If ransomware has encrypted your database, create a restoration task to recover data from a clean backup and minimize data loss.
Prerequisites
Before you begin, make sure that:
An anti-ransomware policy is created for your database and is enabled, so data is being backed up under that policy
At least one backup version exists (the number of backup versions is not zero)
Constraints
Review these constraints before starting:
OS compatibility: You can only restore data to a server that runs the same operating system as the original database server. The target server must also have a protection agent installed. Cross-OS restoration is not supported.
Concurrent task conflict: If a backup task and a restoration task run on the same server at the same time, the restoration task fails. Stop any running backup task on the target server before you create a restoration task.
Create a restoration task
Log on to the Security Center console. In the top navigation bar, select the region of the asset — China or Outside China.
In the left-side navigation pane, choose Protection Configuration > Host Protection > Anti-ransomware.
On the Database extortion virus protection tab, find the database you want to restore and click Restore in the Actions column.
In the Restoration dialog box, configure the parameters for your database engine. Parameters differ by database engine:
MySQL
Parameter Description Recovery time point The time at which the selected backup was generated. To restore data to its pre-encryption state, select the last backup version created before the ransomware attack. Restore to server The target server for the restored data. Must run the same OS as the original server and have a protection agent installed. Stop any running backup task on this server before proceeding. SQL Server
Parameter Description Change database The database whose data you want to restore. List of stored backups The backup to use for restoration. Select the last backup version created before the ransomware attack to recover data closest to its pre-encryption state. Restore to server The target server for the restored data. Must run the same OS as the original server and have a protection agent installed. Stop any running backup task on this server before proceeding. Oracle
Parameter Description Select recovery version The backup version to use. The value is a time range during which the data was backed up. Recovery time point The specific point in time within the selected backup range. Set this to any time within the backup time range. Restore to server The target server for the restored data. Must run the same OS as the original server and have a protection agent installed. Stop any running backup task on this server before proceeding. Click OK.
The anti-ransomware agent runs the restoration task.
View the restoration task
Track the task in the Recovery record panel. To open it, click the value shown under Recovering / Recovering Records on the Database extortion virus protection tab.
When the task completes, the Recovery Status column changes to Successful.