Ransomware Recovery with NAKIVO

NAKIVO Backup & Replication is a comprehensive data protection solution that makes recovery from a ransomware attack possible. Minimize data loss and business disruptions without paying the ransom.

✔ Backups tiering to avoid single point of failure
✔ Immutable local and cloud storage
✔ Instant granular recovery
✔ Instant VM recovery
✔ Automated failover
✔ Disaster recovery orchestration

Leading Brands Trust NAKIVO


Ransomware Recovery with NAKIVO’s Data Protection Solution

Reliable Backups

Reliable Backups

Apply the 3-2-1 backup rule to eliminate a single point of failure

Immutable Storage

Immutable Storage

Guarantee data recovery by protecting backups from overwriting and encryption by ransomware

Proved Recoverability

Proved Recoverability

Test backups and replicas in seconds to ensure successful data recovery in case of a ransomware attack

Faster Recovery Options

Faster Recovery Options

Restore physical and virtual machines in mere minutes, or instantly recover files and app objects

Flexible Retention Policies

Flexible Retention Policies

Create thousands of recovery points using the GFS retention scheme for effective data protection and recovery

Site Recovery Orchestration

Site Recovery Orchestration

Automate ransomware data recovery to ensure continuous availability and business resilience

Ransomware Data Recovery Features

Automated Verification

Ensure successful recovery by testing if your replicas, data backups and backup copies are bootable. The instant verification feature automatically verifies the functionality of your VMs by running the VM directly from the newly-created backup in a test mode environment (with the networking turned off).

Flexible Retention

Save up to 4,000 recovery points per backup and rotate them daily, weekly, monthly and yearly. The retention policy follows the grandfather-father-son (GFS) scheme, providing you with a large ransomware data recovery window. Having thousands of recovery points covering different points in time ensures continuous data protection and provides fast data recovery during or after the ransomware infection.

Data Protection Through Immutability

Immutable backups cannot be modified, encrypted, overwritten or deleted by a user or ransomware. With your data backups locked, you add another layer of ransomware protection and, thus, increase the chances of successful data recovery after a ransomware attack.

Local Linux-based storage. Configure the repository or deploy as a part of the solution’s hardened VA or AMI.
Immutability in the cloud. Use the native cloud features to make backups immutable in cloud storage (Amazon S3, Azure Blob, Backblaze B2, Wasabi).

Data Availability

Implement the 3-2-1 backup strategy in your data recovery plan and store backup copies in multiple locations. If your primary backup gets encrypted, you can still recover from ransomware without paying the ransom and resume operations with minimum downtime and data loss.

Onsite. Keep backup copies onsite for faster and simpler data recovery.
Offsite. Send backup copies to a remote site or the cloud (Amazon S3, Wasabi, Backblaze B2 or Azure Blob) to eliminate a single point of failure and ensure data availability.
Tape. Meet compliance requirements and archival needs with native tape support.

Recovery Orchestration and Automation

Use Site Recovery and automation features to maintain business continuity and ensure 24/7 availability of your data and systems with the minimum downtime:

Replicate critical VMs and EC2 instances and store replicas on a remote site.
Configure automated backup and replication for the machines that match your criteria.
Create multiple site recovery workflows of any complexity, which can also be tailored for recovery from ransomware.
Test workflows to ensure that you meet RTO objectives and guarantee data recovery.
Perform a one-click switch to a secondary location (failover) to rapidly resume your business operations without paying the ransom.

data automation

Instant Ransomware Recovery Options

Choose from a variety of instant data recovery options to restore full VMs or individual files to their original location or to any custom location in minutes:

Instant VM boot from backups.
Instant physical-to-virtual recovery of physical machines (as VMware VMs) from backups.
Granular recovery of encrypted files, corrupted folders and application objects with all permissions preserved.

Cross-Platform Recovery

Use Cross-Platform Recovery for more effective data recovery in mixed physical and virtual environments:

Convert physical machines to VMware vSphere or Microsoft Hyper-V VMs.
Recover VMware vSphere VMs as Microsoft Hyper-V VMs or vice versa.

NAKIVO Backup & Replication Pricing

Starting at USD 29 per workload per year
billed upfront. 24/7 Support included.

Unlock numerous ransomware recovery options with a perpetual or subscription license of NAKIVO’s backup solution:

Full data recovery in every edition.
Flash VM Boot, instant granular recoveries, cross-platform recoveries and automated failover in the Pro editions.
Complex Site Recovery functionality in the Enterprise editions.

Perpetual licenses are charged per CPU socket, physical machine or Oracle database for indefinite use. Get 1 year of free standard technical support via phone, chat and email during business hours.

Subscription licenses are charged per workload, which can be a single VM, instance, physical server (or 3 workstations). Get 1 year of free 24/7 technical support.

For more details, see Pricing and Editions.

recovery pricing
Not Sure What to Choose? Try for Free!
15 days with no limitations. No credit card required.
Office 365 backup Pricing

  • Deploy anywhere. Easily install on Windows and Linux physical machines, NAS devices or deploy the solution as hardened VA or AMI.
  • Perfect for mixed environments and hybrid clouds. Protect VMware, Hyper-V, Amazon EC2, Nutanix AHV VMs; Windows/Linux physical servers and workstations; Microsoft 365 apps; and Oracle databases via RMAN.
  • Secure recovery from immutable local and cloud repositories or from air-gapped backups on external storage devices or tape.
  • Replication of VMs and EC2 instances.
  • Multiple instant recovery options that include VM boot, granular and physical-to-virtual recovery.
  • Cross-platform recovery capabilities for mixed and hybrid environments.
  • Simple administration of the data recovery plan with no errors due to convenient scheduling and automation features.

How to Recover From a Ransomware Attack with NAKIVO’s Solution

How to identify ransomware infections?

Detecting a ransomware attack can be challenging since malicious software silently propagates and encrypts data across networks. An IT monitoring solution can help you identify an infection since it continuously surveys your environment and records abnormal CPU, network and file system activities caused by ransomware. You might also notice that some files were deleted, modified or locked following the attack.

How to protect backups from ransomware?

Backups stored in onsite repositories or in the cloud can be targeted by ransomware attacks. Luckily, you can implement the protection measures below to minimize the risk:

Backup immutability: Make backups immutable in local Linux-based repositories or in cloud storage platforms that support immutability (Amazon S3, Wasabi, Backblaze B2 or Azure Blob). Locked data cannot be modified or encrypted by ransomware thus ensuring recoverability in case of an attack.
Access control: Enable Role-Based Access Control (RBAC) to prevent unauthorized access to your data.

How to mitigate ransomware attacks?

A comprehensive ransomware protection strategy should include the following measures:

Ransomware prevention: Conduct continuous employee training, perform backups, install security tools and keep your systems up to date.
Ransomware detection: Monitor your environment to quickly identify a breach before it affects critical data.
Ransomware recovery: Disconnect the infected devices and restore your data from backups to minimize downtime.

Keep in mind that it is not recommended to pay the ransom since you might not regain access to your encrypted data.

removing encryption

How to recover encrypted files following a ransomware attack?

By conducting backups on a regular basis, you can ensure that your data is recoverable following a ransomware attack. Modern data protection solutions allow you to instantly boot entire workloads. You can also quickly recover individual files, folders or application objects such as Microsoft Exchange Server, Active Directory and SQL Server.

How to remove encryption by ransomware?

Before you try to remove the encryption, you should first identify the ransomware type and version. Once done, use an antivirus software or decryption tool to unlock your files. It is important to note that advanced ransomware infections cannot be removed using these technologies which is why you should rely on backups to recover your data.


Want to learn more? Explore our resources

Useful Downloads


Infographic: How to Recover from Ransomware

Discover the latest ransomware stats, types and learn how to recover from ransomware if your data have been infected.


Infographic: Ransomware 2021: What You Should Know to Be Prepared

Get ready for a ransomware attack. Discover attack vectors, impact on businesses, and learn if your cloud data is safe.


White Paper: Best Practices for Ransomware Protection and Recovery

Learn the best data protection and recovery practices to resume your IT operations with minimum downtime.


Frequently Asked Questions

How do I plan ransomware recovery?

By backing up your data regularly, you can ensure a smooth ransomware recovery process and avoid paying ransoms. You can use data backups to restore your machines to a specific point in time before the incident or use instant granular recovery to restore files and application objects.

How long does it take to recover from ransomware?

The ransomware recovery process varies from one business to another and depends on several factors, including the company’s size, data encryption and ransomware type, amount of data to be restored, etc. According to a survey conducted by Vanson Bourne, it might take up to 33 hours to recover from ransomware as long as there is a valid backup available.

How does immutability protect data from ransomware attacks?

Data backups stored in local Linux storage or cloud storage platforms that support immutability can be made immutable for a defined retention period. Locked data can’t be deleted, encrypted and overwritten until the retention period expires. Immutability helps ensure that backups aren’t corrupted and thus can be used for data recovery from a ransomware attack. Additionally, you can use air-gapped and offline backups stored on tape or external storage devices to recover from a ransomware attack.

What types of ransomware recovery can I perform?

After a ransomware attack, NAKIVO Backup & Replication can help you restore files and application objects from backups with Instant File Recovery and Instant Object Recovery. You can also instantly boot VMs from backups or perform P2V recoveries of your physical machines as VMware VMs.

How quickly is ransomware deployed?

Ransomware attacks usually spread using stolen credentials or phishing emails that include dangerous attachments or links. The harmful malware can deploy malicious software in seconds once the attachment is opened or the link is clicked. Conduct continuous data protection and anti-malware training for your staff to prevent ransomware by recognizing malicious links and phishing emails.

Why is it recommended to never pay ransoms to hackers?

Ransomware victims might not regain access to their encrypted files even after paying the ransom. Moreover, your readiness to pay the ransom may encourage cyber criminals to carry out more ransomware attacks in the future. You should also check the laws in your jurisdiction, as paying out ransoms can incur sanctions in some countries (note the U.S. Department of Treasury advisories, for example).

“With NAKIVO Backup & Replication, the university saved time and money, while gaining peace of mind. I now spend the majority of my time not on backup administration, but on other IT-related tasks.”.
Edwardson A. Pedragosa Jr., Network Administrator at the Asia-Pacific International University
Boise Cascade
“NAKIVO’s fast VM backup and VM replication keep our critical VMs running at all times. If our VMware VMs failed, we would only need a couple of minutes to recover with VM failover and failback.”
Noel Peden, Applications Development Supervisor at Boise Cascade
“With NAKIVO Backup & Replication installed on QNAP NAS, the backup is 2.5X faster! We found a professional solution that covers all our needs, saves money, and provides reliability.”
Mickaël Masquelin, IT Department Manager at the IEMN
“With NAKIVO Backup & Replication, every hour that we save on VM backup administration can be translated into cost savings. NAKIVO Backup & Replication is resource-efficient in terms of installation and configuration. NAKIVO Backup & Replication is just what we needed.”
Samuel Riley, IT Manager at MyoKardia
One World Direct
“In NAKIVO Backup & Replication, we found a stable VM backup solution that lets us back up VMs faster and recover VMs in minutes, which is extremely helpful in order to keep our business operations available at all times.”
Steven Schmidt, System Administrator at One World Direct

Need Help?

NAKIVO’s Support Team is always here to help if you encounter any issues. If you need assistance:
  • Give us a call

    Americas: +1 702 605 4495

    Europe: +44 207 193 1230

    Asia: +886 2 2656 5927

  • Contact us by email: support@nakivo.com
  • Contact us via the chat in the product interface
  • Browse the online knowledge base, anytime and anywhere


NAKIVO Community Forum is a valuable information resource where you can:
  • Share your ideas with tech experts and fellow users
  • Discuss the latest news and upcoming product releases
  • Ask and answer questions about NAKIVO Backup & Replication
  • Learn more about the software capabilities

Free Trial of NAKIVO
Backup & Replication