Home  ›  Glossary  ›  Bare-Metal Restore

What is bare-metal restore?

Bare-metal restore (BMR) is rebuilding a complete computer, with its operating system, settings, applications and data, onto a machine with nothing installed. It works from an image backup, a copy of the whole disk rather than selected files.

Recovery speed is where it pays off. In the Sophos State of Ransomware 2025 survey, 53% of victims had recovered within a week, up from 35% a year earlier.

Rebuilding the house, not just the furniture

A file backup saves the furniture. If the house burns down, someone still has to rebuild the walls before anything can go back in. A bare-metal restore brings back the whole house with the furniture already in place.

Without it, rebuilding a physical server means installing the operating system, then each application, then its settings, and only then the data. That takes a day or more per server and relies on someone remembering how it was built. From an image, the same server returns in about the time it takes to write its disks.

The rebuild in four moves

  1. Start the empty machine from recovery media, such as a USB stick or network boot.
  2. Connect to the backup storage and pick a restore point. After ransomware, that is the last one known to be clean.
  3. Write the disk image back, matching or resizing the original layout.
  4. Fix drivers for the new hardware and restart into the restored system.

Traps that stop a rebuild

  • Only files were backed up. File-level backups never produce a machine that boots. An image-level backup agent is needed for that.
  • The old hardware is off limits. After an attack, servers are often held for investigation. Restoring to a different model or to a virtual machine then decides whether recovery starts on day one.
  • The login depends on Active Directory. If the recovery tools sign in through the domain that was encrypted, the restore stops at step two.
  • Disk encryption keys are missing. A BitLocker image whose keys were kept only in Active Directory may restore and then refuse to boot.
  • Too many servers at once. Rebuilding twenty machines in parallel makes storage read speed the bottleneck, which is where restore throughput comes in.

For a system that cannot wait even an hour, instant recovery runs it straight from backup storage. Rebuilding inside a sealed-off network first is called clean room recovery. All of it rests on sound data backup habits.

ARTESCA and bare-metal restore

In a bare-metal restore, ARTESCA is the repository the backup application reads images from, over S3. ARTESCA accounts sit outside the production directory, so reaching the backups does not wait for a domain rebuild. Images stored under S3 Object Lock in compliance mode stay available until their retain-until date, whatever happened to the original server.

Recovery media, drivers and BitLocker keys sit outside the storage. Read speed during a large rebuild depends on the ARTESCA setup and the network path to the machines being restored.