Accelerating ransomware recovery using a combination of local and remote backups

A system comprising:

• a backup selector identifying a latest unencrypted remote backup, the latest unencrypted remote backup being a remote backup appearing prior to an encrypted backup in a sequence of backups;
• the backup selector identifying a latest unencrypted local backup, the latest unencrypted local backup being a local backup having been created prior to the latest unencrypted remote backup;
• the backup selector identifying a penultimate unencrypted remote backup, the penultimate unencrypted remote backup being a remote backup having been created prior to the latest unencrypted local backup;
• a restoration manager restoring, in a first computing environment, a local computing asset to a state of the latest unencrypted local backup, wherein the latest unencrypted local backup is stored locally to the first computing environment, and wherein the latest unencrypted remote backup and the penultimate unencrypted remote backup are stored in a second computing environment across an external computer network from the first computing environment;
• the restoration manager receiving a first difference between the latest unencrypted remote backup and the penultimate unencrypted remote backup;
• the restoration manager further restoring the local computing asset with the first difference;
• the restoration manager receiving a second difference between a failback backup and the latest unencrypted remote backup;
• and
• the restoration manager further restoring the local computing asset with the second difference.

One or more computer storage media having computer-executable instructions that, upon execution by a processor, cause the processor to at least:

• identify a latest unencrypted remote backup as a remote backup appearing prior to an encrypted backup in a sequence of backups;
• identify a latest unencrypted local backup as a local backup having been created prior to the latest unencrypted remote backup;
• identify a penultimate unencrypted remote backup as a remote backup having been created prior to the latest unencrypted local backup;
• restore, in a first computing environment, a local computing asset to a state of the latest unencrypted local backup, wherein the latest unencrypted local backup is stored locally to the first computing environment, and wherein the latest unencrypted remote backup and the penultimate unencrypted remote backup are stored in a second computing environment across an external computer network from the first computing environment;
• receive a first difference between the latest unencrypted remote backup and the penultimate unencrypted remote backup;
• further restore the local computing asset with the first difference;
• receive a second difference between a failback backup and the latest unencrypted remote backup;
• and
• further restore the local computing asset with the second difference.