From experience, snapshots on primary storage is by far the best way to recover from a cryptolocker. Full restore from secondary backup (tape/disk) will take time.... just ask Maersk.
One very important thing to remember... If every block in the environment is encrypted your snapshot will grow to the same size as the used space on the volumes. So sizing for it may be expensive. Luckily not all(if any) cryptolocker viruses does that, but you still will need more capacity on the array.
_________________ The views and opinions expressed are my own and do not necessarily reflect those of my current or previous employers.
|