to an uncorrupted state;
• presenting a graphical interface to a user that provides a graph over time of the first and second compressibility metrics usable to determine when an attack may have started over time and where changes related to differences between continuous data protection consistency points are presented in time order using the graph;
• and
• determining, based on user input provided by the user with respect to the graph, a corruption-free recovery point for potential use by the storage system to recover from the potential data corruption using the one or more recovery datasets;
• selecting, based on the corruption-free recovery point, a recovery dataset corresponding to the corruption-free recovery point;
• and
• restoring, based on the selected recovery dataset, the data stored by the storage system to the uncorrupted state.

A non-transitory computer-readable medium storing instructions that, when executed, direct a processor of a computing device to perform a process comprising:

• accessing a first compressibility metric indicating an amount of storage space saved if write traffic processed by a storage system is compressed and a second compressibility metric indicating an amount of storage space saved if write traffic processed by an additional storage system is compressed, the additional storage system configured to replicate data stored by the storage system;
• determining, based on the first and second compressibility metrics, that the storage system is possibly being targeted by a security threat that causes a potential data corruption;
• creating or locking down one or more recovery datasets for use in restoring the data stored by the storage system to an uncorrupted state;
• presenting a graphical interface to a user that provides a graph over time of the first and second compressibility metrics usable to determine when an attack may have started over time and where changes related to differences between continuous data protection consistency points are presented in time order using the graph;
• and
• determining, based on user input provided by the user with respect to the graph, a corruption-free recovery point for potential use by the storage system to recover from the potential data corruption using the one or more recovery datasets;
• selecting, based on the corruption-free recovery point, a recovery dataset corresponding to the corruption-free recovery point;
• and
• restoring, based on the selected recovery dataset, the data stored by the storage system to the uncorrupted state.