Skip to main content

Hi:

 

I’ve searched the content here and could not find an answer, sorry if this has been discussed previously. I’m interested in the possible actions after ransomware detection capabilities state that some files are malware. How do you “clean the backups” from attacking files that could be lurking around for some time?

Is there an automated way, or should the admin do a manual search and delete?

 

Thanks!

 

JP

@Juampa , you can do a delete by browse to remove the files:

https://documentation.commvault.com/commvault/v11_sp9/article?p=features/erase_data/t_erase_data_by_browsing_job.htm

Do you have any of Commvault’s Ransomware tools enabled?

 


Thanks Mike, I’m asking for one of our customers and yes, they have some ransomware options active. The question is: can the deletion be automated or in a batch?


Well, I think that the answer is just there:

 

  • Deleting data by this method deletes all versions of the data across all backup and archive sets that are configured under a client. If the data exists in multiple backup or archive sets, deleting the data in any one of them deletes the data everywhere. After deleting backed up or archived data, it is no longer retrievable.
  • Content indexing data does not honor deleting data by browsing. If a file is deleted using browsing and it was content indexed, the file will remain in the content index on the Search Engine according to the retention settings for content indexing.

 


Right, because you’re identifying the file via browse, it’s across all copies.

Sharing this link as well for anyone else reading for the File Anomy alert:

https://documentation.commvault.com/11.24/expert/7879_monitoring_file_anomalies_on_client_computers_01.html


 

Is this option still available

 

https://documentation.commvault.com/commvault/v11_sp9/article?p=features/erase_data/t_erase_data_allow_storage_policy.htm

 

https://documentation.commvault.com/commvault/v11_sp9/article?p=features/erase_data/t_erase_data_by_browsing_job.htm

 

 


This should be what you’re looking for:

https://documentation.commvault.com/2022e/expert/12709_deleting_backup_data_and_archive_data_from_commcell_console.html

We have a KB on the feature as well:

https://kb.commvault.com/article/54407


Reply