Cleanroom Recovery: Restoring Without Restarting the Attack

A restore after a ransomware attack is different from a restore after a storm. After a storm, the backups are trustworthy and the problem is getting them back fast. After ransomware, neither production nor the latest backups can be trusted: the attacker may still have access, and the backups may contain their tools.

Restore straight back into production and you risk restarting the attack.

What a cleanroom is

A cleanroom is a temporary, on-demand environment, separate from production, used to analyze an attack, test recovery and validate workloads before they go back into production.

With Commvault Cleanroom Recovery, that environment is in the cloud, so there's no standby recovery site to buy or maintain.

Four steps

1. Isolate. Recovery runs in an isolated cloud environment, separate from production, behind multi-layered zero-trust access controls.
2. Identify threats. Backups are checked for malware inside the cleanroom, before anything is restored, so infected data stays out.
3. Rebuild clean. Systems are restored from a predefined, validated clean image, a factory reset, rather than patched back into service.
4. Validate. Application recovery is verified and post-recovery threat hunting runs before workloads return to production.

Why it starts with the backups

A cleanroom is only as good as the copies you recover from. They need to be air-gapped and immutable, so they can't be altered or deleted even by an attacker with admin credentials. That's the "1" in the 3-2-1-1-0 rule doing its job.

Forensics without the risk

Investigators also need somewhere safe to work. Recovered systems in the cleanroom can be examined away from production and away from the attacker, while the business gets running again.

Use it before there's an incident

Recovery testing is one of the main uses of a cleanroom. Because it's isolated, you can rehearse a full recovery without touching production, and find out how long it really takes. KELYN runs those tests so you know your recovery plan works before you need it, and KELYN's U.S.-based engineers run recoveries alongside your team when it's real.

The Cleanroom Recovery overview is a two-page PDF to share with your team.