What is a clean restore point?
A clean restore point is a backup that can be restored without bringing back malware, attacker-created accounts or other traces of a compromise. After a ransomware incident it is usually the most recent restore point taken before the intrusion began, which is often not the most recent one that exists.
Why is the newest restore point not always clean?
The time between an attacker's first access and the visible attack is known as dwell time, and it commonly runs from days to weeks. Every backup taken in that window records the system as the attacker left it. Restoring one of them recovers the data and the foothold together. The restore point that matters is the last one from before first access, or the last one that can be shown to be free of the attacker's changes.
How is a clean restore point identified?
No single test proves a restore point is clean. Teams combine several sources of evidence.
| Evidence | What it contributes |
|---|---|
| Incident investigation timeline | Estimated date of first access |
| Malware scanning | Known tools found or not found in each point |
| Entropy and change-rate history | When encryption began on each system |
| Indicators of compromise | Specific files, accounts or tasks to search for |
| Test restore in isolation | Whether the system starts and behaves normally |
Does the same point apply to every system?
Usually not. Systems are compromised at different times, and data and executable code carry different risks. A common approach restores operating systems and applications from before first access, or rebuilds them from trusted media, and restores business data from the most recent point, since data files rarely carry the attacker's tools. That keeps data loss small while removing the foothold. It requires being able to restore data separately from the system image, for example through file-level restore or database-level recovery.
What does this require of backup storage?
Finding a clean point is only useful if that point still exists. Retention has to reach back further than the likely dwell time, which argues for weeks of history, not days. The restore points have to be immutable, since attackers try to delete backups before they strike. And restoring into an isolated environment first, a clean room, allows inspection before anything touches production. Choosing a clean recovery point describes the decision process.
Frequently asked questions
How far back is a clean restore point likely to be?
It varies with how long the intruder was present. Planning for several weeks of retained, immutable restore points covers most cases.
Can a restore point be cleaned instead of going further back?
Sometimes. A system can be restored in isolation, remediated and then returned to production, but that relies on finding everything the attacker changed.
Who decides which restore point to use?
The incident response lead, with input from forensics, the backup team and the owners of the affected systems.