MediaAgent recovery after a ransomware attack (Part 2)

  • 19 September 2022
  • 6 replies

Badge +5

Hello !

Following a previous archived thread about Media Agent protection, I would like to mention some additional concerns about Windows Media Agent backup.

So, in case of a ransomware attack let’s say, you are protected for the CV Deduplication Database (from system backup set), but what about:

  • Cache directory
  • Index Cache directory
  • Job results directory

What’s the best practice to protect them?
Are they really mandatory components for a Media Agent restore in order to be able to start VM, o365 etc restore jobs?

Thank you in advance,

6 replies

Userlevel 7
Badge +23

Job Results are temporary only or used for staging (in some O365 backups) but nothing you’d need historical data for so not really necessary.  It’s not that you can’t or shouldn’t.  More so if you have an older copy of it and restore it to a rebuild Media Agent, I’m not sure how often it will be helpful (though others might have some insight/experience).

For the “Cache” directory, are you referring to the Software cache?  No real need to back it up.  you can just download it anew, though if you ABSOLUTELY need an older version, then perhaps it’s a worthwhile effort (depending on your use case).

For the Index Cache, we can back up v2 Index Cache data to protect you from disasters:

If you’re still on v1 Indexing, here’s the docs to convert the clients to v2:

Userlevel 3
Badge +6

So far I have never had a reason to backup the MediaAgents.

The DDBs and Index (v2) are automatically added to backups - unless you have modified these schedules. These are the only items that need protecting. These are not part of the System State backup but a dedicated DDB Backup subclient that will use snapshots to get a consistent copy.

The v1 indexing is automatically rebuilt from the old backups when they are missing so these are also automatically protected along with every backup job.

As Mike says, others may see it differently but outside of the DDB and Index backups nothing else is needed.

Badge +5

Dear @Graham Swift@Mike Struening,

Im not sure which answer mark as “Best answer” :)

Thanks you very much both, your replies are very useful, and I thing that all of us must be prepared for these kinds of “disasters” with so many ransomware attacks.  

Also one last thing, is there any documentation / best practices about the steps that you must follow for a Windows MA restore?

Have a nice day :)

Userlevel 7
Badge +23

I say mark @Graham Swift ‘s as the Best Answer 😁

For a Media Agent rebuild, you can follow this doc:

this covers pretty much every scenario!

Badge +5

Also, another interesting fact that I found recently is that DDB is not required in case of a data restore.

Even if the MA that has the DDB is offline (from a ransomware attack), you can still restore your data without a DDB to be online! You will need your DDB for new backups in order to save the Storage space.

Userlevel 7
Badge +23

That's right!  The DDB is only needed for backups and data aging/pruning.