Using GuardMode Scan

GuardMode Scan is a powerful feature that allows you to scan mounted filesystems for potential ransomware infections or data encryption. This tool is particularly useful when you want to ensure the integrity of your data before restoring it to production environments.

Initiating a GuardMode Scan

To begin a GuardMode scan on a mounted filesystem:

1. In the volume view of your mounted filesystem, click on the GuardMode Scan tab.

2. Click the Scan with GuardMode button to start the scan.

Now, the table will display detected suspicious files in real-time.

Tip. Always scan mounted snapshots before restoring data to production environments. This best practice helps prevent the introduction of compromised data into your systems.

Understanding Scan Results

The scan results table provides comprehensive information about potentially compromised files. It consists of four columns:

1. Suspicious File: Lists the path and name of files flagged during the scan.

2. Entropy Result: Indicates the level of randomness in the file's content, which can be a sign of encryption.

3. Magic Number Result: Shows whether the file's signature matches its expected file type.

4. Matched Blocklist Pattern: Displays any blocklist patterns that the file matched against.

Tip. Files with high entropy, mismatched magic numbers, or those matching blocklist patterns are more likely to be compromised. Regularly update your GuardMode blocklist to stay protected against the latest threats.

Interpreting and Acting on Scan Results

If GuardMode Scan detects suspicious files in a snapshot:

1. Review the scan results carefully.

2. Understand that a compromised snapshot can indicate an infected system at the time the snapshot was taken.

3. Do not restore from this snapshot. Instead, navigate to earlier snapshots and scan them with GuardMode.

4. Continue this process until you find a clean snapshot without any suspicious files.

5. Use the earliest clean snapshot for your restoration to ensure you're reverting to a state before the infection occurred.