Discussion: Enhancing VBK resilience against partial ransomware encryption and severe metadata loss

Hi ​@HDD Masters - generally, it’s best to make feature requests and architectural discussions on Veeam products over on the Veeam Forums. Veeam Product Managers monitor ther Forums for such posts and can make comments on your suggestions, as well as discuss potential future roadmaps coming down the road (If they’re able to share).

Best.

Yes, as Shane mentioned the Forums would be the place for this type of discussion/feedback.  Since this is just a community of backup professionals we would not be able to comment or put forth suggestions like this.  Best of luck on the forums with this discussion.

​@coolsport00, ​@Chris.Childerhose Thank you for the feedback. I'm going to register on the Veeam Community forum now.

No problem.  Please let us know how it goes over there and post a link to your forum post so we can watch it or contribute.

Unfortunately, the forum doesn't accept my corporate email address, nor does it accept standard Gmail addresses. It seems a technical discussion here won't be possible after all. Thank you all once again for your time and insights.

Upd. It seems the issue was caused by selecting the 'Minsk' time zone. When I chose 'Vilnius', the registration went through. I guess that means I'll only be legally allowed to 'be there' when I'm actually physically in Lithuania.

That seems odd the timezone caused the issue but glad you got registered and can start this discussion.

​@HDD Masters - haha...😊 Well, glad you got it sorted. Hope the Veeam PMs can provide you some valuable input.

Best.

​@Chris.Childerhose ​@coolsport00  Do you think it would be valuable if I wrote a not short post here outlining the types of damage from which data can still be recovered from Veeam Backup files (VBK, VIB, VBR), and what the recovered user data can be expected to look like? How usable will this data be going forward? (Especially in cases where the file's metadata is severely corrupted and some data blocks are missing)

You could do a blog type post about it but indicate support is the route to go for users.

​@HDD Masters - agree with Chris; and of course...redact any org-specific and/or personal data & info

​@coolsport00 ​@Chris.Childerhose 
Absolutely. There will be no direct advertising of services. The goal is simply to clarify what users can expect and present the information in a clear "Q&A" (Question & Answer) format.

We can include screenshots from my in-house lab utility if that makes it clearer, or omit them entirely if forum rules discourage it. A text-only description works perfectly fine too.

Here is an example:

(This post is strictly informational, focusing on data recovery prognosis).

Q: The Storage Header is corrupted/destroyed.
A: This is the simplest scenario to reconstruct, as it only affects the first 4 KB of the file. There is nothing overly complex here. The key is to correctly identify and inject the proper Format Version number and block size to allow the archive to be parsed successfully. In this case, the prognosis for 100% data recovery is excellent.

Q: Both SnapShot Slots (0 and 1) are corrupted/destroyed.
A: This requires a full-file scan to locate the Metabanks. The process involves building lists of banks for both the primary (0) and secondary (1) copies, reconstructing the SnapShot Slots, writing the SnapShot Slot Descriptions, and rebuilding the bank tables with recalculated CRCs for both the individual banks and the SnapShot Slots themselves. With this approach, the prognosis for successful recovery remains close to 100%.

Do you approve of this format for presenting the information in post?

Hi ​@HDD Masters ...the format is mostly strictly up to you really. Looking fwd to reading it! 😊

That format looks good to me.  If there are problems with the post, you will be notified or contacted by an admin, so might as well post and see. 😋