Acronis Cyber Protection Service 21.01 User Manual

Downloading files from the cloud storage

Extracting files from local backups

204

SharePoint Online data

G Suite

Mailboxes

Google Drive files

Shared drive files

Safe recovery is not supported for CDP backups . The machine will be recovered based on the last

Note for Mac users

Starting with 10.11 El Capitan, certain system files, folders, and processes are flagged for protection with an extended file attribute com.apple.rootless. This feature is called System

Integrity Protection (SIP). The protected files include preinstalled applications and most of the folders in /system, /bin, /sbin, /usr.

The protected files and folders cannot be overwritten during a recovery under the operating system. If you need to overwrite the protected files, perform the recovery under bootable media.

Starting with macOS Sierra 10.12, rarely used files can be moved to iCloud by the Store in Cloud feature. Small footprints of these files are kept on the file system. These footprints are backed up instead of the original files.

When you recover a footprint to the original location, it is synchronized with iCloud and the original file becomes available. When you recover a footprint to a different location, it cannot be synchronized and the original file will be unavailable.

12.14.2 Safe recovery

A backed-up OS image can have malware that can reinfect a machine after recovery.

The safe recovery functionality allows you to prevent recurrence of infections by using the integrated

antimalware scanning

and malware deletion during the recovery process.

Limitations :

Safe recovery is supported only for physical or virtual Windows machines with Agent for Windows installed inside the machine.

The supported backup types are "Entire machine" or "Disks/volumes" backups.

Safe recovery is supported only for the volumes with NTFS file system. Non-NTFS partitions will be recovered without anti-malware scanning.

regular backup without the data in the CDP backup. To recover the CDP data, start a Files/folders recovery.

How it works

If you enable the Safe recovery option during the recovery process, then the system will perform the following:

205

1. Scan the image backup for malware and mark the infected files. One of the following statuses is assigned to a backup:

No malware – no malware was found in a backup during scanning.

Malware detected – malware was found in a backup during scanning.

Not scanned – backup was not scanned for malware.

1. Recover the backup to the selected machine.

2. Delete the detected malware.

You can filter backups by using the Status parameter.

206

12.14.3 Creating bootable media

Bootable media is a CD, DVD, USB flash drive, or other removable media that enables you to run the agent without the help of an operating system. The main purpose of bootable media is to recover an operating system that cannot start.

We highly recommend that you create and test a bootable media as soon as you start using disk-level backup. Also, it is a good practice to re-create the media after each major update of the protection agent.

You can recover either Windows or Linux by using the same media. To recover macOS, create a separate media on a machine running macOS.

To create bootable media in Windows or Linux

1. Download the bootable media ISO file. To download the file, select a machine, and then click

Recover > More ways to recover...

> Download ISO image .

2. [Optional] Copy and print, or write down the registration token displayed by the service console.

This token allows access to the cloud storage from bootable media without entering a login and password. It is necessary if you do not have a direct login to the cloud, but use third-party authentication instead.

3. Do any of the following:

Burn a CD/DVD using the ISO file.

Create a bootable USB flash drive by using the ISO file and one of the free tools available online.

Use ISO to USB or RUFUS if you need to boot an UEFI machine, Win32DiskImager for a BIOS machine. In Linux, using the dd utility makes sense.

Connect the ISO file as a CD/DVD drive to the virtual machine that you want to recover.

To create bootable media in macOS

1. On a machine where Agent for Mac is installed, click Applications > Rescue Media Builder .

2. The software displays the connected removable media. Select the one that you want to make bootable.

Warning!

All data on the disk will be erased.

3. Click Create .

4. Wait while the software creates the bootable media.

12.14.4 Startup Recovery Manager

Startup Recovery Manager is a bootable component residing on the system disk in Windows, or on the /boot partition in Linux and configured to start at boot time on pressing F11. It eliminates the need for a separate media or network connection to start the bootable rescue utility.

207

Startup Recovery Manager is especially useful for traveling users. If a failure occurs, reboot the machine, wait for the prompt "Press F11 for Acronis Startup Recovery Manager…" to appear, and then press F11. The program will start and you can perform recovery.

You can also back up using Startup Recovery Manager, while on the move.

On machines with the GRUB boot loader installed, you select the Startup Recovery Manager from the boot menu instead of pressing F11.

A machine booted with Startup Recovery Manager can be registered on the management server similarly to a machine booted from bootable media. To do this, click Tools > Register media on the management server , and then follow the step-by-step procedure described in "Registering media on the management server".

Activating

Startup Recovery Manager

On a machine running Agent for Windows or Agent for Linux, Startup Recovery Manager can be activated by using the service console.

To activate Startup Recovery Manager in the service console

1. Select the machine that you want to activate Startup Recovery Manager on.

2. Click Details .

3. Enable the Startup Recovery Manager switch.

4. Wait while the software activates Startup Recovery Manager.

To activate Startup Recovery Manager on a machine without an agent

1. Boot the machine from bootable media.

2. Click Tools > Activate Startup Recovery Manager .

3. Wait while the software activates Startup Recovery Manager.

What happens when you activate

Startup Recovery Manager

Activation enables the boot-time prompt "Press F11 for Acronis Startup Recovery Manager…" (if you do not have the GRUB boot loader) or adds the " Startup Recovery Manager" item to GRUB's menu

(if you have GRUB).

Note

The system disk (or, the /boot partition in Linux) should have at least 100 MB of free space to activate Startup Recovery Manager.

Unless you use the GRUB boot loader and it is installed in the Master Boot Record (MBR), Startup

Recovery Manager activation overwrites the MBR with its own boot code. Thus, you may need to reactivate third-party boot loaders if they are installed.

Under Linux, when using a boot loader other than GRUB (such as LILO), consider installing it to a

Linux root (or boot) partition boot record instead of the MBR before activating Startup Recovery

Manager. Otherwise, reconfigure the boot loader manually after the activation.

208

Deactivating

Startup Recovery Manager

Deactivation is performed similarly to activation.

Deactivation disables the boot time prompt "Press F11 for Acronis Startup Recovery Manager…" (or, the menu item in GRUB). If Startup Recovery Manager is not activated, you will need one of the following to recover the system when it fails to boot:

l boot the machine from a separate bootable media

l use network boot from a PXE server or Microsoft Remote Installation Services (RIS)

12.14.5 Recovering a machine

Physical machine

This section describes recovery of physical machines by using the web interface.

Use bootable media instead of the web interface if you need to recover:

l macOS

Any operating system to bare metal or to an offline machine

The structure of logical volumes (volumes created by Logical Volume Manager in Linux). The media enables you to recreate the logical volume structure automatically.

Recovery of an operating system requires a reboot. You can choose whether to restart the machine automatically or assign it the Interaction required status. The recovered operating system goes online automatically.

To recover a physical machine

1. Select the backed-up machine.

2. Click Recovery .

3. Select a recovery point. Note that recovery points are filtered by location.

If the machine is offline, the recovery points are not displayed. Do any of the following:

If the backup location is cloud or shared storage (i.e. other agents can access it), click Select machine , select a target machine that is online, and then select a recovery point.

Recover the machine as described in "Recovering disks by using bootable media"

4. Click Recover > Entire machine .

The software automatically maps the disks from the backup to the disks of the target machine.

To recover to another physical machine, click Target machine , and then select a target machine that is online.

209

5. If you are unsatisfied with the mapping result or if the disk mapping fails, click Volume mapping to re-map the disks manually.

The mapping section also enables you to choose individual disks or volumes for recovery. You can switch between recovering disks and volumes by using the Switch to... link in the top-right corner.

210

6. [Optional] Enable Safe recovery to scan the backup for malware. If malware is detected, it will be marked in the backup and deleted right after the recovery process is completed.

7. Click Start recovery .

8. Confirm that you want to overwrite the disks with their backed-up versions. Choose whether to restart the machine automatically.

The recovery progress is shown on the Activities tab.

Physical machine to virtual

This section describes recovery of a physical machine as a virtual machine by using the web interface.

This operation can be performed if at least one Agent for VMware or Agent for Hyper-V is installed and registered.

Note

You cannot recover MacOS virtual machines to Hyper-V hosts, because Hyper-V does not support

MacOS. You can recover MacOS virtual machines to a VMware host that is installed on Mac hardware.

For more information about P2V migration, refer to "Machine migration"

To recover a physical machine as a virtual machine

1. Select the backed-up machine.

2. Click Recovery .

3. Select a recovery point. Note that recovery points are filtered by location.

If the machine is offline, the recovery points are not displayed. Do any of the following:

If the backup location is cloud or shared storage (i.e. other agents can access it), click Select machine , select a machine that is online, and then select a recovery point.

Recover the machine as described in "Recovering disks by using bootable media"

4. Click Recover > Entire machine .

5. In Recover to , select Virtual machine .

6. Click Target machine .

a. Select the hypervisor ( VMware ESXi or Hyper-V ).

At least one Agent for VMware or Agent for Hyper-V must be installed.

b. Select whether to recover to a new or existing machine. The new machine option is preferable as it does not require the disk configuration of the target machine to exactly match the disk configuration in the backup.

c. Select the host and specify the new machine name, or select an existing target machine.

d. Click OK .

7. [Optional] When recovering to a new machine, you can also do the following:

Click Datastore for ESXi or Path for Hyper-V, and then select the datastore (storage) for the virtual machine.

211

Click Disk mapping to select the datastore (storage), interface, and provisioning mode for each virtual disk. The mapping section also enables you to choose individual disks for recovery.

Click VM settings to change the memory size, the number of processors, and the network connections of the virtual machine.

8. [Optional] Enable Safe recovery to scan the backup for malware. If malware is detected, it will be marked in the backup and deleted right after the recovery process is completed.

9. Click Start recovery .

10. When recovering to an existing virtual machine, confirm that you want to overwrite the disks.

The recovery progress is shown on the Activities tab.

Virtual machine

You can recover virtual machines from their backups.

Prerequisites

A virtual machine must be stopped during the recovery to this machine. By default, the software stops the machine without a prompt. When the recovery is completed, you have to start the machine manually. You can change the default behavior by using the VM power management recovery option (click Recovery options > VM power management ).

212

Procedure

1. Do one of the following:

Select a backed-up machine, click Recovery , and then select a recovery point.

If this is the case, continue to step 4 in "Physical machine"

2. Click Recover > Entire machine .

3. If you want to recover to a physical machine, select Physical machine in Recover to . Otherwise, skip this step.

Recovery to a physical machine is possible only if the disk configuration of the target machine exactly matches the disk configuration in the backup.

. Otherwise, we recommend that you

perform the V2P migration by using bootable media

4. [Optional] By default, the software automatically selects the original machine as the target machine. To recover to another virtual machine, click Target machine , and then do the following:

a. Select the hypervisor ( VMware ESXi , Hyper-V , Virtuozzo , or Virtuozzo Hybrid

Infrastructure ).

Only Virtuozzo virtual machines can be recovered to Virtuozzo. For more information about

V2V migration, refer to "Machine migration" .

b. Select whether to recover to a new or existing machine.

c. Select the host and specify the new machine name, or select an existing target machine.

d. Click OK .

5. Setup up the additional recovery options that you need.

[Not available for Virtuozzo Hybrid Infrastructure] To select the datastore for the virtual machine, click Datastore for ESXi or Path for Hyper-V and Virtuozzo, and then select the datastore (storage) for the virtual machine.

[Optional] To view the datastore (storage), interface, and the provisioning mode for each virtual disk, click Disk mapping . You can change these settings, unless you are recovering a Virtuozzo container or Virtuozzo Hybrid Infrastructure virtual machine.

For Virtuozzo Hybrid Infrastructure, you can only select the storage policy for the target disks.

To do so, select the desired target disk, and then click Change . In the blade that opens, click the gear icon, select the storage policy, and then click Done .

The mapping section also enables you to choose individual disks for recovery.

[Optional for VMware ESXi, Hyper-V, and Virtuozzo] Click VM settings to change the memory size and the number of processors (for Virtuozzo Hybrid Infrastructure: select Flavor ), or the network connections of the virtual machine.

Note

For Virtuozzo Hybrid Infrastructure, selecting flavor is a required step.

213

6. [Optional] Enable Safe recovery to scan the backup for malware. If malware is detected, it will be marked in the backup and deleted right after the recovery process is completed.

7. Click Start recovery .

8. When recovering to an existing virtual machine, confirm that you want to overwrite the disks.

The recovery progress is shown on the Activities tab.

Recovering disks by using bootable media

For information about how to create bootable media, refer to "Creating bootable media" .

To recover disks by using bootable media

1. Boot the target machine by using bootable media.

2. [Only when recovering a Mac] If you are recovering APFS-formatted disks/volumes to a nonoriginal machine or to bare metal, re-create the original disk configuration manually:

a. Click Disk Utility .

b. Erase and format the target disk into APFS. For instructions, refer to https://support.apple.com/en-us/HT208496#erasedisk .

c. Re-create the original disk configuration. For instructions, refer to https://support.apple.com/guide/disk-utility/add-erase-or-delete-apfs-volumes-

214

dskua9e6a110/19.0/mac/10.15

d. Click Disk Utility > Quit Disk Utility .

3. Click Manage this machine locally or click Rescue Bootable Media twice, depending on the media type you are using.

4. If a proxy server is enabled in your network, click Tools > Proxy server , and then specify the proxy server host name/IP address, port, and credentials. Otherwise, skip this step.

5. [Optional] When recovering Windows or Linux, click Tools > Register media in the Cyber

Protection service , and then specify the registration token that you obtained when downloading the media. If you do this, you will not need to enter credentials or a registration code to access the cloud storage, as described in step 8.

6. On the welcome screen, click Recover .

7. Click Select data , and then click Browse .

8. Specify the backup location:

To recover from cloud storage, select Cloud storage . Enter the credentials of the account to which the backed up machine is assigned.

When recovering Windows or Linux, you have the option to request a registration code and use it instead of the credentials. Click Use registration code > Request the code . The software shows the registration link and the registration code. You can copy them and perform the registration steps on a different machine. The registration code is valid for one hour.

To recover from a local or a network folder, browse to the folder under Local folders or

Network folders .

Click OK to confirm your selection.

9. Select the backup from which you want to recover the data. If prompted, type the password for the backup.

10. In Backup contents , select the disks that you want to recover. Click OK to confirm your selection.

11. Under Where to recover , the software automatically maps the selected disks to the target disks.

If the mapping is not successful or if you are unsatisfied with the mapping result, you can re-map disks manually.

Note

Changing disk layout may affect the operating system bootability. Please use the original machine's disk layout unless you feel fully confident of success.

12. [When recovering Linux] If the backed-up machine had logical volumes (LVM) and you want to reproduce the original LVM structure:

a. Ensure that the number of the target machine disks and each disk capacity are equal to or exceed those of the original machine, and then click Apply RAID/LVM .

b. Review the volume structure, and then click Apply RAID/LVM to create it.

13. [Optional] Click Recovery options to specify additional settings.

14. Click OK to start the recovery.

215

Using Universal Restore

The most recent operating systems remain bootable when recovered to dissimilar hardware, including the VMware or Hyper-V platforms. If a recovered operating system does not boot, use the

Universal Restore tool to update the drivers and modules that are critical for the operating system startup.

Universal Restore is applicable to Windows and Linux.

To apply Universal Restore

1. Boot the machine from the bootable media.

2. Click Apply Universal Restore .

3. If there are multiple operating systems on the machine, choose the one to apply Universal Restore to.

4. [For Windows only] Configure the additional settings .

5. Click OK .

Universal Restore in Windows

Preparation

12.14.6 Prepare drivers

Before applying Universal Restore to a Windows operating system, make sure that you have the drivers for the new HDD controller and the chipset. These drivers are critical to start the operating system. Use the CD or DVD supplied by the hardware vendor or download the drivers from the vendor’s website. The driver files should have the *.inf extension. If you download the drivers in the

*.exe, *.cab or *.zip format, extract them using a third-party application.

The best practice is to store drivers for all the hardware used in your organization in a single repository sorted by device type or by the hardware configurations. You can keep a copy of the repository on a DVD or a flash drive; pick some drivers and add them to the bootable media; create the custom bootable media with the necessary drivers (and the necessary network configuration) for each of your servers. Or, you can simply specify the path to the repository every time Universal

Restore is used.

12.14.7 Check access to the drivers in bootable environment

Make sure you have access to the device with drivers when working under bootable media. Use

WinPE-based media if the device is available in Windows but Linux-based media does not detect it.

216

Universal Restore settings

12.14.8 Automatic driver search

Specify where the program will search for the Hardware Abstraction Layer (HAL), HDD controller driver and network adapter driver(s):

If the drivers are on a vendor's disc or other removable media, turn on the Search removable media .

If the drivers are located in a networked folder or on the bootable media, specify the path to the folder by clicking Add folder .

In addition, Universal Restore will search the Windows default driver storage folder. Its location is determined in the registry value DevicePath , which can be found in the registry key HKEY_LOCAL_

MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion . This storage folder is usually

WINDOWS/inf.

Universal Restore will perform the recursive search in all the sub-folders of the specified folder, find the most suitable HAL and HDD controller drivers of all those available, and install them into the system. Universal Restore also searches for the network adapter driver; the path to the found driver is then transmitted by Universal Restore to the operating system. If the hardware has multiple network interface cards, Universal Restore will try to configure all the cards' drivers.

12.14.9 Mass storage drivers to install anyway

You need this setting if:

The hardware has a specific mass storage controller such as RAID (especially NVIDIA RAID) or a fibre channel adapter.

You migrated a system to a virtual machine that uses a SCSI hard drive controller. Use SCSI drivers bundled with your virtualization software or download the latest drivers versions from the software manufacturer website.

If the automatic drivers search does not help to boot the system.

Specify the appropriate drivers by clicking Add driver . The drivers defined here will be installed, with appropriate warnings, even if the program finds a better driver.

Universal Restore process

After you have specified the required settings, click OK .

If Universal Restore cannot find a compatible driver in the specified locations, it will display a prompt about the problem device. Do one of the following:

Add the driver to any of the previously specified locations and click Retry .

217

If you do not remember the location, click Ignore to continue the process. If the result is not satisfactory, reapply Universal Restore. When configuring the operation, specify the necessary driver.

Once Windows boots, it will initialize the standard procedure for installing new hardware. The network adapter driver will be installed silently if the driver has the Microsoft Windows signature.

Otherwise, Windows will ask for confirmation on whether to install the unsigned driver.

After that, you will be able to configure the network connection and specify drivers for the video adapter, USB and other devices.

Universal Restore in Linux

Universal Restore can be applied to Linux operating systems with a kernel version of 2.6.8 or later.

When Universal Restore is applied to a Linux operating system, it updates a temporary file system known as the initial RAM disk (initrd). This ensures that the operating system can boot on the new hardware.

Universal Restore adds modules for the new hardware (including device drivers) to the initial RAM disk. As a rule, it finds the necessary modules in the /lib/modules directory. If Universal Restore cannot find a module it needs, it records the module’s file name into the log.

Universal Restore may modify the configuration of the GRUB boot loader. This may be required, for example, to ensure the system bootability when the new machine has a different volume layout than the original machine.

Universal Restore never modifies the Linux kernel.

Reverting to the original initial RAM disk

You can revert to the original initial RAM disk if necessary.

The initial RAM disk is stored on the machine in a file. Before updating the initial RAM disk for the first time, Universal Restore saves a copy of it to the same directory. The name of the copy is the name of the file, followed by the _acronis_backup.img

suffix. This copy will not be overwritten if you run

Universal Restore more than once (for example, after you have added missing drivers).

To revert to the original initial RAM disk, do any of the following:

Rename the copy accordingly. For example, run a command similar to the following: mv initrd-2.6.16.60-0.21-default_acronis_backup.img initrd-2.6.16.60-0.21default

Specify the copy in the initrd line of the GRUB boot loader configuration.

218

12.14.10 Recovering files

Recovering files by using the web interface

1. Select the machine that originally contained the data that you want to recover.

2. Click Recovery .

3. Select the recovery point. Note that recovery points are filtered by location.

If the selected machine is physical and it is offline, recovery points are not displayed. Do any of the following:

[Recommended] If the backup location is cloud or shared storage (i.e. other agents can access it), click Select machine , select a target machine that is online, and then select a recovery point.

Download the files from the cloud storage .

Use bootable media

4. Click Recover > Files/folders .

5. Browse to the required folder or use search to obtain the list of the required files and folders.

You can use one or more wildcard characters (* and ?). For more details about using wildcards,

refer to "File filters" .

Note

Search is not available for disk-level backups that are stored in the cloud storage.

6. Select the files that you want to recover.

7. If you want to save the files as a .zip file, click Download , select the location to save the data to, and click Save . Otherwise, skip this step.

Downloading is not available if your selection contains folders or the total size of the selected files exceeds 100 MB.

8. Click Recover .

In Recover to , you see one of the following:

The machine that originally contained the files that you want to recover (if an agent is installed on this machine).

The machine where Agent for VMware, Agent for Hyper-V, or Agent for Virtuozzo is installed (if the files originate from an ESXi, Hyper-V, or Virtuozzo virtual machine).

This is the target machine for the recovery. You can select another machine, if necessary.

9. In Path , select the recovery destination. You can select one of the following:

The original location (when recovering to the original machine)

A local folder on the target machine

219

Note

Symbolic links are not supported.

A network folder that is accessible from the target machine.

10. Click Start recovery .

11. Select one of the file overwriting options:

Overwrite existing files

Overwrite an existing file if it is older

Do not overwrite existing files

The recovery progress is shown on the Activities tab.

Downloading files from the cloud storage

You can browse the cloud storage, view the contents of the backups, and download files that you need.

Limitations

Backups of system state, SQL databases, and Exchange databases cannot be browsed.

For a better downloading experience, download no more than 100 MB at a time. To quickly

retrieve larger amounts of data from the cloud, use the file recovery procedure .

To download files from the cloud storage

1. Select a machine that was backed up.

2. Click Recover > More ways to recover... > Download files .

3. Enter the credentials of the account to which the backed up machine is assigned.

4. [When browsing disk-level backups] Under Versions , click the backup from which you want to recover the files.

[When browsing file-level backups] You can select the backup date and time in the next step, under the gear icon located to the right of the selected file. By default, files are recovered from the latest backup.

5. Browse to the required folder or use search to obtain the list of the required files.

220

6. Select the check boxes for the items you need to recover, and then click Download .

If you select a single file, it will be downloaded as is. Otherwise, the selected data will be archived into a .zip file.

7. Select the location to save the data to, and then click Save .

Verifying file authenticity with Notary Service

If notarization was enabled during backup

, you can verify the authenticity of a backed-up file.

To verify the file authenticity

1. Select the file as described in steps 1-6 of the "Recovering files by using the web interface"

section,

or steps 1-5 of the " Downloading files from the cloud storage

" section.

2. Ensure that the selected file is marked with the following icon: notarized.

3. Do one of the following:

Click Verify .

. This means that the file is

The software checks the file authenticity and displays the result.

Click Get certificate .

A certificate that confirms the file notarization is opened in a web browser window. The window also contains instructions that allow you to verify the file authenticity manually.

Signing a file with ASign

Note

This functionality is available only in the Advanced edition of the Cyber Protection service.

ASign is a service that allows multiple people to sign a backed-up file electronically. This feature is available only for file-level backups stored in the cloud storage.

221

Only one file version can be signed at a time. If the file was backed up multiple times, you must choose the version to sign, and only this version will be signed.

For example, ASign can be used for electronic signing of the following files:

Rental or lease agreements

Sales contracts

Asset purchase agreements

Loan agreements

Permission slips

Financial documents

Insurance documents

Liability waivers

Healthcare documents

Research papers

Certificates of product authenticity

Nondisclosure agreements

Offer letters

Confidentiality agreements

Independent contractor agreements

To sign a file version

1. Select the file as described in steps 1-6 of the "Recovering files by using the web interface"

section,

or steps 1-5 of the " Downloading files from the cloud storage

" section.

2. Ensure that the correct date and time is selected on the left panel.

3. Click Sign this file version .

4. Specify the password for the cloud storage account under which the backup is stored. The login of the account is displayed in the prompt window.

The ASign service interface is opened in a web browser window.

5. Add other signees by specifying their email addresses. It is not possible to add or remove signees after sending invitations, so ensure that the list includes everyone whose signature is required.

6. Click Invite to sign to send invitations to the signees.

Each signee receives an email message with the signature request. When all the requested signees sign the file, it is notarized and signed through the notary service.

You will receive notifications when each signee signs the file and when the entire process is complete. You can access the ASign web page by clicking View details in any of the email messages that you receive.

7. Once the process is complete, go to the ASign web page and click Get document to download a

.pdf document that contains:

The Signature Certificate page with the collected signatures.

The Audit Trail page with history of activities: when the invitation was sent to the signees, when each signee signed the file, and so on.

222

Recovering files by using bootable media

For information about how to create bootable media, refer to "Creating bootable media" .

To recover files by using bootable media

1. Boot the target machine by using the bootable media.

2. Click Manage this machine locally or click Rescue Bootable Media twice, depending on the media type you are using.

3. If a proxy server is enabled in your network, click Tools > Proxy server , and then specify the proxy server host name/IP address, port, and credentials. Otherwise, skip this step.

4. [Optional] When recovering Windows or Linux, click Tools > Register media in the Cyber

5. On the welcome screen, click Recover .

6. Click Select data , and then click Browse .

7. Specify the backup location:

To recover from cloud storage, select Cloud storage . Enter the credentials of the account to which the backed up machine is assigned.

To recover from a local or a network folder, browse to the folder under Local folders or

Network folders .

Click OK to confirm your selection.

8. Select the backup from which you want to recover the data. If prompted, type the password for the backup.

9. In Backup contents , select Folders/files .

10. Select the data that you want to recover. Click OK to confirm your selection.

11. Under Where to recover , specify a folder. Optionally, you can prohibit overwriting of newer versions of files or exclude some files from recovery.

12. [Optional] Click Recovery options to specify additional settings.

13. Click OK to start the recovery.

Extracting files from local backups

You can browse the contents of backups and extract files that you need.

223

Requirements

This functionality is available only in Windows by using File Explorer.

A protection agent must be installed on the machine from which you browse a backup.

The backed-up file system must be one of the following: FAT16, FAT32, NTFS, ReFS, Ext2, Ext3,

Ext4, XFS, or HFS+.

The backup must be stored in a local folder or on a network share (SMB/CIFS).

To extract files from a backup

1. Browse to the backup location by using File Explorer.

2. Double-click the backup file. The file names are based on the following template:

3. If the backup is encrypted, enter the encryption password. Otherwise, skip this step.

File Explorer displays the recovery points.

4. Double-click the recovery point.

File Explorer displays the backed-up data.

5. Browse to the required folder.

6. Copy the required files to any folder on the file system.

12.14.11 Recovering system state

1. Select the machine for which you want to recover the system state.

2. Click Recovery .

3. Select a system state recovery point. Note that recovery points are filtered by location.

4. Click Recover system state .

5. Confirm that you want to overwrite the system state with its backed-up version.

The recovery progress is shown on the Activities tab.

12.14.12 Recovering ESXi configuration

To recover an ESXi configuration, you need Linux-based bootable media. For information about how

to create bootable media, refer to "Creating bootable media"

If you are recovering an ESXi configuration to a non-original host and the original ESXi host is still connected to the vCenter Server, disconnect and remove this host from the vCenter Server to avoid unexpected issues during the recovery. If you want to keep the original host along with the recovered one, you can add it again after the recovery is complete.

The virtual machines running on the host are not included in an ESXi configuration backup. They can be backed up and recovered separately.

To recover an ESXi configuration

1. Boot the target machine by using the bootable media.

2. Click Manage this machine locally .

224

3. On the welcome screen, click Recover .

4. Click Select data , and then click Browse .

5. Specify the backup location:

Browse to the folder under Local folders or Network folders .

Click OK to confirm your selection.

6. In Show , select ESXi configurations .

7. Select the backup from which you want to recover the data. If prompted, type the password for the backup.

8. Click OK .

9. In Disks to be used for new datastores , do the following:

Under Recover ESXi to , select the disk where the host configuration will be recovered. If you are recovering the configuration to the original host, the original disk is selected by default.

[Optional] Under Use for new datastore , select the disks where new datastores will be created. Be careful because all data on the selected disks will be lost. If you want to preserve the virtual machines in the existing datastores, do not select any disks.

10. If any disks for new datastores are selected, select the datastore creation method in How to create new datastores : Create one datastore per disk or Create one datastore on all selected HDDs .

11. [Optional] In Network mapping , change the result of automatic mapping of the virtual switches present in the backup to the physical network adapters.

12. [Optional] Click Recovery options to specify additional settings.

13. Click OK to start the recovery.

12.14.13 Recovery options

To modify the recovery options, click Recovery options when configuring recovery.

Availability of the recovery options

The set of available recovery options depends on:

The environment the agent that performs recovery operates in (Windows, Linux, macOS, or bootable media).

The type of data being recovered (disks, files, virtual machines, application data).

The following table summarizes the availability of the recovery options.

Disks

Window s

Linu x

Bootabl e media

Window s

Linu x

Files Virtual machine s

SQL and

Exchang e macO

Bootabl e media

ESXi,

Hyper-V, and

Virtuozz

Window s

225

Backup validation

Boot mode

Date and time for files

+ + Hyper-V only

Backup validation

This option defines whether to validate a backup to ensure that the backup is not corrupted, before data is recovered from it. This operation is performed by the protection agent.

The preset is: Disabled .

226

Validation calculates a checksum for every data block saved in the backup. The only exception is validation of file-level backups that are located in the cloud storage. These backups are validated by checking consistency of the meta information saved in the backup.

Note

Depending on the settings chosen by your service provider, validation might not be available when backing up to the cloud storage.

Boot mode

This option is effective when recovering a physical or a virtual machine from a disk-level backup that contains a Windows operating system.

This option enables you to select the boot mode (BIOS or UEFI) that Windows will use after the recovery. If the boot mode of the original machine is different from the selected boot mode, the software will:

Initialize the disk to which you are recovering the system volume, according to the selected boot mode (MBR for BIOS, GPT for UEFI).

Adjust the Windows operating system so that it can start using the selected boot mode.

The preset is: As on the target machine.

You can choose one of the following:

As on the target machine

The agent that is running on the target machine detects the boot mode currently used by Windows and makes the adjustments according to the detected boot mode.

This is the safest value that automatically results in bootable system unless the limitations listed below apply. Since the Boot mode option is absent under bootable media, the agent on media always behaves as if this value is chosen.

As on the backed-up machine

The agent that is running on the target machine reads the boot mode from the backup and makes the adjustments according to this boot mode. This helps you recover a system on a different machine, even if this machine uses another boot mode, and then replace the disk in the backed-up machine.

BIOS

The agent that is running on the target machine makes the adjustments to use BIOS.

UEFI

The agent that is running on the target machine makes the adjustments to use UEFI.

Once a setting is changed, the disk mapping procedure will be repeated. This will take some time.

227

Recommendations

If you need to transfer Windows between UEFI and BIOS:

Recover the entire disk where the system volume is located. If you recover only the system volume on top of an existing volume, the agent will not be able to initialize the target disk properly.

Remember that BIOS does not allow using more than 2 TB of disk space.

Limitations

Transferring between UEFI and BIOS is supported for:

64-bit Windows operating systems starting with Windows Vista SP1

64-bit Windows Server operating systems starting with Windows Server 2008 SP1

Transferring between UEFI and BIOS is not supported if the backup is stored on a tape device.

When transferring a system between UEFI and BIOS is not supported, the agent behaves as if the As on the backed-up machine setting is chosen. If the target machine supports both UEFI and BIOS, you need to manually enable the boot mode corresponding to the original machine. Otherwise, the system will not boot.

Date and time for files

This option is effective only when recovering files.

This option defines whether to recover the files' date and time from the backup or assign the files the current date and time.

If this option is enabled, the files will be assigned the current date and time.

The preset is: Enabled .

Error handling

These options enable you to specify how to handle errors that might occur during recovery.

Re-attempt, if an error occurs

The preset is: Enabled. Number of attempts: 30. Interval between attempts: 30 seconds.

When a recoverable error occurs, the program re-attempts to perform the unsuccessful operation.

Do not show messages and dialogs while processing (silent mode)

The preset is: Disabled .

228

With the silent mode enabled, the program will automatically handle situations requiring user interaction where possible. If an operation cannot continue without user interaction, it will fail.

Details of the operation, including errors, if any, can be found in the operation log.

Save system information if a recovery with reboot fails

This option is effective for a disk or volume recovery to a physical machine running Windows or

Linux.

The preset is: Disabled .

When this option is enabled, you can specify a folder on the local disk (including flash or HDD drives attached to the target machine) or on a network share where the log, system information, and crash dump files will be saved. This file will help the technical support personnel to identify the problem.

File exclusions

This option is effective only when recovering files.

The option defines which files and folders to skip during the recovery process and thus exclude from the list of recovered items.

Note

Exclusions override the selection of data items to recover. For example, if you select to recover file

MyFile.tmp and to exclude all .tmp files, file MyFile.tmp will not be recovered.

File-level security

This option is effective when recovering files from disk- and file-level backups of NTFS-formatted volumes.

This option defines whether to recover NTFS permissions for files along with the files.

The preset is: Enabled .

You can choose whether to recover the permissions or let the files inherit their NTFS permissions from the folder to which they are recovered.

Flashback

This option is effective when recovering disks and volumes on physical and virtual machines, except for Mac.

This option works only if the volume layout of the disk being recovered exactly matches that of the target disk.

If the option is enabled, only the differences between the data in the backup and the target disk data are recovered. This accelerates recovery of physical and virtual machines. The data is compared at the block level.

When recovering a physical machine, the preset is: Disabled .

229

When recovering a virtual machine, the preset is: Enabled .

Full path recovery

This option is effective only when recovering data from a file-level backup.

If this option is enabled, the full path to the file will be re-created in the target location.

The preset is: Disabled .

Mount points

This option is effective only in Windows for recovering data from a file-level backup.

Enable this option to recover files and folders that were stored on the mounted volumes and were

backed up with the enabled Mount points

option.

The preset is: Disabled .

This option is effective only when you select for recovery a folder that is higher in the folder hierarchy than the mount point. If you select for recovery folders within the mount point or the mount point itself, the selected items will be recovered regardless of the Mount points option value.

Note

Please be aware that if the volume is not mounted at the moment of recovery, the data will be recovered directly to the folder that has been the mount point at the time of backing up.

Performance

This option defines the priority of the recovery process in the operating system.

The available settings are: Low , Normal , High .

The preset is: Normal .

The priority of a process running in a system determines the amount of CPU and system resources allocated to that process. Decreasing the recovery priority will free more resources for other applications. Increasing the recovery priority might speed up the recovery process by requesting the operating system to allocate more resources to the application that will perform the recovery.

However, the resulting effect will depend on the overall CPU usage and other factors like disk I/O speed or network traffic.

Pre/Post commands

The option enables you to define the commands to be automatically executed before and after the data recovery.

Example of how you can use the pre/post commands:

Launch the Checkdisk command in order to find and fix logical file system errors, physical errors or bad sectors to be started before the recovery starts or after the recovery ends.

230

The program does not support interactive commands, i.e. commands that require user input (for example, "pause".)

A post-recovery command will not be executed if the recovery proceeds with reboot.

Pre-recovery command

To specify a command/batch file to be executed before the recovery process starts

1. Enable the Execute a command before the recovery switch.

2. In the Command...

field, type a command or browse to a batch file. The program does not support interactive commands, i.e. commands that require user input (for example, "pause".)

3. In the Working directory field, specify a path to a directory where the command/batch file will be executed.

4. In the Arguments field specify the command’s execution arguments, if required.

5. Depending on the result you want to obtain, select the appropriate options as described in the table below.

6. Click Done .

Check box

Fail the recovery if the command execution fails*

Do not recover until the command execution is complete

Selected

Selection

Cleared Selected

Selected Cleared

Result

Preset

Perform the recovery only after the command is successfully executed. Fail the recovery if the command execution failed.

Perform the recovery after the command is executed despite execution failure or success.

* A command is considered failed if its exit code is not equal to zero.

N/A

Cleared

Perform the recovery concurrently with the command execution and irrespective of the command execution result.

Post-recovery command

To specify a command/executable file to be executed after the recovery is completed

231

1. Enable the Execute a command after the recovery switch.

2. In the Command...

field, type a command or browse to a batch file.

3. In the Working directory field, specify a path to a directory where the command/batch file will be executed.

4. In the Arguments field, specify the command execution arguments, if required.

5. Select the Fail the recovery if the command execution fails check box if successful execution of the command is critical for you. The command is considered failed if its exit code is not equal to zero. If the command execution fails, the recovery status will be set to Error .

When the check box is not selected, the command execution result does not affect the recovery failure or success. You can track the command execution result by exploring the Activities tab.

6. Click Done .

Note

A post-recovery command will not be executed if the recovery proceeds with reboot.

SID changing

This option is effective when recovering Windows 8.1/Windows Server 2012 R2 or earlier.

This option is not effective when recovery to a virtual machine is performed by Agent for VMware or

Agent for Hyper-V.

The preset is: Disabled .

The software can generate a unique security identifier (Computer SID) for the recovered operating system. You only need this option to ensure operability of third-party software that depends on

Computer SID.

Microsoft does not officially support changing SID on a deployed or recovered system. So use this option at your own risk.

VM power management

These options are effective when recovery to a virtual machine is performed by Agent for VMware,

Agent for Hyper-V, or Agent for Virtuozzo.

Power off target virtual machines when starting recovery

The preset is: Enabled .

Recovery to an existing virtual machine is not possible if the machine is online, and so the machine is powered off automatically as soon as the recovery starts. Users will be disconnected from the machine and any unsaved data will be lost.

Clear the check box for this option if you prefer to power off virtual machines manually before the recovery.

232

Power on the target virtual machine when recovery is complete

The preset is: Disabled .

After a machine is recovered from a backup to another machine, there is a chance the existing machine's replica will appear on the network. To be on the safe side, power on the recovered virtual machine manually, after you take the necessary precautions.

Windows event log

This option is effective only in Windows operating systems.

This option defines whether the agents have to log events of the recovery operations in the

Application Event Log of Windows (to see this log, run eventvwr.exe or select Control Panel >

Administrative tools > Event Viewer ). You can filter the events to be logged.

The preset is: Disabled .

12.15 Operations with backups

12.15.1 The Backup storage tab

The Backup storage tab provides access to all backups, including backups of offline machines and machines that are no longer registered in the Cyber Protection service.

Backups that are stored in a shared location (such as an SMB or NFS share) are visible to all users that have the read permission for the location.

In the cloud storage, users have access only to their own backups. An administrator can view backups on behalf of any account that belongs to the given unit or company and its child groups. This account is indirectly chosen in Machine to browse from . The Backup storage tab shows backups of all machines ever registered under the same account as this machine is registered.

Backups created by the cloud Agent for Office 365 and backups of G Suite data are shown not in the

Cloud storage location, but in a separate section named Cloud applications backups .

Backup locations that are used in protection plans are automatically added to the Backup storage tab. To add a custom folder (for example, a detachable USB device) to the list of backup locations, click Browse and specify the folder path.

If you added or removed some backups by using a file manager, click the gear icon next to the location name, and then click Refresh .

A backup location (except for the cloud storage) disappears from the Backup storage tab if all machines that had ever backed up to the location were deleted from the Cyber Protection service.

This ensures that you do not have to pay for the backups stored in this location. As soon as a backup to this location occurs, the location is re-added along with all backups that are stored in it.

On the Backup storage tab, you can filter backups in the list by using the following criteria:

233

Only with forensic data

– only backups having forensic data will be shown.

Only pre-update backups created by Patch management

– only backups that were created during patch management run before patch installation

will be shown.

To select a recovery point by using the Backup storage tab

1. On the Backup storage tab, select the location where the backups are stored.

The software displays all backups that your account is allowed to view in the selected location. The backups are combined in groups. The group names are based on the following template:

2. Select a group from which you want to recover the data.

3. [Optional] Click Change next to Machine to browse from , and then select another machine.

Some backups can only be browsed by specific agents. For example, you must select a machine running Agent for SQL to browse the backups of Microsoft SQL Server databases.

Important

Please be aware that the Machine to browse from is a default destination for recovery from a physical machine backup. After you select a recovery point and click Recover , double check the

Target machine setting to ensure that you want to recover to this specific machine. To change the recovery destination, specify another machine in Machine to browse from .

4. Click Show backups .

5. Select the recovery point.

12.15.2 Mounting volumes from a backup

Mounting volumes from a disk-level backup lets you access the volumes as though they were physical disks. Volumes are mounted in the read-only mode.

Requirements

This functionality is available only in Windows by using File Explorer.

Agent for Windows must be installed on the machine that performs the mount operation.

The backed-up file system must be supported by the Windows version that the machine is running.

The backup must be stored in a local folder, on a network share (SMB/CIFS), or in the Secure Zone.

To mount a volume from a backup

1. Browse to the backup location by using File Explorer.

2. Double-click the backup file. The file names are based on the following template:

3. If the backup is encrypted, enter the encryption password. Otherwise, skip this step.

File Explorer displays the recovery points.

4. Double-click the recovery point.

234

File Explorer displays the backed-up volumes.

Note

Double-click a volume to browse its content. You can copy files and folders from the backup to any folder on the file system.

5. Right-click a volume to mount, and then click Mount in read-only mode .

6. If the backup is stored on a network share, provide access credentials. Otherwise, skip this step.

The software mounts the selected volume. The first unused letter is assigned to the volume.

To unmount a volume

1. Browse to Computer ( This PC in Windows 8.1 and later) by using File Explorer.

2. Right-click the mounted volume.

3. Click Unmount .

The software unmounts the selected volume.

12.15.3 Deleting backups

Warning!

When a backup is deleted, all of its data is permanently erased. Deleted data cannot be recovered.

To delete backups of a machine that is online and present in the service console

1. On the All devices tab, select a machine whose backups you want to delete.

2. Click Recovery .

3. Select the location to delete the backups from.

4. Do one of the following:

To delete a single backup, select the backup to delete, and then click the X sign.

To delete all backups in the selected location, click Delete all .

5. Confirm your decision.

To delete backups of any machine

1. On the Backup storage tab, select the location from which you want to delete the backups.

The software displays all backups that your account is allowed to view in the selected location. The backups are combined in groups. The group names are based on the following template:

2. Select a group.

3. Do one of the following:

To delete a single backup, click Show backups , select the backup to delete, and then click the X sign.

To delete the selected group, click Delete .

4. Confirm your decision.

To delete backups directly from the cloud storage

235

1. Log in to the cloud storage, as described in "Downloading files from the cloud storage" .

2. Click the name of the machine whose backups you want to delete.

The software displays one or more backup groups.

3. Click the gear icon corresponding to the backup group that you want to delete.

4. Click Remove .

5. Confirm the operation.

What to do if you deleted local backups by using a file manager

We recommend that you delete backups by using the service console, whenever possible. If you deleted local backups by using a file manager, do the following:

1. On the Backup storage tab, click the gear icon next to the location name.

2. Click Refresh .

This way you will inform the Cyber Protection service that the local storage usage is decreased.

12.16 Protecting Microsoft applications

12.16.1 Protecting Microsoft SQL Server and Microsoft Exchange

Server

There are two methods of protecting these applications:

Database backup

This is a file-level backup of the databases and the metadata associated with them. The databases can be recovered to a live application or as files.

Application-aware backup

This is a disk-level backup that also collects the applications' metadata. This metadata enables browsing and recovery of the application data without recovering the entire disk or volume. The disk or volume can also be recovered as a whole. This means that a single solution and a single protection plan can be used for both disaster recovery and data protection purposes.

For Microsoft Exchange Server, you can opt for Mailbox backup . This is a backup of individual mailboxes via the Exchange Web Services protocol. The mailboxes or mailbox items can be recovered to a live Exchange Server or to Microsoft Office 365. Mailbox backup is supported for Microsoft

Exchange Server 2010 Service Pack 1 (SP1) and later.

12.16.2 Protecting Microsoft SharePoint

A Microsoft SharePoint farm consists of front-end servers that run SharePoint services, database servers that run Microsoft SQL Server, and (optionally) application servers that offload some

SharePoint services from the front-end servers. Some front-end and application servers may be identical to each other.

To protect an entire SharePoint farm:

236

Back up all of the database servers with application-aware backup.

Back up all of the unique front-end servers and application servers with usual disk-level backup.

The backups of all servers should be done on the same schedule.

To protect only the content, you can back up the content databases separately.

12.16.3 Protecting a domain controller

A machine running Active Directory Domain Services can be protected by application-aware backup.

If a domain contains more than one domain controller, and you recover one of them, a nonauthoritative restore is performed and a USN rollback will not occur after the recovery.

12.16.4 Recovering applications

The following table summarizes the available application recovery methods.

From a database backup From an application-aware backup

Microsoft SQL Server

Microsoft Exchange

Server

Databases to a live Exchange

Granular recovery to a live

Exchange or to Office 365*

Databases to a live Exchange

Granular recovery to a live

Exchange or to Office 365*

Microsoft SharePoint database servers

Microsoft SharePoint front-end web servers

Active Directory Domain

Services

Granular recovery by using

SharePoint Explorer

Granular recovery by using

SharePoint Explorer

From a disk backup

For physical machines and machines with the agent installed inside, the Volume Shadow Copy

237

* Granular recovery is also available from a mailbox backup. Recovery of Exchange data items to

Office 365, and vice versa, is supported on the condition that Agent for Office 365 is installed locally.

12.16.5 Prerequisites

Before configuring the application backup, ensure that the requirements listed below are met.

To check the VSS writers state, use the vssadmin list writers command.

Common requirements

For Microsoft SQL Server, ensure that:

At least one Microsoft SQL Server instance is started.

The SQL writer for VSS is turned on.

For Microsoft Exchange Server, ensure that:

The Microsoft Exchange Information Store service is started.

Windows PowerShell is installed. For Exchange 2010 or later, the Windows PowerShell version must be at least 2.0.

Microsoft .NET Framework is installed.

For Exchange 2007, the Microsoft .NET Framework version must be at least 2.0.

For Exchange 2010 or later, the Microsoft .NET Framework version must be at least 3.5.

The Exchange writer for VSS is turned on.

On a domain controller, ensure that:

The Active Directory writer for VSS is turned on.

When creating a protection plan, ensure that:

Service (VSS)

backup option is enabled.

For virtual machines, the Volume Shadow Copy Service (VSS) for virtual machines

backup option is enabled.

Additional requirements for application-aware backups

When creating a protection plan, ensure that Entire machine is selected for backup. The Sector-bysector backup option must be disabled in a protection plan, otherwise it will be impossible to perform a recovery of application data from such backups. If the plan is executed in the Sector-bysector mode due to an automatic switch to this mode, then recovery of application data will also be impossible.

Requirements for ESXi virtual machines

If the application runs on a virtual machine that is backed up by Agent for VMware, ensure that:

238

The virtual machine being backed up meets the requirements for application-consistent backup and restore listed in the article "Windows Backup Implementations" in the VMware documentation: https://code.vmware.com/docs/1674/virtual-disk-programmingguide/doc/vddkBkupVadp.9.6.html

VMware Tools is installed and up-to-date on the machine.

User Account Control (UAC) is disabled on the machine. If you do not want to disable UAC, you must provide the credentials of a built-in domain administrator (DOMAIN\Administrator) when enabling application backup.

Requirements for Hyper-V virtual machines

If the application runs on a virtual machine that is backed up by Agent for Hyper-V, ensure that:

The guest operating system is Windows Server 2008 or later.

For Hyper-V 2008 R2: the guest operating system is Windows Server 2008/2008 R2/2012.

The virtual machine has no dynamic disks.

The network connection exists between the Hyper-V host and the guest operating system. This is required to execute remote WMI queries inside the virtual machine.

The virtual machine configuration matches the following criteria:

Hyper-V Integration Services is installed and up-to-date. The critical update is https://support.microsoft.com/en-us/help/3063109/hyper-v-integration-components-updatefor-windows-virtual-machines

In the virtual machine settings, the Management > Integration Services > Backup (volume checkpoint) option is enabled.

For Hyper-V 2012 and later: the virtual machine has no checkpoints.

For Hyper-V 2012 R2 and later: the virtual machine has a SCSI controller (check Settings >

Hardware ).

12.16.6 Database backup

Before backing up databases, ensure that the requirements listed in "Prerequisites" are met.

Select the databases as described below, and then specify other settings of the protection plan as appropriate .

Selecting SQL databases

A backup of an SQL database contains the database files (.mdf, .ndf), log files (.ldf), and other associated files. The files are backed with the help of the SQL Writer service. The service must be running at the time that the Volume Shadow Copy Service (VSS) requests a backup or recovery.

239

The SQL transaction logs are truncated after each successful backup. SQL log truncation can be

disabled in the protection plan options .

To select SQL databases

1. Click Devices > Microsoft SQL .

The software shows the tree of SQL Server Always On Availability Groups (AAG), machines running

Microsoft SQL Server, SQL Server instances, and databases.

2. Browse to the data that you want to back up.

Expand the tree nodes or double-click items in the list to the right of the tree.

3. Select the data that you want to back up. You can select AAGs, machines running SQL Server, SQL

Server instances, or individual databases.

If you select an AAG, all databases that are included into the selected AAG will be backed up. For

more information about backing up AAGs or individual AAG databases, refer to "Protecting

Always On Availability Groups (AAG)" .

If you select a machine running an SQL Server, all databases that are attached to all SQL Server instances running on the selected machine will be backed up.

If you select a SQL Server instance, all databases that are attached to the selected instance will be backed up.

If you select databases directly, only the selected databases will be backed up.

4. Click Protect . If prompted, provide credentials to access the SQL Server data. The account must be a member of the Backup Operators or Administrators group on the machine and a member of the sysadmin role on each of the instances that you are going to back up.

Selecting Exchange Server data

The following table summarizes the Microsoft Exchange Server data that you can select for backup and the minimal user rights required to back up the data.

Exchange version

2007

Data items

Storage groups

User rights

Membership in the Exchange Organization

Administrators role group

Membership in the Server Management role group.

2010/2013/2016/2019 Databases, Database

Availability Groups (DAG)

A full backup contains all of the selected Exchange Server data.

An incremental backup contains the changed blocks of the database files, the checkpoint files, and a small number of the log files that are more recent than the corresponding database checkpoint.

Because changes to the database files are included in the backup, there is no need to back up all the transaction log records since the previous backup. Only the log that is more recent than the checkpoint needs to be replayed after a recovery. This makes for faster recovery and ensures successful database backup, even with circular logging enabled.

The transaction log files are truncated after each successful backup.

240

To select Exchange Server data

1. Click Devices > Microsoft Exchange .

The software shows the tree of Exchange Server Database Availability Groups (DAG), machines running Microsoft Exchange Server, and Exchange Server databases. If you configured Agent for

Exchange as described in "Mailbox backup"

, mailboxes are also shown in this tree.

2. Browse to the data that you want to back up.

Expand the tree nodes or double-click items in the list to the right of the tree.

3. Select the data that you want to back up.

If you select a DAG, one copy of each clustered database will be backed up. For more information about backing up DAGs, refer to "Protecting Database Availability Groups (DAG)".

If you select a machine running Microsoft Exchange Server, all databases that are mounted to the Exchange Server running on the selected machine will be backed up.

If you select databases directly, only the selected databases will be backed up.

If you configured Agent for Exchange as described in "Mailbox backup"

, you can select mailboxes for backup.

4. If prompted, provide the credentials to access the data.

5. Click Protect .

Protecting Always On Availability Groups (AAG)

Note

This functionality is available only in the Advanced edition of the Cyber Protection service.

SQL Server high-availability solutions overview

The Windows Server Failover Clustering (WSFC) functionality enables you to configure a highly available SQL Server through redundancy at the instance level (Failover Cluster Instance, FCI) or at the database level (AlwaysOn Availability Group, AAG). You can also combine both methods.

In a Failover Cluster Instance, SQL databases are located on a shared storage. This storage can only be accessed from the active cluster node. If the active node fails, a failover occurs and a different node becomes active.

In an availability group, each database replica resides on a different node. If the primary replica becomes not available, a secondary replica residing on a different node is assigned the primary role.

Thus, the clusters are already serving as a disaster recovery solution themselves. However, there might be cases when the clusters cannot provide data protection: for example, in case of a database logical corruption, or when the entire cluster is down. Also cluster solutions do not protect from harmful content changes, as they usually immediately replicate to all cluster nodes.

Supported cluster configurations

This backup software supports only the Always On Availability Group (AAG) for SQL Server 2012 or later. Other cluster configurations, such as Failover Cluster Instances, database mirroring, and log

241

shipping are not supported.

How many agents are required for cluster data backup and recovery?

For successful data backup and recovery of a cluster Agent for SQL has to be installed on each node of the WSFC cluster.

Backing up databases included in an AAG

1. Install Agent for SQL on each node of the WSFC cluster.

Note

After you install the agent on one of the nodes, the software displays the AAG and its nodes under Devices > Microsoft SQL > Databases . To install Agents for SQL on the rest of the nodes, select the AAG, click Details , and then click Install agent next to each of the nodes.

2. Select the AAG to backup as described in "Selecting SQL databases".

You must select the AAG itself to backup all databases of the AAG. To backup a set of databases, define this set of databases in all nodes of the AAG.

Warning!

The database set must be exactly the same in all nodes. If even one set is different, or not defined on all nodes, the cluster backup will not work correctly.

3. Configure the "Cluster backup mode"

backup option.

Recovery of databases included in an AAG

1. Select the databases that you want to recover, and then select the recovery point from which you want to recover the databases.

When you select a clustered database under Devices > Microsoft SQL > Databases , and then click Recover , the software shows only the recovery points that correspond to the times when the selected copy of the database was backed up.

The easiest way to view all recovery points of a clustered database is to select the backup of the

entire AAG on the Backup storage tab . The names of AAG backups are based on the following

template: <AAG name> - <protection plan name> and have a special icon.

2. To configure recovery, follow the steps described in "Recovering SQL databases" , starting from

step 5.

The software automatically defines a cluster node to which the data will be recovered. The node's name is displayed in the Recover to field. You can manually change the target node.

Important

A database that is included in an Always On Availability Group cannot be overwritten during a recovery because Microsoft SQL Server prohibits this. You need to exclude the target database from the AAG before the recovery. Or, just recover the database as a new non-AAG one. When the recovery is completed, you can reconstruct the original AAG configuration.

242

Protecting Database Availability Groups (DAG)

Note

This functionality is available only in the Advanced edition of the Cyber Protection service.

Exchange Server clusters overview

The main idea of Exchange clusters is to provide high database availability with fast failover and no data loss. Usually, it is achieved by having one or more copies of databases or storage groups on the members of the cluster (cluster nodes). If the cluster node hosting the active database copy or the active database copy itself fails, the other node hosting the passive copy automatically takes over the operations of the failed node and provides access to Exchange services with minimal downtime. Thus, the clusters are already serving as a disaster recovery solution themselves.

However, there might be cases when failover cluster solutions cannot provide data protection: for example, in case of a database logical corruption, or when a particular database in a cluster has no copy (replica), or when the entire cluster is down. Also cluster solutions do not protect from harmful content changes, as they usually immediately replicate to all cluster nodes.

Cluster-aware backup

With cluster-aware backup, you back up only one copy of the clustered data. If the data changes its location within the cluster (due to a switchover or a failover), the software will track all relocations of this data and safely back it up.

Supported cluster configurations

Cluster-aware backup is supported only for Database Availability Group (DAG) in Exchange Server

2010 or later. Other cluster configurations, such as Single Copy Cluster (SCC) and Cluster Continuous

Replication (CCR) for Exchange 2007, are not supported.

DAG is a group of up to 16 Exchange Mailbox servers. Any node can host a copy of mailbox database from any other node. Each node can host passive and active database copies. Up to 16 copies of each database can be created.

243

How many agents are required for cluster-aware backup and recovery?

For successful backup and recovery of clustered databases, Agent for Exchange has to be installed on each node of the Exchange cluster.

Note

After you install the agent on one of the nodes, the service console displays the DAG and its nodes under Devices > Microsoft Exchange > Databases . To install Agents for Exchange on the rest of the nodes, select the DAG, click Details , and then click Install agent next to each of the nodes.

Backing up the Exchange cluster data

1. When creating a protection plan, select the DAG as described in "Selecting Exchange Server data"

2. Configure the "Cluster backup mode"

backup option.

3. Specify other settings of the protection plan as appropriate .

Important

For cluster-aware backup, ensure to select the DAG itself. If you select individual nodes or databases inside the DAG, only the selected items will be backed up and the Cluster backup mode option will be ignored.

Recovering the Exchange cluster data

1. Select the recovery point for the database that you want to recover. Selecting an entire cluster for recovery is not possible.

When you select a copy of a clustered database under Devices > Microsoft Exchange >

Databases > <cluster name> > <node name> and click Recover , the software shows only the recovery points that correspond to the times when this copy was backed up.

The easiest way to view all recovery points of a clustered database is to select its backup on the

Backup storage tab .

2. Follow the steps described in "Recovering Exchange databases", starting from step 5.

244

The software automatically defines a cluster node to which the data will be recovered. The node's name is displayed in the Recover to field. You can manually change the target node.

12.16.7 Application-aware backup

Application-aware disk-level backup is available for physical machines, ESXi virtual machines, and

Hyper-V virtual machines.

When you back up a machine running Microsoft SQL Server, Microsoft Exchange Server, or Active

Directory Domain Services, enable Application backup for additional protection of these applications' data.

Why use application-aware backup?

By using application-aware backup, you ensure that:

1. The applications are backed up in a consistent state and thus will be available immediately after the machine is recovered.

2. You can recover the SQL and Exchange databases, mailboxes, and mailbox items without recovering the entire machine.

3. The SQL transaction logs are truncated after each successful backup. SQL log truncation can be

disabled in the protection plan options

. The Exchange transaction logs are truncated on virtual

machines only. You can enable the VSS full backup option

if you want to truncate Exchange transaction logs on a physical machine.

4. If a domain contains more than one domain controller, and you recover one of them, a nonauthoritative restore is performed and a USN rollback will not occur after the recovery.

What do I need to use application-aware backup?

On a physical machine, Agent for SQL and/or Agent for Exchange must be installed, in addition to

Agent for Windows.

On a virtual machine, no agent installation is required; it is presumed that the machine is backed up by Agent for VMware (Windows) or Agent for Hyper-V.

Agent for VMware (Virtual Appliance) can create application-aware backups, but cannot recover application data from them. To recover application data from backups created by this agent, you need Agent for VMware (Windows), Agent for SQL, or Agent for Exchange on a machine that has access to the location where the backups are stored. When configuring recovery of application data, select the recovery point on the Backup storage tab, and then select this machine in Machine to browse from .

Other requirements are listed in the "Prerequisites"

and "Required user rights" sections.

245

Required user rights

An application-aware backup contains metadata of VSS-aware applications that are present on the disk. To access this metadata, the agent needs an account with the appropriate rights, which are listed below. You are prompted to specify this account when enabling application backup.

For SQL Server:

The account must be a member of the Backup Operators or Administrators group on the machine, and a member of the sysadmin role on each of the instances that you are going to back up.

For Exchange Server:

Exchange 2007: The account must be a member of the Administrators group on the machine, and a member of the Exchange Organization Administrators role group.

Exchange 2010 and later: The account must be a member of the Administrators group on the machine, and a member of the Organization Management role group.

For Active Directory:

The account must be a domain administrator.

Additional requirement for virtual machines

If the application runs on a virtual machine that is backed up by Agent for VMware or Agent for

Hyper-V, ensure that User Account Control (UAC) is disabled on the machine. If you do not want to disable UAC, you must provide the credentials of a built-in domain administrator

(DOMAIN\Administrator) when enabling application backup.

12.16.8 Mailbox backup

Mailbox backup is supported for Microsoft Exchange Server 2010 Service Pack 1 (SP1) and later.

Mailbox backup is available if at least one Agent for Exchange is registered on the management server. The agent must be installed on a machine that belongs to the same Active Directory forest as

Microsoft Exchange Server.

Before backing up mailboxes, you must connect Agent for Exchange to the machine running the

Client Access server role (CAS) of Microsoft Exchange Server. In Exchange 2016 and later, the CAS role is not available as a separate installation option. It is automatically installed as part of the

Mailbox server role. Thus, you can connect the agent to any server running the Mailbox role .

To connect Agent for Exchange to CAS

1. Click Devices > Add .

2. Click Microsoft Exchange Server .

3. Click Exchange mailboxes .

If no Agent for Exchange is registered on the management server, the software suggests that you install the agent. After the installation, repeat this procedure from step 1.

246

4. [Optional] If multiple Agents for Exchange are registered on the management server, click Agent , and then change the agent that will perform the backup.

5. In Client Access server , specify the fully qualified domain name (FQDN) of the machine where the Client Access role of Microsoft Exchange Server is enabled.

In Exchange 2016 and later, the Client Access services are automatically installed as part of the

Mailbox server role. Thus, you can specify any server running the Mailbox role . We refer to this server as CAS later in this section.

6. In Authentication type , select the authentication type that is used by the CAS. You can select

Kerberos (default) or Basic .

7. [Only for basic authentication] Select which protocol will be used. You can select HTTPS (default) or HTTP .

8. [Only for basic authentication with the HTTPS protocol] If the CAS uses an SSL certificate that was obtained from a certification authority, and you want the software to check the certificate when connecting to the CAS, select the Check SSL certificate check box. Otherwise, skip this step.

9. Provide the credentials of an account that will be used to access the CAS. The requirements for

this account are listed in "Required user rights"

10. Click Add .

As a result, the mailboxes appear under Devices > Microsoft Exchange > Mailboxes .

Selecting Exchange Server mailboxes

Select the mailboxes as described below, and then specify other settings of the protection plan as appropriate .

To select Exchange mailboxes

1. Click Devices > Microsoft Exchange .

The software shows the tree of Exchange databases and mailboxes.

2. Click Mailboxes , and then select the mailboxes that you want to back up.

3. Click Protect .

Required user rights

To access mailboxes, Agent for Exchange needs an account with the appropriate rights. You are prompted to specify this account when configuring various operations with mailboxes.

Membership of the account in the Organization Management role group enables access to any mailbox, including mailboxes that will be created in the future.

The minimum required user rights are as follows:

The account must be a member of the Server Management and Recipient Management role groups.

The account must have the ApplicationImpersonation management role enabled for all users or groups of users whose mailboxes the agent will access.

247

For information about configuring the ApplicationImpersonation management role, refer to the following Microsoft knowledge base article: https://msdn.microsoft.com/enus/library/office/dn722376.aspx

12.16.9 Recovering SQL databases

This section describes recovery from both database backups and application-aware backups.

You can recover SQL databases to a SQL Server instance, if Agent for SQL is installed on the machine running the instance. You will need to provide credentials for an account that is a member of the

Backup Operators or Administrators group on the machine and a member of the sysadmin role on the target instance.

Alternatively, you can recover the databases as files. This can be useful if you need to extract data for data mining, audit, or further processing by third-party tools. You can attach the SQL database files to

a SQL Server instance, as described in "Attaching SQL Server databases" .

If you use only Agent for VMware (Windows), recovering databases as files is the only available recovery method. Recovering databases by using Agent for VMware (Virtual Appliance) is not possible.

System databases are basically recovered in the same way as user databases. The peculiarities of

system database recovery are described in "Recovering system databases"

To recover SQL databases to a SQL Server instance

1. Do one of the following:

When recovering from an application-aware backup, under Devices , select the machine that originally contained the data that you want to recover.

When recovering from a database backup, click Devices > Microsoft SQL , and then select the databases that you want to recover.

2. Click Recovery .

3. Select a recovery point. Note that recovery points are filtered by location.

If the machine is offline, the recovery points are not displayed. Do one of the following:

[Only when recovering from an application-aware backup] If the backup location is cloud or shared storage (i.e. other agents can access it), click Select machine , select an online machine that has Agent for SQL, and then select a recovery point.

The machine chosen for browsing in either of the above actions becomes a target machine for the

SQL databases recovery.

4. Do one of the following:

When recovering from an application-aware backup, click Recover > SQL databases , select the databases that you want to recover, and then click Recover .

When recovering from a database backup, click Recover > Databases to an instance .

248

5. By default, the databases are recovered to the original ones. If the original database does not exist, it will be recreated. You can select another SQL Server instance (running on the same machine) to recover the databases to.

To recover a database as a different one to the same instance:

a. Click the database name.

b. In Recover to , select New database .

c. Specify the new database name.

d. Specify the new database path and log path. The folder you specify must not contain the original database and log files.

6. [Optional] [Not available for a database recovered to its original instance as a new database] To change the database state after recovery, click the database name, and then choose one of the following states:

Ready to use (RESTORE WITH RECOVERY) (default)

After the recovery completes, the database will be ready for use. Users will have full access to it.

The software will roll back all uncommitted transactions of the recovered database that are stored in the transaction logs. You will not be able to recover additional transaction logs from the native Microsoft SQL backups.

Non-operational (RESTORE WITH NORECOVERY)

After the recovery completes, the database will be non-operational. Users will have no access to it. The software will keep all uncommitted transactions of the recovered database. You will be able to recover additional transaction logs from the native Microsoft SQL backups and thus reach the necessary recovery point.

Read-only (RESTORE WITH STANDBY)

After the recovery completes, users will have read-only access to the database. The software will undo any uncommitted transactions. However, it will save the undo actions in a temporary standby file so that the recovery effects can be reverted.

This value is primarily used to detect the point in time when a SQL Server error occurred.

7. Click Start recovery .

The recovery progress is shown on the Activities tab.

To recover SQL databases as files

1. Do one of the following:

When recovering from an application-aware backup, under Devices , select the machine that originally contained the data that you want to recover.

When recovering from a database backup, click Devices > Microsoft SQL , and then select the databases that you want to recover.

2. Click Recovery .

3. Select a recovery point. Note that recovery points are filtered by location.

If the machine is offline, the recovery points are not displayed. Do one of the following:

[Only when recovering from an application-aware backup] If the backup location is cloud or shared storage (i.e. other agents can access it), click Select machine , select an online machine

249

that has Agent for SQL or Agent for VMware, and then select a recovery point.

recovery fails for some reason and you are looking for a workaround to mount the databases manually .

The machine chosen for browsing in either of the above actions becomes a target machine for the

SQL databases recovery.

4. Do one of the following:

When recovering from an application-aware backup, click Recover > SQL databases , select the databases that you want to recover, and then click Recover as files .

When recovering from a database backup, click Recover > Databases as files .

5. Click Browse , and then select a local or a network folder to save the files to.

6. Click Start recovery .

The recovery progress is shown on the Activities tab.

Recovering system databases

All system databases of an instance are recovered at once. When recovering system databases, the software automatically restarts the destination instance in the single-user mode. After the recovery completes, the software restarts the instance and recovers other databases (if any).

Other things to consider when recovering system databases:

System databases can only be recovered to an instance of the same version as the original instance.

System databases are always recovered in the "ready to use" state.

Recovering the master database

System databases include the master database. The master database records information about all databases of the instance. Hence, the master database in a backup contains information about databases which existed in the instance at the time of the backup. After recovering the master database, you may need to do the following:

Databases that have appeared in the instance after the backup was done are not visible by the instance. To bring these databases back to production, attach them to the instance manually by using SQL Server Management Studio.

Databases that have been deleted after the backup was done are displayed as offline in the instance. Delete these databases by using SQL Server Management Studio.

Attaching SQL Server databases

This section describes how to attach a database in SQL Server by using SQL Server Management

Studio. Only one database can be attached at a time.

Attaching a database requires any of the following permissions: CREATE DATABASE , CREATE ANY

DATABASE , or ALTER ANY DATABASE . Normally, these permissions are granted to the sysadmin role of the instance.

To attach a database

250

1. Run Microsoft SQL Server Management Studio.

2. Connect to the required SQL Server instance, and then expand the instance.

3. Right-click Databases and click Attach .

4. Click Add .

5. In the Locate Database Files dialog box, find and select the .mdf file of the database.

6. In the Database Details section, make sure that the rest of database files (.ndf and .ldf files) are found.

Details . SQL Server database files may not be found automatically, if:

They are not in the default location, or they are not in the same folder as the primary database file (.mdf). Solution: Specify the path to the required files manually in the Current File Path column.

You have recovered an incomplete set of files that make up the database. Solution: Recover the missing SQL Server database files from the backup.

7. When all of the files are found, click OK .

12.16.10 Recovering Exchange databases

This section describes recovery from both database backups and application-aware backups.

You can recover Exchange Server data to a live Exchange Server. This may be the original Exchange

Server or an Exchange Server of the same version running on the machine with the same fully qualified domain name (FQDN). Agent for Exchange must be installed on the target machine.

The following table summarizes the Exchange Server data that you can select for recovery and the minimal user rights required to recover the data.

Exchange version

2007

Data items

Storage groups

2010/2013/2016/2019 Databases

User rights

Membership in the Exchange Organization Administrators role group.

Membership in the Server Management role group.

Alternatively, you can recover the databases (storage groups) as files. The database files, along with transaction log files, will be extracted from the backup to a folder that you specify. This can be useful if you need to extract data for an audit or further processing by third-party tools, or when the

If you use only Agent for VMware (Windows), recovering databases as files is the only available recovery method. Recovering databases by using Agent for VMware (Virtual Appliance) is not possible.

We will refer to both databases and storage groups as "databases" throughout the below procedures.

To recover Exchange databases to a live Exchange Server

251

1. Do one of the following:

When recovering from an application-aware backup, under Devices , select the machine that originally contained the data that you want to recover.

When recovering from a database backup, click Devices > Microsoft Exchange > Databases , and then select the databases that you want to recover.

2. Click Recovery .

3. Select a recovery point. Note that recovery points are filtered by location.

If the machine is offline, the recovery points are not displayed. Do one of the following:

The machine chosen for browsing in either of the above actions becomes a target machine for the

Exchange data recovery.

4. Do one of the following:

When recovering from an application-aware backup, click Recover > Exchange databases , select the databases that you want to recover, and then click Recover .

When recovering from a database backup, click Recover > Databases to an Exchange server .

5. By default, the databases are recovered to the original ones. If the original database does not exist, it will be recreated.

To recover a database as a different one:

a. Click the database name.

b. In Recover to , select New database .

c. Specify the new database name.

d. Specify the new database path and log path. The folder you specify must not contain the original database and log files.

6. Click Start recovery .

The recovery progress is shown on the Activities tab.

To recover Exchange databases as files

1. Do one of the following:

When recovering from an application-aware backup, under Devices , select the machine that originally contained the data that you want to recover.

When recovering from a database backup, click Devices > Microsoft Exchange > Databases , and then select the databases that you want to recover.

2. Click Recovery .

3. Select a recovery point. Note that recovery points are filtered by location.

If the machine is offline, the recovery points are not displayed. Do one of the following:

252

For more information about recovery to Office 365, refer to "Protecting Office 365 mailboxes"

The machine chosen for browsing in either of the above actions becomes a target machine for the

Exchange data recovery.

4. Do one of the following:

When recovering from an application-aware backup, click Recover > Exchange databases , select the databases that you want to recover, and then click Recover as files .

When recovering from a database backup, click Recover > Databases as files .

5. Click Browse , and then select a local or a network folder to save the files to.

6. Click Start recovery .

The recovery progress is shown on the Activities tab.

Mounting Exchange Server databases

After recovering the database files, you can bring the databases online by mounting them. Mounting is performed by using Exchange Management Console, Exchange System Manager, or Exchange

Management Shell.

The recovered databases will be in a Dirty Shutdown state. A database that is in a Dirty Shutdown state can be mounted by the system if it is recovered to its original location (that is, information about the original database is present in Active Directory). When recovering a database to an alternate location (such as a new database or as the recovery database), the database cannot be mounted until you bring it to a Clean Shutdown state by using the Eseutil /r <Enn> command.

<Enn> specifies the log file prefix for the database (or storage group that contains the database) into which you need to apply the transaction log files.

The account you use to attach a database must be delegated an Exchange Server Administrator role and a local Administrators group for the target server.

For details about how to mount databases, see the following articles:

Exchange 2010 or later: http://technet.microsoft.com/en-us/library/aa998871.aspx

Exchange 2007: http://technet.microsoft.com/en-us/library/aa998871(v=EXCHG.80).aspx

12.16.11 Recovering Exchange mailboxes and mailbox items

This section describes how to recover Exchange mailboxes and mailbox items from database backups, from application-aware backups, and from mailbox backups. The mailboxes or mailbox items can be recovered to a live Exchange Server or to Microsoft Office 365.

The following items can be recovered:

Mailboxes (except for archive mailboxes)

Public folders

253

Public folder items

Email folders

Email messages

Calendar events

Tasks

Contacts

Journal entries

Notes

You can use search to locate the items.

Recovery to an Exchange Server

Granular recovery can be performed to Microsoft Exchange Server 2010 Service Pack 1 (SP1) and later. The source backup may contain databases or mailboxes of any supported Exchange version.

Granular recovery can be performed by Agent for Exchange or Agent for VMware (Windows). The target Exchange Server and the machine running the agent must belong to the same Active Directory forest.

When a mailbox is recovered to an existing mailbox, the existing items with matching IDs are overwritten.

Recovery of mailbox items does not overwrite anything. Instead, the full path to a mailbox item is recreated in the target folder.

Requirements on user accounts

A mailbox being recovered from a backup must have an associated user account in Active Directory.

User mailboxes and their contents can be recovered only if their associated user accounts are enabled . Shared, room, and equipment mailboxes can be recovered only if their associated user accounts are disabled .

A mailbox that does not meet the above conditions is skipped during recovery.

If some mailboxes are skipped, the recovery will succeed with warnings. If all mailboxes are skipped, the recovery will fail.

Recovery to Office 365

Recovery of Exchange data items to Office 365, and vice versa, is supported on the condition that

Agent for Office 365 is installed locally.

Recovery can be performed from backups of Microsoft Exchange Server 2010 and later.

When a mailbox is recovered to an existing Office 365 mailbox, the existing items are kept intact, and the recovered items are placed next to them.

254

When recovering a single mailbox, you need to select the target Office 365 mailbox. When recovering several mailboxes within one recovery operation, the software will try to recover each mailbox to the mailbox of the user with the same name. If the user is not found, the mailbox is skipped. If some mailboxes are skipped, the recovery will succeed with warnings. If all mailboxes are skipped, the recovery will fail.

Recovering mailboxes

To recover mailboxes from an application-aware backup or a database backup

1. [Only when recovering from a database backup to Office 365] If Agent for Office 365 is not installed on the machine running Exchange Server that was backed up, do one of the following:

If there is not Agent for Office 365 in your organization, install Agent for Office 365 on the machine that was backed up (or on another machine with the same Microsoft Exchange Server version).

If you already have Agent for Office 365 in your organization, copy libraries from the machine that was backed up (or from another machine with the same Microsoft Exchange Server

version) to the machine with Agent for Office 365, as described in "Copying Microsoft Exchange libraries" .

2. Do one of the following:

When recovering from an application-aware backup: under Devices , select the machine that originally contained the data that you want to recover.

When recovering from a database backup, click Devices > Microsoft Exchange > Databases , and then select the database that originally contained the data that you want to recover.

3. Click Recovery .

4. Select a recovery point. Note that recovery points are filtered by location.

If the machine is offline, the recovery points are not displayed. Use other ways to recover:

requirements for this account are listed in "Required user rights"

The machine chosen for browsing in either of the above actions will perform the recovery instead of the original machine that is offline.

5. Click Recover > Exchange mailboxes .

6. Select the mailboxes that you want to recover.

You can search mailboxes by name. Wildcards are not supported.

255

7. Click Recover .

8. [Only when recovering to Office 365]:

a. In Recover to , select Microsoft Office 365 .

b. [If you selected only one mailbox in step 6] In Target mailbox , specify the target mailbox.

c. Click Start recovery .

Further steps of this procedure are not required.

Click Target machine with Microsoft Exchange Server to select or change the target machine. This step allows recovery to a machine that is not running Agent for Exchange.

Specify the fully qualified domain name (FQDN) of a machine where the Client Access role (in

Microsoft Exchange Server 2010/2013) or Mailbox role (in Microsoft Exchange Server 2016 or later) is enabled. The machine must belong to the same Active Directory forest as the machine

9. that performs the recovery.

If prompted, provide the credentials of an account that will be used to access the machine. The

10. [Optional] Click Database to re-create any missing mailboxes to change the automatically selected database.

11. Click Start recovery .

The recovery progress is shown on the Activities tab.

To recover a mailbox from a mailbox backup

1. Click Devices > Microsoft Exchange > Mailboxes .

2. Select the mailbox to recover, and then click Recovery .

You can search mailboxes by name. Wildcards are not supported.

If the mailbox was deleted, select it on the Backup storage tab , and then click

Show backups .

3. Select a recovery point. Note that recovery points are filtered by location.

4. Click Recover > Mailbox .

5. Perform steps 8-11 of the above procedure.

Recovering mailbox items

To recover mailbox items from an application-aware backup or a database backup

1. [Only when recovering from a database backup to Office 365] If Agent for Office 365 is not installed on the machine running Exchange Server that was backed up, do one of the following:

256

If there is not Agent for Office 365 in your organization, install Agent for Office 365 on the machine that was backed up (or on another machine with the same Microsoft Exchange Server version).

If you already have Agent for Office 365 in your organization, copy libraries from the machine that was backed up (or from another machine with the same Microsoft Exchange Server

version) to the machine with Agent for Office 365, as described in "Copying Microsoft Exchange libraries" .

2. Do one of the following:

When recovering from an application-aware backup: under Devices , select the machine that originally contained the data that you want to recover.

When recovering from a database backup, click Devices > Microsoft Exchange > Databases , and then select the database that originally contained the data that you want to recover.

3. Click Recovery .

4. Select a recovery point. Note that recovery points are filtered by location.

If the machine is offline, the recovery points are not displayed. Use other ways to recover:

requirements for this account are listed in "Required user rights"

The machine chosen for browsing in either of the above actions will perform the recovery instead of the original machine that is offline.

5. Click Recover > Exchange mailboxes .

6. Click the mailbox that originally contained the items that you want to recover.

7. Select the items that you want to recover.

The following search options are available. Wildcards are not supported.

For email messages: search by subject, sender, recipient, and date.

For events: search by title and date.

For tasks: search by subject and date.

For contacts: search by name, email address, and phone number.

When an email message is selected, you can click Show content to view its contents, including attachments.

Note

Click the name of an attached file to download it.

To be able to select folders, click the recover folders icon.

257

8. Click Recover .

9. To recover to Office 365, select Microsoft Office 365 in Recover to .

To recover to an Exchange Server, keep the default Microsoft Exchange value in Recover to .

[Only when recovering to an Exchange Server] Click Target machine with Microsoft Exchange

Server to select or change the target machine. This step allows recovery to a machine that is not running Agent for Exchange.

Specify the fully qualified domain name (FQDN) of a machine where the Client Access role (in

Microsoft Exchange Server 2010/2013) or Mailbox role (in Microsoft Exchange Server 2016 or later) is enabled. The machine must belong to the same Active Directory forest as the machine that performs the recovery.

10. If prompted, provide the credentials of an account that will be used to access the machine. The

11. In Target mailbox , view, change, or specify the target mailbox.

By default, the original mailbox is selected. If this mailbox does not exist or a non-original target machine is selected, you must specify the target mailbox.

12. [Only when recovering email messages] In Target folder , view or change the target folder in the target mailbox. By default, the Recovered items folder is selected. Due to Microsoft Exchange limitations, events, tasks, notes, and contacts are restored to their original location regardless of any different Target folder specified.

13. Click Start recovery .

The recovery progress is shown on the Activities tab.

To recover a mailbox item from a mailbox backup

1. Click Devices > Microsoft Exchange > Mailboxes .

2. Select the mailbox that originally contained the items that you want to recover, and then click

Recovery .

You can search mailboxes by name. Wildcards are not supported.

If the mailbox was deleted, select it on the Backup storage tab , and then click

Show backups .

3. Select a recovery point. Note that recovery points are filtered by location.

4. Click Recover > Email messages .

5. Select the items that you want to recover.

The following search options are available. Wildcards are not supported.

258

For email messages: search by subject, sender, recipient, and date.

For events: search by title and date.

For tasks: search by subject and date.

For contacts: search by name, email address, and phone number.

When an email message is selected, you can click Show content to view its contents, including attachments.

Note

Click the name of an attached file to download it.

When an email message is selected, you can click Send as email to send the message to an email address. The message is sent from your administrator account's email address.

To be able to select folders, click the recover folders icon:

6. Click Recover .

7. Perform steps 9-13 of the above procedure.

Copying Microsoft Exchange Server libraries

When recovering Exchange mailboxes or mailbox items to Office 365

, you may need to copy the following libraries from the machine that was backed up (or from another machine with the same

Microsoft Exchange Server version) to the machine with Agent for Office 365.

Copy the following files, according to the Microsoft Exchange Server version that was backed up.

Microsoft Exchange Server version

Microsoft Exchange Server 2010

Libraries ese.dll

esebcli2.dll

store.exe

Microsoft Exchange Server 2013 ese.dll

Microsoft Exchange Server 2016,

2019

%ProgramFiles%\Microsoft\Exchange

Server\V14\bin

Default location

%ProgramFiles%\Microsoft\Exchange

Server\V15\bin msvcr110.dll

%WINDIR%\system32 ese.dll

%ProgramFiles%\Microsoft\Exchange

Server\V15\bin msvcr110.dll

%WINDIR%\system32 msvcp110.dll

The libraries should be placed in the folder %ProgramData%\Acronis\ese . If this folder does not exist, create it manually.

259

12.16.12 Changing the SQL Server or Exchange Server access credentials

You can change access credentials for SQL Server or Exchange Server without re-installing the agent.

To change the SQL Server or Exchange Server access credentials

1. Click Devices , and then click Microsoft SQL or Microsoft Exchange .

2. Select the Always On Availability Group, Database Availability Group, SQL Server instance, or

Exchange Server for which you want to change the access credentials.

3. Click Specify credentials .

4. Specify the new access credentials, and then click OK .

To change the Exchange Server access credentials for mailbox backup

1. Click Devices > Microsoft Exchange , and then expand Mailboxes .

2. Select the Exchange Server for which you want to change the access credentials.

3. Click Settings .

4. Under Exchange administrator account , specify the new access credentials, and then click

Save .

12.17 Protecting mobile devices

The Cyber Protect app allows you to back up your mobile data to the Cloud storage and then recover it in case of loss or corruption. Note that backup to the cloud storage requires an account and the

Cloud subscription.

12.17.1 Supported mobile devices

You can install the Cyber Protect app on a mobile device that runs one of the following operating systems:

l iOS 10.3 and later (iPhone, iPod, and iPads)

Android 6.0 and later

12.17.2 What you can back up

Contacts

Photos

Videos

Calendars

Reminders (only on iOS devices)

260

12.17.3 What you need to know

You can back up the data only to the cloud storage.

Any time you open the app, you will see the summary of data changes and can start a backup manually.

The Continuous backup functionality is enabled by default. If this setting is turned on:

For Android 7.0 or higher, the Cyber Protect app automatically detects new data on-the-fly and uploads it to the Cloud,

For Android 6, it checks for changes every three hours. You can turn off continuous backup in the app settings.

The Use Wi-Fi only option is enabled by default in the app settings. If this setting is turned on, the

Cyber Protect app will back up your data only when a Wi-Fi connection is available. If the Wi-Fi connection is lost, a backup process does not start. For the app to use cellular connection as well, turn this option off.

The battery optimization on your device might prevent the Cyber Protect app from proper operation. To run backups on time, you should stop the battery optimization for the app.

You have two ways to save energy:

The Back up while charging functionality which is disabled by default. If this setting is turned on, the Cyber Protect app will back up your data only when your device is connected to a power source. When the device is disconnected from a power source during a continuous backup process, the backup is paused.

The Save power mode which is enabled by default. If this setting is turned on, the Cyber

Protect app will back up your data only when your device battery is not low. When the device battery gets low, the continuous backup is paused. This option is available for Android 8 or higher.

You can access the backed-up data from any mobile device registered under your account. This helps you transfer the data from an old mobile device to a new one. Contacts and photos from an

Android device can be recovered to an iOS device and vice versa. You can also download a photo, video, or contact to any device by using the service console.

The data backed up from mobile devices registered under your account is available only under this account. Nobody else can view or recover your data.

In the Cyber Portect app, you can recover only the latest data versions. If you need to recover from a specific backup version, use the service console on either a tablet or a computer.

Retention rules are not applied to backups of mobile devices.

[Only for Android devices] If an SD card is present during a backup, the data stored on this card is also backed up. The data will be recovered to an SD card, to the folder Recovered by Backup if it is present during recovery, or the app will ask for a different location to recover the data to.

12.17.4 Where to get the Cyber Protect app

Depending on your mobile device, install the app from the App Store or Google Play.

261

12.17.5 How to start backing up your data

1. Open the app.

2. Sign in with your account.

3. Tap Set up to create your backup. Note that this button occurs only when you have no backup of your mobile device.

4. Select the data categories that you want to back up. By default, all categories are selected.

5. [optional step] Enable Encrypt Backup to protect your backup by encryption. In this case, you will need to also:

a. Enter an encryption password twice.

Note

Make sure you remember the password, because a forgotten password can never be restored or changed.

b. Tap Encrypt .

6. Tap Back up .

7. Allow the app access to your personal data. If you deny access to some data categories, they will not be backed up.

The backup starts.

12.17.6 How to recover data to a mobile device

1. Open the Cyber Protect app.

2. Tap Browse .

3. Tap the device name.

4. Do one of the following:

To recover all of the backed-up data, tap Recover all . No more actions are required.

To recover one or more data categories, tap Select , and then tap the check boxes for the required data categories. Tap Recover . No more actions are required.

To recover one or more data items belonging to the same data category, tap the data category.

Proceed to further steps.

5. Do one of the following:

To recover a single data item, tap it.

To recover several data items, tap Select , and then tap the check boxes for the required data items.

6. Tap Recover .

12.17.7 How to review data via the service console

1. On a computer, open a browser and type the service console URL.

2. Sign in with your account.

262

3. In All devices , click Recover under your mobile device name.

4. Do any of the following:

To download all photos, videos, contacts, calendars, or reminders, select the respective data category. Click Download .

To download individual photos, videos, contacts, calendars, or reminders, click the respective data category name, and then select the check boxes for the required data items. Click

Download .

263

To preview a photo, or a contact, click the respective data category name, and then click the required data item.

12.18 Protecting Hosted Exchange data

12.18.1 What items can be backed up?

You can back up user mailboxes, shared mailboxes, and group mailboxes. Optionally, you can choose to back up the archive mailboxes ( In-Place Archive ) of the selected mailboxes.

12.18.2 What items can be recovered?

The following items can be recovered from a mailbox backup:

Mailboxes

Email folders

Email messages

Calendar events

Tasks

Contacts

Journal entries

Notes

You can use search to locate the items.

When recovering mailboxes, mailbox items, public folders, and public folder items, you can select whether to overwrite the items in the target location.

When a mailbox is recovered to an existing mailbox, the existing items with matching IDs are overwritten.

Recovery of mailbox items does not overwrite anything. Instead, the full path to a mailbox item is recreated in the target folder.

12.18.3 Selecting mailboxes

Select the mailboxes as described below, and then specify other settings of the protection plan as appropriate .

To select Exchange Online mailboxes

1. Click Devices > Hosted Exchange .

2. If multiple Hosted Exchange organizations were added to the Cyber Protection service, select the organization whose users' data you want to back up. Otherwise, skip this step.

3. Do one of the following:

To back up the mailboxes of all users and all shared mailboxes (including mailboxes that will be created in the future), expand the Users node, select All users , and then click Group backup .

To back up individual user or shared mailboxes, expand the Users node, select All users , select the users whose mailboxes you want to back up, and then click Backup .

264

To back up all group mailboxes (including mailboxes of groups that will be created in the future), expand the Groups node, select All groups , and then click Group backup .

To back up individual group mailboxes, expand the Groups node, select All groups , select the groups whose mailboxes you want to back up, and then click Backup .

12.18.4 Recovering mailboxes and mailbox items

Recovering mailboxes

1. Click Devices > Hosted Exchange .

2. If multiple Hosted Exchange organizations were added to the Cyber Protection service, select the organization whose backed-up data you want to recover. Otherwise, skip this step.

3. Do one of the following:

To recover a user mailbox, expand the Users node, select All users , select the user whose mailbox you want to recover, and then click Recovery .

To recover a shared mailbox, expand the Users node, select All users , select the shared mailbox that you want to recover, and then click Recovery .

To recover a group mailbox, expand the Groups node, select All groups , select the group whose mailbox you want to recover, and then click Recovery .

If the user, group, or the shared mailbox was deleted, select the item in the Cloud applications backups

Show backups .

You can search users and groups by name. Wildcards are not supported.

4. Select a recovery point.

5. Click Recover > Entire mailbox .

6. If multiple Hosted Exchange organizations are added to the Cyber Protection service, click Hosted

Exchange organization to view, change, or specify the target organization.

By default, the original organization is selected. If this organization is no longer registered in the

Cyber Protection service, you must specify the target organization.

7. In Recover to mailbox , view, change, or specify the target mailbox.

By default, the original mailbox is selected. If this mailbox does not exist or a non-original organization is selected, you must specify the target mailbox.

8. Click Start recovery .

9. Select one of the overwriting options:

Overwrite existing items

Do not overwrite existing items

10. Click Proceed to confirm your decision.

Recovering mailbox items

1. Click Devices > Hosted Exchange .

2. If multiple Hosted Exchange organizations were added to the Cyber Protection service, select the organization whose backed-up data you want to recover. Otherwise, skip this step.

265

3. Do one of the following:

To recover items from a user mailbox, expand the Users node, select All users , select the user whose mailbox originally contained the items that you want to recover, and then click

Recovery .

To recover items from a shared mailbox, expand the Users node, select All users , select the shared mailbox that originally contained the items that you want to recover, and then click

Recovery .

To recover items from a group mailbox, expand the Groups node, select All groups , select the group whose mailbox originally contained the items that you want to recover, and then click

Recovery .

If the user, group, or the shared mailbox was deleted, select the item in the Cloud applications backups

10 manual runs during an hour

Show backups .

You can search users and groups by name. Wildcards are not supported.

4. Select a recovery point.

5. Click Recover > Email messages .

6. Browse to the required folder or use search to obtain the list of the required items.

The following search options are available. Wildcards are not supported.

For email messages: search by subject, sender, recipient, attachment name, and date.

For events: search by title and date.

For tasks: search by subject and date.

For contacts: search by name, email address, and phone number.

7. Select the items that you want to recover. To be able to select folders, click the "recover folders" icon:

Additionally, you can do any of the following:

When an item is selected, click Show content to view its contents, including attachments.

Click the name of an attached file to download it.

When an email message or a calendar item is selected, click Send as email to send the item to the specified email addresses. You can select the sender and write a text to be added to the forwarded item.

Only if the backup is not encrypted, you used search, and selected a single item in the search results: click Show versions to select the item version to recover. You can select any backedup version, earlier or later than the selected recovery point.

8. Click Recover .

9. If multiple Hosted Exchange organizations were added to the Cyber Protection service, click

Hosted Exchange organization to view, change, or specify the target organization.

By default, the original organization is selected. If this organization is no longer registered in the

Cyber Protection service, you must specify the target organization.

10. In Recover to mailbox , view, change, or specify the target mailbox.

By default, the original mailbox is selected. If this mailbox does not exist or a non-original organization is selected, you must specify the target mailbox.

266

11. [Only when recovering to a user or a shared mailbox] In Path , view or change the target folder in the target mailbox. By default, the Recovered items folder is selected.

Group mailbox items are always recovered to the Inbox folder.

12. Click Start recovery .

13. Select one of the overwriting options:

Overwrite existing items

Do not overwrite existing items

14. Click Proceed to confirm your decision.

12.19 Protecting Office 365 data

12.19.1 Why back up Office 365 data?

Even though Microsoft Office 365 is a set of cloud services, regular backups provide an additional layer of protection from user errors and intentional malicious actions. You can recover deleted items from a backup even after the Office 365 retention period has expired. Also, you can keep a local copy of the Exchange Online mailboxes if it is required for regulatory compliance.

12.19.2 Agent for Office 365

Depending on the desired functionality, you can choose to install Agent for Office 365 locally, use the agent installed in the cloud, or both. The following table summarizes the functionality of the local and the cloud agent.

Local Agent for Office 365 Cloud Agent for Office 365

Data items that can be backed up

Exchange Online: user and shared mailboxes

Exchange Online : user, shared, and group mailboxes; public folders

OneDrive : user files and folders

SharePoint Online : classic site collections, group (team) sites, communication sites, individual data items

Office 365 Teams : entire teams, team channels, channel files, team mailboxes, files and email messages in team mailboxes, meetings, team sites

No Yes Backup of archive mailboxes ( In-Place

Archive )

Backup schedule

Backup locations

User-defined

Cloud storage, local folder, network

Cannot be changed. Each protection plan runs daily at the same time of day.*

Cloud storage only

267

folder

No Automatic protection of new Office 365 users, groups, sites, and teams

Protecting more than one Office 365 organization

Granular recovery

Recovery to another user within one organization

Yes

Recovery to another organization

Recovery to an onpremises Microsoft

Exchange Server

Maximum number of items that can be backed up without performance degradation

Maximum number of manual backup runs

Maximum number of simultaneous recovery operations

When backing up to the cloud storage: 5000 mailboxes per company

When backing up to other destinations: 2000 mailboxes per protection plan (no limitation for number of mailboxes per company)

Yes, by applying a protection plan to the

All users , All groups teams

Yes

, All sites

groups

, All

10 000 protected items (mailboxes,

OneDrives, or sites) per company**

10 operations, including GSuite recovery operations

* Because a cloud agent serves multiple customers, it determines the start time for each protection plan on its own, to ensure even load during a day and the equal quality of service for all customers.

Note

The protection schedule might be affected by the operation of third-party services, for example, the accessibility of Microsoft Office 365 servers, throttling settings on the Microsoft servers, and others.

See also https://docs.microsoft.com/en-us/graph/throttling .

** It is recommended that you back up your protected items gradually and in this order:

268

1. Mailboxes.

2. After all mailboxes are backed up, proceed with OneDrives.

3. After OneDrive backup is completed, proceed with the SharePoint Online sites.

The first full backup may take several days, depending on the number of protected items and their size.

12.19.3 Limitations

A mailbox backup includes only folders visible to users. The Recoverable items folder and its subfolders ( Deletions , Versions , Purges , Audits , DiscoveryHold , Calendar Logging ) are not included in a mailbox backup.

Automatic creation of users, public folders, groups, or sites during a recovery is not possible. For example, if you want to recover a deleted SharePoint Online site, first create a new site manually, and then specify it as the target site during a recovery.

12.19.4 Required user rights

In the

Cyber Protection

service

Any Agent for Office 365, either local or cloud, must be registered under a company administrator account and used on a customer tenant level. Company administrators acting on a unit level, unit administrators, and users cannot back up or recover Office 365 data.

In Microsoft Office 365

Your account must be assigned the global administrator role in Microsoft Office 365.

To back up and recover Office 365 public folders, at least one of your Office 365 administrator accounts must have a mailbox and read/write rights to the public folders that you want to back up.

The local agent will log in to Office 365 by using this account. To enable the agent to access the contents of all mailboxes, this account will be assigned the ApplicationImpersonation management role. If you change this account password, update the password in the service

console, as described in "Changing the Office 365 access credentials" .

The cloud agent does not log in to Office 365. The agent is given the necessary permissions directly by Microsoft Office 365. You only need to confirm granting these permissions once, being signed in as a global administrator. The agent does not store your account credentials and does not use them to perform backup and recovery. Changing this account password or disabling this account or deleting this account in Office 365 does not affect agent operation.

12.19.5 Using the locally installed Agent for Office 365

Adding a Microsoft Office 365 organization

To add a Microsoft Office 365 organization

269

1. Sign in to the service console as a company administrator.

2. Click the account icon in the top-right corner, and then click Downloads > Agent for Office 365 .

3. Download the agent and install it on a Windows machine that is connected to the Internet.

4. After the installation is complete, click Devices > Microsoft Office 365 , and then enter the

Office 365 global administrator credentials.

Important

There must be only one locally installed Agent for Office 365 in an organization (company group).

As a result, your organization data items appear in the service console on the Microsoft Office 365 page.

Protecting Exchange Online mailboxes

What items can be backed up?

You can back up user mailboxes and shared mailboxes. Group mailboxes and archive mailboxes ( In-

Place Archive ) cannot be backed up.

What items can be recovered?

The following items can be recovered from a mailbox backup:

Mailboxes

Email folders

Email messages

Calendar events

Tasks

Contacts

Journal entries

Notes

You can use search to locate the items.

When a mailbox is recovered to an existing mailbox, the existing items with matching IDs are overwritten.

Recovery of mailbox items does not overwrite anything. Instead, the full path to a mailbox item is recreated in the target folder.

Selecting mailboxes

Select the mailboxes as described below, and then specify other settings of the protection plan as appropriate .

To select mailboxes

270

1. Click Microsoft Office 365 .

2. If prompted, sign in as a global administrator to Microsoft Office 365.

3. Select the mailboxes that you want to back up.

4. Click Backup .

Recovering mailboxes and mailbox items

Recovering mailboxes

1. Click Microsoft Office 365 .

2. Select the mailbox to recover, and then click Recovery .

You can search mailboxes by name. Wildcards are not supported.

If the mailbox was deleted, select it on the Backup storage tab , and then click

Show backups .

3. Select a recovery point. Note that recovery points are filtered by location.

4. Click Recover > Mailbox .

5. In Target mailbox , view, change, or specify the target mailbox.

By default, the original mailbox is selected. If this mailbox does not exist, you must specify the target mailbox.

6. Click Start recovery .

Recovering mailbox items

1. Click Microsoft Office 365 .

2. Select the mailbox that originally contained the items that you want to recover, and then click

Recovery .

You can search mailboxes by name. Wildcards are not supported.

If the mailbox was deleted, select it on the Backup storage tab , and then click

Show backups .

3. Select a recovery point. Note that recovery points are filtered by location.

4. Click Recover > Email messages .

5. Select the items that you want to recover.

The following search options are available. Wildcards are not supported.

For email messages: search by subject, sender, recipient, attachment name, and date.

For events: search by title and date.

For tasks: search by subject and date.

For contacts: search by name, email address, and phone number.

When an email message is selected, you can click Show content to view its contents, including attachments.

Note

Click the name of an attached file to download it.

When an email message is selected, you can click Send as email to send the message to an email address. The message is sent from your administrator account's email address.

271

To be able to select folders, click the "recover folders" icon:

6. Click Recover .

7. In Target mailbox , view, change, or specify the target mailbox.

By default, the original mailbox is selected. If this mailbox does not exist, you must specify the target mailbox.

8. Click Start recovery .

9. Confirm your decision.

The mailbox items are always recovered to the Recovered items folder of the target mailbox.

Changing the Office 365 access credentials

You can change access credentials for Office 365 without re-installing the agent.

To change the Office 365 access credentials

1. Click Devices > Microsoft Office 365 .

2. Click Specify credentials .

3. Enter the Office 365 global administrator credentials, and then click OK .

The agent will log in to Office 365 by using this account. To enable the agent to access the contents of all mailboxes, this account will be assigned the ApplicationImpersonation management role.

12.19.6 Using the cloud Agent for Office 365

Adding a Microsoft Office 365 organization

To add a Microsoft Office 365 organization

1. Sign in to the service console as a company administrator.

2. Click Devices > Add > Microsoft Office 365 for Business .

3. Select the Microsoft data center used by your organization.

The software redirects you to the Microsoft Office 365 login page.

4. Sign in with the Office 365 global administrator credentials.

Microsoft Office 365 displays a list of permissions that are necessary to back up and recover your organization's data.

5. Confirm that you grant the Cyber Protection service these permissions.

As a result, your organization's data items appear in the service console on the Microsoft Office 365 page.

Tips for further usage

The cloud agent synchronizes with Office 365 every 24 hours, starting from the moment when the organization is added to the Cyber Protection service. If you add or remove a user, group, or site, you will not see this change in the service console immediately. To forcibly synchronize the cloud

272

agent with Office 365, select the organization on the Microsoft Office 365 page, and then click

Refresh .

If you applied a protection plan to the All users , All groups , or All sites group, the newly added items will be included in the backup only after the synchronization.

According to Microsoft policy, after a user, group, or site is removed from Office 365 GUI, it remains available for a few days via the API. During these days, the removed item is inactive

(grayed out) in the service console and is not backed up. When the removed item becomes unavailable via the API, it disappears from the service console. Its backups (if any) can be found at

Backups > Cloud applications backups .

Deleting a Microsoft Office 365 organization

To delete a Microsoft Office 365 organization

1. Sign in to the service console as a company administrator.

2. Go to Devices > Microsoft Office 365.

3. Select the organization and click Delete group .

As a result, the backup plans applied to this group will be revoked.

However, you should additionally revoke access rights of the Backup Service application to Office 365 organization data manually.

To revoke access rights

1. Log in to Office 365 under a global administrator.

2. Go to Admin Center > Azure Active Directory > Enterprise applications > All applications .

3. Select the Backup Service application and drill down to it.

4. Go to the Properties tab and on the action panel click Delete .

5. Confirm the deletion operation.

As a result, access rights to the Office 365 organization data will be revoked from the Backup Service application.

Protecting Exchange Online data

What items can be backed up?

You can back up user mailboxes, shared mailboxes, and group mailboxes. Optionally, you can choose to back up the archive mailboxes ( In-Place Archive ) of the selected mailboxes.

Starting from version 8.0 of the Cyber Protection service, you can back up public folders. If your organization was added to the Cyber Protection service before the version 8.0 release, you need to re-add the organization to obtain this functionality. Do not delete the organization, simply repeat the

steps described in "Adding a Microsoft Office 365 organization"

. As a result, the Cyber Protection service obtains the permission to use the corresponding API.

273

What items can be recovered?

The following items can be recovered from a mailbox backup:

Mailboxes

Email folders

Email messages

Calendar events

Tasks

Contacts

Journal entries

Notes

The following items can be recovered from a public folder backup:

Subfolders

Posts

Email messages

You can use search to locate the items.

When recovering mailboxes, mailbox items, public folders, and public folder items, you can select whether to overwrite the items in the target location.

Selecting mailboxes

Select the mailboxes as described below, and then specify other settings of the protection plan as appropriate .

To select Exchange Online mailboxes

1. Click Microsoft Office 365 .

2. If multiple Office 365 organizations were added to the Cyber Protection service, select the organization whose users' data you want to back up. Otherwise, skip this step.

3. Do one of the following:

To back up the mailboxes of all users and all shared mailboxes (including mailboxes that will be created in the future), expand the Users node, select All users , and then click Group backup .

To back up individual user or shared mailboxes, expand the Users node, select All users , select the users whose mailboxes you want to back up, and then click Backup .

To back up all group mailboxes (including mailboxes of groups that will be created in the future), expand the Groups node, select All groups , and then click Group backup .

To back up individual group mailboxes, expand the Groups node, select All groups , select the groups whose mailboxes you want to back up, and then click Backup .

274

Note

The cloud Agent for Office 365 uses an account with the appropriate rights to access a group mailbox. Thus, to back up a group mailbox, at least one of the group owners must be licensed

Office 365 user with a mailbox. If the group is private or with hidden membership, the owner must also be a member of the group.

4. On the protection plan panel:

Ensure that the Office 365 mailboxes item is selected in What to back up .

If some of the individually selected users do not have the Exchange service included in their

Office 365 plan, you will not be able to select this option.

If some of the selected users for group backup do not have the Exchange service included in their Office 365 plan, you will be able to select this option, but the protection plan will not be applied to those users.

If you do not want to backup the archive mailboxes, disable the Archive mailbox switch.

Selecting public folders

Select the public folders as described below, and then specify other settings of the protection plan as appropriate .

Note

Public folders consume licenses from your backup quota for Office 365 seats.

To select Exchange Online public folders

1. Click Microsoft Office 365 .

2. If multiple Office 365 organizations were added to the Cyber Protection service, expand the organization whose data you want to back up. Otherwise, skip this step.

3. Expand the Public folders node, and then select All public folders .

4. Do one of the following:

To back up all public folders (including public folders that will be created in the future), click

Group backup .

To back up individual public folders, select the public folders that you want to back up, and then click Backup .

5. On the protection plan panel, ensure that the Office 365 mailboxes item is selected in What to back up .

Recovering mailboxes and mailbox items

Recovering mailboxes

1. Click Microsoft Office 365 .

2. If multiple Office 365 organizations were added to the Cyber Protection service, select the organization whose backed-up data you want to recover. Otherwise, skip this step.

275

3. Do one of the following:

To recover a user mailbox, expand the Users node, select All users , select the user whose mailbox you want to recover, and then click Recovery .

To recover a shared mailbox, expand the Users node, select All users , select the shared mailbox that you want to recover, and then click Recovery .

To recover a group mailbox, expand the Groups node, select All groups , select the group whose mailbox you want to recover, and then click Recovery .

If the user, group, or the shared mailbox was deleted, select the item in the Cloud applications backups

Show backups .

You can search users and groups by name. Wildcards are not supported.

4. Select a recovery point.

Note

To see only the recovery points that contain mailboxes, select Mailboxes in Filter by content .

5. Click Recover > Entire mailbox .

6. If multiple Office 365 organizations are added to the Cyber Protection service, click Office 365 organization to view, change, or specify the target organization.

By default, the original organization is selected. If this organization is no longer registered in the

Cyber Protection service, you must specify the target organization.

7. In Recover to mailbox , view, change, or specify the target mailbox.

By default, the original mailbox is selected. If this mailbox does not exist or a non-original organization is selected, you must specify the target mailbox.

8. Click Start recovery .

9. Select one of the overwriting options:

Overwrite existing items

Do not overwrite existing items

10. Click Proceed to confirm your decision.

Recovering mailbox items

1. Click Microsoft Office 365 .

2. If multiple Office 365 organizations were added to the Cyber Protection service, select the organization whose backed-up data you want to recover. Otherwise, skip this step.

3. Do one of the following:

To recover items from a user mailbox, expand the Users node, select All users , select the user whose mailbox originally contained the items that you want to recover, and then click

Recovery .

To recover items from a shared mailbox, expand the Users node, select All users , select the shared mailbox that originally contained the items that you want to recover, and then click

Recovery .

276

To recover items from a group mailbox, expand the Groups node, select All groups , select the group whose mailbox originally contained the items that you want to recover, and then click

Recovery .

If the user, group, or the shared mailbox was deleted, select the item in the Cloud applications backups

Backup storage tab , and then click

Show backups .

You can search users and groups by name. Wildcards are not supported.

4. Select a recovery point.

Note

To see only the recovery points that contain mailboxes, select Mailboxes in Filter by content .

5. Click Recover > Email messages .

6. Browse to the required folder or use search to obtain the list of the required items.

The following search options are available. Wildcards are not supported.

For email messages: search by subject, sender, recipient, attachment name, and date.

For events: search by title and date.

For tasks: search by subject and date.

For contacts: search by name, email address, and phone number.

7. Select the items that you want to recover. To be able to select folders, click the "recover folders" icon:

Additionally, you can do any of the following:

When an item is selected, click Show content to view its contents, including attachments.

Click the name of an attached file to download it.

8. Click Recover .

9. If multiple Office 365 organizations were added to the Cyber Protection service, click Office 365 organization to view, change, or specify the target organization.

By default, the original organization is selected. If this organization is no longer registered in the

Cyber Protection service, you must specify the target organization.

10. In Recover to mailbox , view, change, or specify the target mailbox.

By default, the original mailbox is selected. If this mailbox does not exist or a non-original organization is selected, you must specify the target mailbox.

11. [Only when recovering to a user or a shared mailbox] In Path , view or change the target folder in the target mailbox. By default, the Recovered items folder is selected.

Group mailbox items are always recovered to the Inbox folder.

12. Click Start recovery .

277

13. Select one of the overwriting options:

Overwrite existing items

Do not overwrite existing items

14. Click Proceed to confirm your decision.

Recovering public folders and folder items

In order to recover a public folder or public folder items, at least one administrator of the target

Office 365 organization must have the Owner 's rights for the target public folder. If the recovery fails with an error about denied access, assign these rights in the target folder properties, select the target organization in the service console, click Refresh , and then repeat the recovery.

To recover a public folder or folder items

1. Click Microsoft Office 365 .

2. If multiple Office 365 organizations are added to the Cyber Protection service, expand the organization whose backed-up data you want to recover. Otherwise, skip this step.

3. Do one of the following:

Expand the Public folders node, select All public folders , select the public folder that you want to recover or that originally contained the items that you want to recover, and then click

Recovery .

If the public folder was deleted, select it in the Cloud applications backups

section of the

Show backups .

You can search public folders by name. Wildcards are not supported.

4. Select a recovery point.

5. Click Recover data .

6. Browse to the required folder or use search to obtain the list of the required items.

You can search email messages and posts by subject, sender, recipient, and date. Wildcards are not supported.

7. Select the items that you want to recover. To be able to select folders, click the "recover folders" icon:

Additionally, you can do any of the following:

When an email message or a post is selected, click Show content to view its contents, including attachments.

Click the name of an attached file to download it.

When an email message or a post is selected, click Send as email to send the item to specified email addresses. You can select the sender and write a text to be added to the forwarded item.

8. Click Recover .

9. If multiple Office 365 organizations were added to the Cyber Protection service, click Office 365 organization to view, change, or specify the target organization.

278

By default, the original organization is selected. If this organization is no longer registered in the

Cyber Protection service, you must specify the target organization.

10. In Recover to public folder , view, change, or specify the target public folder.

By default, the original folder is selected. If this folder does not exist or a non-original organization is selected, you must specify the target folder.

11. In Path , view or change the target subfolder in the target public folder. By default, the original path will be recreated.

12. Click Start recovery .

13. Select one of the overwriting options:

Overwrite existing items

Do not overwrite existing items

14. Click Proceed to confirm your decision.

Protecting OneDrive files

What items can be backed up?

You can back up an entire OneDrive, or individual files and folders.

Files are backed up together with their sharing permissions. Advanced permission levels ( Design ,

Full , Contribute ) are not backed up.

What items can be recovered?

You can recover an entire OneDrive or any file or folder that was backed up.

You can use search to locate the items.

You can choose whether to recover the sharing permissions or let the files inherit the permissions from the folder to which they are recovered.

Sharing links for files and folders are not recovered.

Selecting OneDrive files

Select the files as described below, and then specify other settings of the protection plan as appropriate .

To select OneDrive files

1. Click Microsoft Office 365 .

2. If multiple Office 365 organizations were added to the Cyber Protection service, select the organization whose users' data you want to back up. Otherwise, skip this step.

3. Do one of the following:

To back up the files of all users (including users that will be created in the future), expand the

Users node, select All users , and then click Group backup .

279

To back up the files of individual users, expand the Users node, select All users , select the users whose files you want to back up, and then click Backup .

4. On the protection plan panel:

Ensure that the OneDrive item is selected in What to back up .

If some of the individually selected users do not have the OneDrive service included in their

Office 365 plan, you will not be able to select this option.

If some of the selected users for group backup do not have the OneDrive service included in their Microsoft 365 plan, you will be able to select this option, but the protection plan will not be applied to those users.

In Items to back up , do one of the following:

Keep the default setting [All] (all files).

Specify the files and folders to back up by adding their names or paths.

You can use wildcard characters (*, **, and ?). For more details about specifying paths and

using wildcards, refer to "File filters" .

Specify the files and folders to back up by browsing.

The Browse link is available only when creating a protection plan for a single user.

[Optional] In Items to back up , click Show exclusions to specify the files and folders to skip during the backup.

File exclusions override the file selection; i.e. if you specify the same file in both fields, this file will be skipped during a backup.

Recovering OneDrive and OneDrive files

Recovering an entire OneDrive

1. Click Microsoft Office 365 .

2. If multiple Office 365 organizations were added to the Cyber Protection service, select the organization whose backed-up data you want to recover. Otherwise, skip this step.

3. Expand the Users node, select All users , select the user whose OneDrive you want to recover, and then click Recovery .

If the user was deleted, select the user in the Cloud applications backups

Show backups .

You can search users by name. Wildcards are not supported.

4. Select a recovery point.

Note

To see only the recovery points that contain OneDrive files, select OneDrive in Filter by content .

5. Click Recover > Entire OneDrive .

6. If multiple Office 365 organizations were added to the Cyber Protection service, click Office 365 organization to view, change, or specify the target organization.

280

By default, the original organization is selected. If this organization is no longer registered in the

Cyber Protection service, you must specify the target organization.

7. In Recover to drive , view, change, or specify the target user.

By default, the original user is selected. If this user does not exist or a non-original organization is selected, you must specify the target user.

8. Select whether to recover the sharing permissions for the files.

9. Click Start recovery .

10. Select one of the overwriting options:

Overwrite existing files

Overwrite an existing file if it is older

Do not overwrite existing files

11. Click Proceed to confirm your decision.

Recovering OneDrive files

1. Click Microsoft Office 365 .

2. If multiple Office 365 organizations were added to the Cyber Protection service, select the organization whose backed-up data you want to recover. Otherwise, skip this step.

3. Expand the Users node, select All users , select the user whose OneDrive files you want to recover, and then click Recovery .

If the user was deleted, select the user in the Cloud Applications Backups

Select the data as described below, and then specify other settings of the protection plan as appropriate .

Show backups .

You can search users by name. Wildcards are not supported.

4. Select a recovery point.

Note

To see only the recovery points that contain OneDrive files, select OneDrive in Filter by content .

5. Click Recover > Files/folders .

6. Browse to the required folder or use search to obtain the list of the required files and folders.

The search is not available if the backup is encrypted.

7. Select the files that you want to recover.

If the backup is not encrypted and you selected a single file, you can click Show versions to select the file version to recover. You can select any backed-up version, earlier or later than the selected recovery point.

8. If you want to download a file, select the file, click Download , select the location to save the file to, and then click Save . Otherwise, skip this step.

9. Click Recover .

10. If multiple Office 365 organizations were added to the Cyber Protection service, click Office 365 organization to view, change, or specify the target organization.

281

By default, the original organization is selected. If this organization is no longer registered in the

Cyber Protection service, you must specify the target organization.

11. In Recover to drive , view, change, or specify the target user.

By default, the original user is selected. If this user does not exist or a non-original organization is selected, you must specify the target user.

12. In Path , view or change the target folder in the target user's OneDrive. By default, the original location is selected.

13. Select whether to recover the sharing permissions for the files.

14. Click Start recovery .

15. Select one of the file overwriting options:

Overwrite existing files

Overwrite an existing file if it is older

Do not overwrite existing files

16. Click Proceed to confirm your decision.

Protecting SharePoint Online sites

What items can be backed up?

You can back up SharePoint classic site collections, group (modern team) sites, and communication sites. Also, you can select individual subsites, lists, and libraries for backup.

The following items are skipped during a backup:

The Look and Feel site settings (except for Title, description, and logo ).

Site page comments and page comments settings (comments On / Off ).

The Site features site settings.

Web part pages and web parts embedded in the wiki pages (due to SharePoint Online API limitations).

Checked out files—files that are manually checked out for editing and all files that are created or uploaded in libraries, for which the option Require Check Out was enabled. To backup these files, first check them in.

OneNote files (due to SharePoint Online API limitations).

External data and Managed Metadata types of columns.

The default site collection "domain-my.sharepoint.com". This is a collection where all of the organization users’ OneDrive files reside.

The contents of the recycle bin.

Limitations

Titles and descriptions of sites/subsites/lists/columns are truncated during a backup if the title/description size is greater than 10000 bytes.

282

You cannot back up previous versions of files created in SharePoint Online. Only the latest versions of the files are protected.

You cannot back up sites created in the Business Productivity Online Suite (BPOS), the predecessor of Microsoft Office 365.

You cannot back up the settings for sites that use the managed path /portals (for example, https://<tenant>.sharepoint.com/portals/...

What items can be recovered?

The following items can be recovered from a site backup:

Entire site

Subsites

Lists

List items

Document libraries

Documents

List item attachments

Site pages and wiki pages

You can use search to locate the items.

Items can be recovered to the original or a non-original site. The path to a recovered item is the same as the original one. If the path does not exist, it is created.

You can choose whether to recover the sharing permissions or let the items inherit the permissions from the parent object after the recovery.

What items cannot be recovered?

Subsites based on the Visio Process Repository template.

Lists of the following types: Survey list , Task list , Picture library , Links , Calendar , Discussion

Board , External , and Import Spreadsheet .

Lists for which multiple content types are enabled.

Selecting SharePoint Online data

To select SharePoint Online data

1. Click Microsoft Office 365 .

2. If multiple Office 365 organizations were added to the Cyber Protection service, select the organization whose users' data you want to back up. Otherwise, skip this step.

3. Do one of the following:

283

To back up all classic SharePoint sites in the organization, including sites that will be created in the future, expand the Site collections node, select All site collections , and then click

Group backup .

To back up individual classic sites, expand the Site collections node, select All site collections , select the sites that you want to back up, and then click Backup .

To back up all group (modern team) sites, including sites that will be created in the future, expand the Groups node, select All groups , and then click Group backup .

To back up individual group (modern team) sites, expand the Groups node, select All groups , select the groups whose sites you want to back up, and then click Backup .

4. On the protection plan panel:

Ensure that the SharePoint sites item is selected in What to back up .

In Items to back up , do one of the following:

Keep the default setting [All] (all items of the selected sites).

Specify the subsites, lists, and libraries to back up by adding their names or paths.

To back up a subsite or a top-level site list/library, specify its display name in the following format: /display name/**

To back up a subsite list/library, specify its display name in the following format: /subsite display name/list display name/**

The display names of subsites, lists, and libraries are shown on the Site contents page of a

SharePoint site or subsite.

Specify the subsites to back up by browsing.

The Browse link is available only when creating a protection plan for a single site.

[Optional] In Items to back up , click Show exclusions to specify the subsites, lists, and libraries to skip during the backup.

Item exclusions override the item selection; i.e. if you specify the same subsite in both fields, this subsite will be skipped during a backup.

Recovering SharePoint Online data

1. Click Microsoft Office 365 .

2. If multiple Office 365 organizations were added to the Cyber Protection service, select the organization whose backed-up data you want to recover. Otherwise, skip this step.

3. Do one of the following:

To recover data from a group (modern team) site, expand the Groups node, select All groups , select the group whose site originally contained the items that you want to recover, and then click Recovery .

To recover data from a classic site, expand the Site Collections node, select All site collections , select the site that originally contained the items that you want to recover, and then click Recovery .

If the site was deleted, select it in the Cloud applications backups

Select teams as described below, and then specify other settings of the protection plan as appropriate .

Show backups .

You can search groups and sites by name. Wildcards are not supported.

284

4. Select a recovery point.

Note

To see only the recovery points that contain SharePoint sites, select SharePoint sites in Filter by content .

5. Click Recover SharePoint files .

6. Browse to the required folder or use search to obtain the list of the required data items.

The search is not available if the backup is encrypted.

7. Select the items that you want to recover.

If the backup is not encrypted, you used search, and selected a single item in the search results, you can click Show versions to select the item version to recover. You can select any backed-up version, earlier or later than the selected recovery point.

8. If you want to download an item, select the item, click Download , select the location to save the item to, and click Save . Otherwise, skip this step.

9. Click Recover .

10. If multiple Office 365 organizations were added to the Cyber Protection service, click Office 365 organization to view, change, or specify the target organization.

By default, the original organization is selected. If this organization is no longer registered in the

Cyber Protection service, you must specify the target organization.

11. In Recover to site , view, change, or specify the target site.

By default, the original site is selected. If this site does not exist or a non-original organization is selected, you must specify the target site.

12. Select whether to recover the sharing permissions of the recovered items.

13. Click Start recovery .

14. Select one of the overwriting options:

Overwrite existing files

Overwrite an existing file if it is older

Do not overwrite existing files

15. Click Proceed to confirm your decision.

Protecting Office 365 Teams

What items can be backed up?

You can back up entire teams. This includes team name, team members list, team channels and their content, team mailbox and meetings, and team site.

What items can be recovered?

Entire team

Team channels

Channel files

285

Team mailbox

Email folders in the team mailbox

Email messages in the team mailbox

Meetings

Team site

You cannot recover conversations in team channels, but you can download them as a single html file.

Limitations

The following items are not backed up:

The settings of the general channel (moderation preferences) – due to a Microsoft Teams beta API limitation.

The settings of the custom channels (moderation preferences) – due to a Microsoft Teams beta API limitation.

Meeting notes, chats.

Stickers and praises.

Backup and recovery are supported for the following channel tabs:

Word

Excel

PowerPoint

PDF

Document Library

Files that are shared in private channels are backed up, but not restored due to an API limitation.

Note

These files are stored in specific locations, separately from the files that are shared in public channels.

Selecting teams

To select teams

1. Click Microsoft Office 365 .

2. If multiple Office 365 organizations were added to the Cyber Protection service, select the organization whose teams you want to back up. Otherwise, skip this step.

3. Do one of the following:

To back up all the teams in the organization (including teams that will be created in the future), expand the Teams node, select All teams , and then click Group backup .

To back up individual teams, expand the Teams node, select All teams , select the teams that you want to back up, and then click Backup .

286

You can search teams by name. Wildcards are not supported.

4. On the protection plan panel:

Ensure that the Microsoft Teams item is selected in What to back up .

[Optional] In How long to keep , set the cleanup options.

[Optional] If you want to encrypt your backup, enable the Encryption switch, and then set your password and select the encryption algorithm.

Recovering an entire team

1. Click Microsoft Office 365 .

2. If multiple Office 365 organizations were added to the Cyber Protection service, select the organization whose backed-up teams you want to recover. Otherwise, skip this step.

3. Expand the Teams node, select All teams , select the team that you want to recover, and then click Recovery .

You can search teams by name. Wildcards are not supported.

4. Select a recovery point.

5. Click Recover > Entire Team .

If multiple Office 365 organizations were added to the Cyber Protection service, click Office 365 organization to view, change, or specify the target organization.

By default, the original organization is selected. If this organization is no longer registered in the

Cyber Protection service, you must specify the target organization.

6. In Recover to team , view, change, or specify the target team.

By default, the original team is selected. If this team does not exist or a non-original organization is selected, you must specify the target team.

7. Click Start recovery .

8. Select one of the overwriting options:

Overwrite existing content if it is older

Overwrite existing content

Do not overwrite existing content

9. Click Proceed to confirm your decision.

When you delete a channel in Microsoft Teams' graphic interface, it is not immediately removed from the system. Thus, when you recover the whole team, this channel's name cannot be used and a postfix will be added to it.

Conversations are recovered as a single html file in the Files tab of the channel. You can find this file in a folder named according to the following pattern: <Team name>_<Channel name>_conversations_ backup_<date of recovery>T<time of recovery>Z .

Note

After recovering a team or team channels, go to Microsoft Teams, select the channels that were recovered, and then click their Files tab. Otherwise, the subsequent backups of these channels will not include this tab's content – due to a Microsoft Teams beta API limitation.

287

Recovering team channels or files in team channels

To recover team channels

1. Click Microsoft Office 365 .

2. If multiple Office 365 organizations were added to the Cyber Protection service, select the organization whose backed-up teams you want to recover. Otherwise, skip this step.

3. Expand the Teams node, select All teams , select the team whose channels you want to recover, and then click Recovery .

4. Select a recovery point.

5. Click Recover > Channels .

6. Select the channels that you want to recover, and then click Recover . To select a channel in the main pane, select the check box in front of its name.

The following search options are available:

For Conversations : sender, subject, content, language, attachment name, date or date range.

For Files : file name or folder name, file type, size, date or date range of the last change.

7. If multiple Office 365 organizations were added to the Cyber Protection service, click Office 365 organization to view, change, or specify the target organization.

By default, the original organization is selected. If this organization is no longer registered in the

Cyber Protection service, you must specify the target organization.

8. In Recover to team , view, change, or specify the target team.

By default, the original team is selected. If this team does not exist or a non-original organization is selected, you must specify the target team.

9. In Recover to channel , view, change, or specify the target channel.

10. Click Start recovery .

11. Select one of the overwriting options:

Overwrite existing content if it is older

Overwrite existing content

Do not overwrite existing content

12. Click Proceed to confirm your decision.

Note

To recover files in a team channel

288

1. Click Microsoft Office 365 .

2. If multiple Office 365 organizations were added to the Cyber Protection service, select the organization whose backed-up teams you want to recover. Otherwise, skip this step.

3. Expand the Teams node, select All teams , select the team whose channels you want to recover, and then click Recovery .

4. Select a recovery point.

5. Click Recover > Channels .

6. Select the desired channel, and then open the Files folder.

Browse to the required items or use search to obtain the list of the required items. The following search options are available:file name or folder name, file type, size, date or date range of the last change.

7. Select the items that you want to recover, and then click Recover

8. If multiple Office 365 organizations were added to the Cyber Protection service, click Office 365 organization to view, change, or specify the target organization.

By default, the original organization is selected. If this organization is no longer registered in the

Cyber Protection service, you must specify the target organization.

9. In Recover to team , view, change, or specify the target team.

By default, the original team is selected. If this team does not exist or a non-original organization is selected, you must specify the target team.

10. In Recover to channel , view, change, or specify the target channel.

11. Select whether to recover the sharing permissions of the recovered items.

12. Click Start recovery .

13. Select one of the overwriting options:

Overwrite existing content if it is older

Overwrite existing content

Do not overwrite existing content

14. Click Proceed to confirm your decision.

You cannot recover individual conversations. In the main pane, you can only browse the

Conversation folder or download its content as a single html file. To do so, click the "recover folders" icon , select the desired Conversations folder, and then click Download .

You can search the messages in the Conversation folder by:

Sender

Content

Attachment name

Date

289

Recovering a team mailbox

1. Click Microsoft Office 365 .

2. If multiple Office 365 organizations were added to the Cyber Protection service, select the organization whose backed-up teams you want to recover. Otherwise, skip this step.

3. Expand the Teams node, select All teams , select the team whose mailbox you want to recover, and then click Recovery .

You can search teams by name. Wildcards are not supported.

4. Select a recovery point.

5. Click Recover > Email messages .

6. Click the "recover folders" icon , select the root mailbox folder, and then click Recover .

Note

You can also recover individual folders from the selected mailbox.

7. Click Recover .

8. If multiple Office 365 organizations were added to the Cyber Protection service, click Office 365 organization to view, change, or specify the target organization.

By default, the original organization is selected. If this organization is no longer registered in the

Cyber Protection service, you must specify the target organization.

9. In Recover to mailbox , view, change, or specify the target mailbox.

By default, the original mailbox is selected. If this mailbox does not exist or a non-original organization is selected, you must specify the target mailbox.

10. Click Start recovery .

11. Select one of the overwriting options:

Overwrite existing items

Do not overwrite existing items

12. Click Proceed to confirm your decision.

Recovering email messages and meetings

1. Click Microsoft Office 365 .

2. If multiple Office 365 organizations were added to the Cyber Protection service, select the organization whose backed-up teams you want to recover. Otherwise, skip this step.

3. Expand the Teams node, select All teams , select the team whose email messages or meetings you want to recover, and then click Recovery .

You can search teams by name. Wildcards are not supported.

4. Select a recovery point.

5. Click Recover > Email messages .

6. Browse to the required item or use search to obtain the list of the required items.

The following search options are available:

290

For email messages: search by subject, sender, recipient, and date.

For meetings: search by event name and date.

7. Select the items that you want to recover, and then click Recover .

Note

You can find the meetings in the Calendar folder.

Additionally, you can do any of the following:

When an item is selected, click Show content to view its contents, including attachments. Click the name of an attached file to download it.

When an email message or a meeting is selected, click Send as email to send the item to the specified email addresses. You can select the sender and write a text to be added to the forwarded item.

8. If multiple Office 365 organizations were added to the Cyber Protection service, click Office 365 organization to view, change, or specify the target organization.

By default, the original organization is selected. If this organization is no longer registered in the

Cyber Protection service, you must specify the target organization.

9. In Recover to mailbox , view, change, or specify the target mailbox.

By default, the original mailbox is selected. If this mailbox does not exist or a non-original organization is selected, you must specify the target mailbox.

10. Click Start recovery .

11. Select one of the overwriting options:

Overwrite existing items

Do not overwrite existing items

12. Click Proceed to confirm your decision.

Recovering a team site or specific items of a site

1. Click Microsoft Office 365 .

2. If multiple Office 365 organizations were added to the Cyber Protection service, select the organization whose backed-up teams you want to recover. Otherwise, skip this step.

3. Expand the Teams node, select All teams , select the team whose site you want to recover, and then click Recovery .

You can search teams by name. Wildcards are not supported.

4. Select a recovery point.

5. Click Recover > Team site .

6. Browse to the required item or use search to obtain the list of the required items.

The search is not available if the backup is encrypted.

7. Select the items that you want to recover, and then click Recover .

8. If multiple Office 365 organizations were added to the Cyber Protection service, click Office 365 organization to view, change, or specify the target organization.

291

By default, the original organization and team are selected. If this organization is no longer registered in the Cyber Protection service, you must specify the target organization.

9. In Recover to team , view, change, or specify the target team.

By default, the original team is selected. If this team does not exist or a non-original organization is selected, you must specify the target site.

10. Select whether to recover the sharing permissions of the recovered items.

11. Click Start recovery .

12. Select one of the overwriting options:

Overwrite existing content if it is older

Overwrite existing content

Do not overwrite existing content

13. Click Proceed to confirm your decision.

Upgrading the cloud agent

This section describes how to upgrade to the current version of the backup solution for Microsoft

Office 365. This version supports OneDrive and SharePoint Online backup, and provides improved backup and recovery performance. Starting from version 8.0 of the Cyber Protection service, the following functionality is no longer supported by the old solution: editing, deleting, applying, and revoking a protection plan.

The upgrade availability depends on the data center readiness and the settings made by your service provider. If the upgrade is available, the service console shows a notification at the top of the

Microsoft Office 365 (v1) tab.

The upgrade process

During the upgrade, your Office 365 organization users are added to the new backup solution. The protection plans are migrated and applied to the appropriate users.

The earlier created backups are copied from one location in the cloud to another. On the Backup storage tab, the copied backups are shown in a separate section named Cloud applications backups , while the original backups remain in the Cloud storage location. When the upgrade process is complete, the original backups are deleted from the Cloud storage location.

The upgrade may take several hours, or even days, depending on the number of users in the organization, the number of backups, and the Office 365 access speed. During the upgrade, recovery from the earlier created backups is possible. However, backups and protection plans created during the upgrade will be lost.

In the unlikely case of an upgrade failure, the backup solution remains fully operational and the upgrade can be restarted from the point of failure.

To start the upgrade process

1. Click Microsoft Office 365 (v1) .

2. Click Upgrade in the notification at the top of the screen.

292

3. Confirm that you want to start the upgrade process.

4. Select the Microsoft data center used by your organization.

The software redirects you to the Microsoft Office 365 login page.

5. Sign in with the Office 365 global administrator credentials.

Microsoft Office 365 displays a list of permissions that are necessary to back up and recover your organization's data.

6. Confirm that you grant the Cyber Protection service these permissions.

You are redirected to the service console and the upgrade process begins. The upgrade progress is shown on the Microsoft Office 365 > Activities panel.

12.20 Protecting G Suite data

12.20.1 What does G Suite protection mean?

Cloud-to-cloud backup and recovery of G Suite user data (Gmail mailboxes, Calendars, Contacts,

Google Drives) and G Suite Shared drives.

Granular recovery of emails, files, contacts, and other items.

Support for several G Suite organizations and cross-organization recovery.

Optional notarization of the backed-up files by means of the Ethereum blockchain database. When enabled, you can prove that a file is authentic and unchanged since it was backed up.

Optional full-text search. When enabled, you can search emails by their content.

Up to 5000 items (mailboxes, Google Drives, and Shared drives) per company can be protected without performance degradation.

12.20.2 Supported G Suite editions

G Suite Basic. Only Gmail, Drive, Calendar, and Contacts services.

G Suite Business. Only Gmail, Drive (including Shared drives), Calendar, and Contacts services.

G Suite Enterprise. Only Gmail, Drive (including Shared drives), Calendar, and Contacts services.

G Suite for Education. Only Gmail, Drive (including Shared drives), Calendar, and Contacts services.

Classroom service is not supported.

12.20.3 Required user rights

In the

Cyber Protection

service

In the Cyber Protection service, you need to be a company administrator acting on a customer tenant level. Company administrators acting on a unit level, unit administrators, and users cannot back up or recover G Suite data.

293

In G Suite

To add your G Suite organization to the Cyber Protection service, you must be signed in as a Super

Admin with enabled API access ( Security > API reference > Enable API access in the Google Admin console).

The Super Admin password is not stored anywhere and is not used to perform backup and recovery.

Changing this password in G Suite does not affect Cyber Protection service operation.

If the Super Admin who added the G Suite organization is deleted from G Suite or assigned a role with

less privileges, the backups will fail with an error like "access denied". In this case, repeat the "Adding a

G Suite organization" procedure and specify valid Super Admin credentials. To avoid this situation, we

recommend creating a dedicated Super Admin user for backup and recovery purposes.

12.20.4 About the backup schedule

Because the cloud agent serves multiple customers, it determines the start time for each protection plan on its own, to ensure an even load during a day and an equal quality of service for all of the customers.

Each protection plan runs daily at the same time of day.

12.20.5 Limitations

Search in encrypted backups is not supported.

No more than 10 manual backup runs during an hour .

No more than 10 simultaneous recovery operations (this number includes both Office 365 and

GSuite recovery).

12.20.6 Adding a G Suite organization

To add a G Suite organization

1. Sign in to the service console as a company administrator.

2. Click Devices > Add > G Suite .

3. Follow the instructions displayed by the software:

a. Click Open marketplace .

b. Sign in with the Super Admin credentials.

c. Click Domain install .

d. Confirm the domain-wide installation.

G Suite displays a list of permissions that are necessary to back up and recover your organization's data.

e. Confirm that you grant the Cyber Protection service these permissions.

f. Complete the installation wizard.

294

g. Go to the Apps launcher icon, find the Cyber Protection Service application in the list, and then click on it.

You are redirected back to the service console. Your organization's data items appear in the service console on the G Suite page.

Tips for further usage

After adding a G Suite organization, the user data and Shared drives in both the primary domain and all the secondary domains, if there are any, will be backed up. The backed-up resources will be displayed in one list, and will not be grouped by their domain.

The cloud agent synchronizes with G Suite every 24 hours, starting from the moment when the organization is added to the Cyber Protection service. If you add or remove a user or Shared drive, you will not see this change in the service console immediately. To forcibly synchronize the cloud agent with G Suite, select the organization on the G Suite page, and then click Refresh .

If you applied a protection plan to the All users or All Shared drives group, the newly added items will be included in the backup only after the synchronization.

According to Google policy, after a user or Shared drive is removed from the G Suite GUI, it remains available for a few days via the API. During these days, the removed item is inactive

(grayed out) in the service console and is not backed up. When the removed item becomes unavailable via the API, it disappears from the service console. Its backups (if any) can be found at

Backups > Cloud Applications Backups .

12.20.7 Protecting Gmail data

What items can be backed up?

You can back up Gmail users' mailboxes. A mailbox backup also includes the Calendar and Contacts data. Optionally, you can choose to back up the shared calendars.

The following items are skipped during a backup:

The Birthdays , Reminders , Tasks calendars

Folders attached to calendar events

The Directory folder in Contacts

The following Calendar items are skipped, due to Google Calendar API limitations:

Appointment slots

The conferencing field of an event

The calendar setting All-day event notifications

The calendar setting Auto-accept invitations (in calendars for rooms or shared spaces)

The following Contacts items are skipped, due to Google People API limitations:

The Other contacts folder

The external profiles of a contact ( Directory profile , Google profile )

295

The contact field File as

What items can be recovered?

The following items can be recovered from a mailbox backup:

Mailboxes

Email folders (According to Google terminology, "labels". Labels are presented in the backup software as folders, for consistency with other data presentation.)

Email messages

Calendar events

Contacts

You can use search to locate items in a backup, unless the backup is encrypted. Search in encrypted backups is not supported.

When recovering mailboxes and mailbox items, you can select whether to overwrite the items in the target location.

Limitations

Contact photos cannot be recovered

The Out of office calendar item is recovered as a regular calendar event, due to Google Calendar

API limitations

Selecting mailboxes

Select the mailboxes as described below, and then specify other settings of the protection plan as appropriate .

To select Gmail mailboxes

1. Click G Suite .

2. If multiple G Suite organizations were added to the Cyber Protection service, select the organization whose users' data you want to back up. Otherwise, skip this step.

3. Do one of the following:

To back up the mailboxes of all users (including mailboxes that will be created in the future), expand the Users node, select All users , and then click Group backup .

To back up individual user mailboxes, expand the Users node, select All users , select the users whose mailboxes you want to back up, and then click Backup .

4. On the protection plan panel:

Ensure that the Gmail item is selected in What to back up .

If you want to back up calendars that are shared with the selected users, enable the Include shared calendars switch.

Decide whether you need full-text search

through the backed-up email messages. To access this option, click the gear icon > Backup options > Full-text search .

296

Full-text search

This option defines whether the email messages content is indexed by the cloud agent.

The preset is: Enabled .

If this option is enabled, the messages content is indexed and you can search messages by their content. Otherwise, only searching by subject, sender, recipient, or date is available.

Note

Search in encrypted backups is not supported.

The indexing process does not affect the backup performance because it is performed by a different software component. Indexing of the first (full) backup may take some time, therefore, there may be a delay between the backup completion and the content appearing in the search results.

The index occupies 10-30 percent of storage space occupied by the mailbox backups. To learn the exact value, click Backup storage > Cloud applications backups and view the Index size column.

You may want to disable full-text search in order to save this space. The value in the Index size column will decrease to a few megabytes after the next backup. This minimal amount of metadata is necessary to perform a search by subject, sender, recipient, or date.

When you re-enable full-text search, the software indexes all of the backups previously created by the protection plan. This also takes some time.

Recovering mailboxes and mailbox items

Recovering mailboxes

1. Click G Suite .

2. If multiple G Suite organizations were added to the Cyber Protection service, select the organization whose backed-up data you want to recover. Otherwise, skip this step.

3. Expand the Users node, select All users , select the user whose mailbox you want to recover, and then click Recovery .

If the user was deleted, select the user in the Cloud applications backups

Show backups .

You can search users and groups by name. Wildcards are not supported.

4. Select a recovery point.

Note

To see only the recovery points that contain mailboxes, select Gmail in Filter by content .

5. Click Recover > Entire mailbox .

6. If multiple G Suite organizations are added to the Cyber Protection service, click G Suite organization to view, change, or specify the target organization.

297

By default, the original organization is selected. If this organization is no longer registered in the

Cyber Protection service, you must select a new target organization from the available registered organizations.

7. In Recover to mailbox , view, change, or specify the target mailbox.

By default, the original mailbox is selected. If this mailbox does not exist or a non-original organization is selected, you must specify the target mailbox.

8. Click Start recovery .

9. Select one of the overwriting options:

Overwrite existing items

Do not overwrite existing items

10. Click Proceed to confirm your decision.

Recovering mailbox items

1. Click G Suite .

2. If multiple G Suite organizations were added to the Cyber Protection service, select the organization whose backed-up data you want to recover. Otherwise, skip this step.

3. Expand the Users node, select All users , select the user whose mailbox originally contained the items that you want to recover, and then click Recovery .

If the user was deleted, select the user in the Cloud applications backups

Select the files as described below, and then specify other settings of the protection plan as appropriate .

Show backups .

You can search users and groups by name. Wildcards are not supported.

4. Select a recovery point.

Note

To see only the recovery points that contain mailboxes, select Gmail in Filter by content .

5. Click Recover > Email messages .

6. Browse to the required folder. If the backup is not encrypted, you can use search to obtain the list of the required items.

The following search options are available. Wildcards are not supported.

For email messages: search by subject, sender, recipient, date, attachment name, and message content. The last two options yield results only if the Full-text search option was enabled during backup. The language of the message fragment being searched can be specified as an additional parameter.

For events: search by title and date.

For contacts: search by name, email address, and phone number.

7. Select the items that you want to recover. To be able to select folders, click the "recover folders" icon:

Additionally, you can do any of the following:

When an item is selected, click Show content to view its contents, including attachments.

Click the name of an attached file to download it.

298

8. Click Recover .

9. If multiple G Suite organizations were added to the Cyber Protection service, click G suite organization to view, change, or specify the target organization.

By default, the original organization is selected. If this organization is no longer registered in the

Cyber Protection service, you must select a new target organization from the available registered organizations.

10. In Recover to mailbox , view, change, or specify the target mailbox.

By default, the original mailbox is selected. If this mailbox does not exist or a non-original organization is selected, you must specify the target mailbox.

11. In Path , view or change the target folder in the target mailbox. By default, the original folder is selected.

12. Click Start recovery .

13. Select one of the overwriting options:

Overwrite existing items

Do not overwrite existing items

14. Click Proceed to confirm your decision.

12.20.8 Protecting Google Drive files

What items can be backed up?

You can back up an entire Google Drive, or individual files and folders. Optionally, you can choose to back up files that are shared with the Google Drive user.

Files are backed up together with their sharing permissions.

The following items are skipped during a backup:

A shared file, if the user has a commenter or viewer access to the file and the file owner disabled the options to download, print, and copy for commenters and viewers.

The Computers folder (created by the Backup and Sync client)

Limitations

Out of Google-specific file formats, only Google docs, Google sheets, Google slides, and Google

Drawings are backed up.

What items can be recovered?

You can recover an entire Google Drive, or any file or folder that was backed up.

You can use search to locate items in a backup, unless the backup is encrypted. Search in encrypted backups is not supported.

299

You can choose whether to recover the sharing permissions or let the files inherit the permissions from the folder to which they are recovered.

Limitations

Comments in files are not recovered.

Sharing links for files and folders are not recovered.

The read-only Owner settings for shared files ( Prevent editors from changing access and adding new people and Disable options to download, print and copy for commenters and viewers ) cannot be changed during a recovery.

Ownership of a shared folder cannot be changed during a recovery if the Prevent editors from changing access and adding new people option is enabled for this folder. This setting prevents the Google Drive API from listing the folder permissions. Ownership of the files in the folder is recovered correctly.

Selecting Google Drive files

To select Google Drive files

1. Click G Suite .

2. If multiple G Suite organizations were added to the Cyber Protection service, select the organization whose users' data you want to back up. Otherwise, skip this step.

3. Do one of the following:

To back up the files of all users (including users that will be created in the future), expand the

Users node, select All users , and then click Group backup .

To back up the files of individual users, expand the Users node, select All users , select the users whose files you want to back up, and then click Backup .

4. On the protection plan panel:

Ensure that the Google Drive item is selected in What to back up .

In Items to back up , do one of the following:

Keep the default setting [All] (all files).

Specify the files and folders to back up by adding their names or paths.

You can use wildcard characters (*, **, and ?). For more details about specifying paths and

using wildcards, refer to "File filters" .

Specify the files and folders to back up by browsing.

The Browse link is available only when creating a protection plan for a single user.

[Optional] In Items to back up , click Show exclusions to specify the files and folders to skip during the backup.

File exclusions override the file selection; i.e. if you specify the same file in both fields, this file will be skipped during a backup.

300

If you want to back up the files that are shared with the selected users, enable the Include shared files switch.

If you want to enable notarization of all files selected for backup, enable the Notarization

switch. For more information about notarization, refer to "Notarization"

Recovering Google Drive and Google Drive files

Recovering an entire Google Drive

1. Click G Suite .

2. If multiple G Suite organizations were added to the Cyber Protection service, select the organization whose backed-up data you want to recover. Otherwise, skip this step.

3. Expand the Users node, select All users , select the user whose Google Drive you want to recover, and then click Recovery .

If the user was deleted, select the user in the Cloud applications backups

Show backups .

You can search users by name. Wildcards are not supported.

4. Select a recovery point.

Note

To see only the recovery points that contain Google Drive files, select Google Drive in Filter by content .

5. Click Recover > Entire Drive .

6. If multiple G Suite organizations were added to the Cyber Protection service, click G Suite organization to view, change, or specify the target organization.

By default, the original organization is selected. If this organization is no longer registered in the

Cyber Protection service, you must select a new target organization from the available registered organizations.

7. In Recover to drive , view, change, or specify the target user or the target Shared drive.

By default, the original user is selected. If this user does not exist or a non-original organization is selected, you must specify the target user or the target Shared drive.

If the backup contains shared files, the files will be recovered to the root folder of the target drive.

8. Select whether to recover the sharing permissions for the files.

9. Click Start recovery .

10. Select one of the overwriting options:

Overwrite existing files

Overwrite an existing file if it is older

Do not overwrite existing files

11. Click Proceed to confirm your decision.

301

Recovering Google Drive files

1. Click G Suite .

2. If multiple G Suite organizations were added to the Cyber Protection service, select the organization whose backed-up data you want to recover. Otherwise, skip this step.

3. Expand the Users node, select All users , select the user whose Google Drive files you want to recover, and then click Recovery .

If the user was deleted, select the user in the Cloud applications backups

Select the files as described below, and then specify other settings of the protection plan as appropriate .

Show backups .

You can search users by name. Wildcards are not supported.

4. Select a recovery point.

Note

To see only the recovery points that contain Google Drive files, select Google Drive in Filter by content .

5. Click Recover > Files/folders .

6. Browse to the required folder or use search to obtain the list of the required files and folders.

The search is not available if the backup is encrypted.

7. Select the files that you want to recover.

8. If you want to download a file, select the file, click Download , select the location to save the file to, and then click Save . Otherwise, skip this step.

9. Click Recover .

10. If multiple G Suite organizations were added to the Cyber Protection service, click G Suite organization to view, change, or specify the target organization.

By default, the original organization is selected. If this organization is no longer registered in the

Cyber Protection service, you must select a new target organization from the available registered organizations.

11. In Recover to drive , view, change, or specify the target user or the target Shared drive.

By default, the original user is selected. If this user does not exist or a non-original organization is selected, you must specify the target user or the target Shared drive.

12. In Path , view or change the target folder in the target user's Google Drive or in the target Shared drive. By default, the original location is selected.

13. Select whether to recover the sharing permissions for the files.

14. Click Start recovery .

15. Select one of the file overwriting options:

Overwrite existing files

Overwrite an existing file if it is older

302

Do not overwrite existing files

16. Click Proceed to confirm your decision.

12.20.9 Protecting Shared drive files

What items can be backed up?

You can back up an entire Shared drive, or individual files and folders.

Files are backed up together with their sharing permissions.

Limitations

A Shared drive without members cannot be backed up, due to Google Drive API limitations.

Out of Google-specific file formats only Google docs, Google sheets, Google slides, and Google

Drawings are backed up.

What items can be recovered?

You can recover an entire Shared drive, or any file or folder that was backed up.

You can use search to locate items in a backup, unless the backup is encrypted. Search in encrypted backups is not supported.

You can choose whether to recover the sharing permissions or let the files inherit the permissions from the folder to which they are recovered.

The following items are not recovered:

Sharing permissions for a file that was shared with a user outside the organization are not recovered if sharing outside the organization is disabled in the target Shared drive.

Sharing permissions for a file that was shared with a user who is not a member of the target

Shared drive are not recovered if Sharing with non-members is disabled in the target Shared drive.

Limitations

Comments in files are not recovered.

Sharing links for files and folders are not recovered.

Selecting Shared drive files

To select Shared drive files

303

1. Click G Suite .

2. If multiple G Suite organizations were added to the Cyber Protection service, select the organization whose users' data you want to back up. Otherwise, skip this step.

3. Do one of the following:

To back up the files of all Shared drive (including Shared drive that will be created in the future), expand the Shared drives node, select All Shared drives , and then click Group backup .

To back up the files of individual Shared drives, expand the Shared drives node, select All

Shared drives , select the Shared drives to back up, and then click Backup .

4. On the protection plan panel:

In Items to back up , do one of the following:

Keep the default setting [All] (all files).

Specify the files and folders to back up by adding their names or paths.

You can use wildcard characters (*, **, and ?). For more details about specifying paths and

using wildcards, refer to "File filters" .

Specify the files and folders to back up by browsing.

The Browse link is available only when creating a protection plan for a single Shared drive.

[Optional] In Items to back up , click Show exclusions to specify the files and folders to skip during the backup.

File exclusions override the file selection; i.e. if you specify the same file in both fields, this file will be skipped during a backup.

If you want to enable notarization of all files selected for backup, enable the Notarization

switch. For more information about notarization, refer to "Notarization"

Recovering Shared drive and Shared drive files

Recovering an entire Shared drive

1. Click G Suite .

2. If multiple G Suite organizations were added to the Cyber Protection service, select the organization whose backed-up data you want to recover. Otherwise, skip this step.

3. Expand the Shared drives node, select All Shared drives , select the Shared drive that you want to recover, and then click Recovery .

If the Shared drive was deleted, select it in the Cloud applications backups

section of the

Backup storage tab , and then click

Show backups .

You can search Shared drives by name. Wildcards are not supported.

4. Select a recovery point.

5. Click Recover > Entire Shared drive .

6. If multiple G Suite organizations were added to the Cyber Protection service, click G Suite organization to view, change, or specify the target organization.

304

By default, the original organization is selected. If this organization is no longer registered in the

Cyber Protection service, you must select a new target organization from the available registered organizations.

7. In Recover to drive , view, change, or specify the target Shared drive or the target user. If you specify a user, the data will be recovered to this user's Google Drive.

By default, the original Shared drive is selected. If this Shared drive does not exist or a non-original organization is selected, you must specify the target Shared drive or the target user.

8. Select whether to recover the sharing permissions for the files.

9. Click Start recovery .

10. Select one of the overwriting options:

Overwrite existing files

Overwrite an existing file if it is older

Do not overwrite existing files

11. Click Proceed to confirm your decision.

Recovering Shared drive files

1. Click G Suite .

2. If multiple G Suite organizations were added to the Cyber Protection service, select the organization whose backed-up data you want to recover. Otherwise, skip this step.

3. Expand the Shared drives node, select All Shared drives , select the Shared drive that originally contained the files you want to recover, and then click Recovery .

If the Shared drive was deleted, select it in the Cloud applications backups

section of the

Backup storage tab , and then click

Show backups .

You can search Shared drives by name. Wildcards are not supported.

4. Select a recovery point.

5. Click Recover > Files/folders .

6. Browse to the required folder or use search to obtain the list of the required files and folders.

The search is not available if the backup is encrypted.

7. Select the files that you want to recover.

8. If you want to download a file, select the file, click Download , select the location to save the file to, and then click Save . Otherwise, skip this step.

9. Click Recover .

10. If multiple G Suite organizations were added to the Cyber Protection service, click G Suite organization to view, change, or specify the target organization.

By default, the original organization is selected. If this organization is no longer registered in the

Cyber Protection service, you must select a new target organization from the available registered organizations.

305

11. In Recover to drive , view, change, or specify the target Shared drive or the target user. If you specify a user, the data will be recovered to this user's Google Drive.

By default, the original Shared drive is selected. If this Shared drive does not exist or a non-original organization is selected, you must specify the target Shared drive or the target user.

12. In Path , view or change the target folder in the target Shared drive or the target user's Google

Drive. By default, the original location is selected.

13. Select whether to recover the sharing permissions for the files.

14. Click Start recovery .

15. Select one of the file overwriting options:

Overwrite existing files

Overwrite an existing file if it is older

Do not overwrite existing files

16. Click Proceed to confirm your decision.

12.20.10 Notarization

Notarization is available only for backups of Google Drive files and G Suite Shared drive files.

How to use notarization

To enable notarization of all files selected for backup, enable the Notarization switch when creating a protection plan.

When configuring recovery, the notarized files will be marked with a special icon, and you can verify the file authenticity

How it works

306

Verifying file authenticity with Notary Service

If notarization was enabled during backup, you can verify the authenticity of a backed-up file.

To verify the file authenticity

1. Do one of the following:

To verify the authenticity of a Google Drive file, select the file as described in steps 1-7 of the

"Recovering Google Drive files"

section.

To verify the authenticity of a G Suite Shared drive file, select the file as described in steps 1-7

of the "Recovering Shared drive files" section.

2. Ensure that the selected file is marked with the following icon: notarized.

3. Do one of the following:

Click Verify .

. This means that the file is

The software checks the file authenticity and displays the result.

Click Get certificate .

A certificate that confirms the file notarization is opened in a web browser window. The window also contains instructions that allow you to verify the file authenticity manually.

12.21 Protecting Oracle Database

Protection of Oracle Database is described in a separate document available at https://dl.managedprotection.com/u/pdf/OracleBackup_whitepaper.pdf

Note

This functionality is available only in the Advanced edition of the Cyber Protection service.

12.22 Protecting SAP HANA

Protection of SAP HANA is described in a separate document available at https://dl.managedprotection.com/u/pdf/SAP%20HANA_backup_whitepaper.pdf

Note

This functionality is available only in the Advanced edition of the Cyber Protection service.

12.23 Protecting websites and hosting servers

12.23.1 Protecting websites

A website can be corrupted as a result of unauthorized access or a malware attack. Back up your website if you want to easily revert it to a healthy state, in case of corruption.

307

What do I need to back up a website?

The website must be accessible via the SFTP or SSH protocol. You do not need to install an agent, just add a website as described later in this section.

What items can be backed up?

You can back up the following items:

Website content files

All files accessible to the account you specify for the SFTP or SSH connection.

Linked databases (if any) hosted on MySQL servers.

All databases accessible to the MySQL account you specify.

If your website employs databases, we recommend that you back up both the files and the databases, to be able to recover them to a consistent state.

Limitations

The only backup location available for website backup is the cloud storage.

It is possible to apply several protection plans to a website, but only one of them can run on a schedule. Other plans need to be started manually.

The only available backup option is "Backup file name"

The website protection plans are not shown on the Plans > Protection tab.

Backing up a website

To add a website

1. Click Devices > Add .

2. Click Website .

3. Configure the following access settings for the website:

In Website name , create and type a name for your website. This name will be displayed in the service console.

In Host , specify the host name or IP address that will be used to access the website via SFTP or

SSH. For example, my.server.com

or 10.250.100.100

In Port , specify the port number.

In User name and Password , specify the credentials of the account that can be used to access the website via SFTP or SSH.

Important

Only the files that are accessible to the specified account will be backed up.

Instead of a password, you can specify your private SSH key. To do this, select the Use SSH private key instead of password check box, and then specify the key.

308

4. Click Next .

5. If your website uses MySQL databases, configure the access settings for the databases. Otherwise, click Skip .

a. In Connection type , select how to access the databases from the cloud:

Via SSH from host —The databases will be accessed via the host specified in step 3.

Direct connection —The databases will be accessed directly. Choose this setting only if the databases are accessible from the Internet.

b. In Host , specify the name or IP address of the host where the MySQL server is running.

c. In Port , specify the port number for the TCP/IP connection to the server. The default port number is 3306.

d. In User name and Password , specify the MySQL account credentials.

Important

Only the databases that are accessible to the specified account will be backed up.

e. Click Create .

The website appears in the service console under Devices > Websites .

To change the connection settings

1. Select the website under Devices > Websites .

2. Click Details .

3. Click the pencil icon next to the website or the database connection settings.

4. Do the necessary changes, and then click Save .

To create a protection plan for websites

1. Select a website or several websites under Devices > Websites .

2. Click Protect .

3. [Optional] Enable backup of databases.

If several websites are selected, backup of databases is disabled by default.

4. [Optional] Change the retention rules

5. [Optional] Enable encryption of backups

6. [Optional] Click the gear icon to edit the Backup file name option. This makes sense in two

cases:

If you backed up this website earlier and want to continue the existing sequence of backups

If you want to see the custom name on the Backup storage tab

7. Click Apply .

You can edit, revoke, and delete protection plans for websites in the same way as for machines. These operations are described in "Operations with protection plans".

Recovering a website

To recover a website

309

1. Do one of the following:

Under Devices > Websites , select the website that you want to recover, and then click

Recovery .

You can search websites by name. Wildcards are not supported.

If the website was deleted, select it in the Cloud applications backups

Show backups .

To recover a deleted website, you need to add the target site as a device.

2. Select the recovery point.

3. Click Recover , and then select what you want to recover: Entire website , Databases (if any), or

Files/folders .

To ensure that your website is in a consistent state, we recommend recovering both files and databases, in any order.

4. Depending on your choice, follow one of the procedures described below.

To recover the entire website

1. In Recover to website , view or change the target website.

By default, the original website is selected. If it does not exist, you must select the target website.

2. Select whether to recover the sharing permissions of the recovered items.

3. Click Start recovery , and then confirm the action.

To recover the databases

1. Select the databases that you want to recover.

2. If you want to download a database as a file, click Download , select the location to save the file to, and then click Save . Otherwise, skip this step.

3. Click Recover .

4. In Recover to website , view or change the target website.

By default, the original website is selected. If it does not exist, you must select the target website.

5. Click Start recovery , and then confirm the action.

To recover the website files/folders

1. Select the files/folders that you want to recover.

2. If you want to save a file, click Download , select the location to save the file to, and then click

Save . Otherwise, skip this step.

3. Click Recover .

4. In Recover to website , view or change the target website.

By default, the original website is selected. If it does not exist, you must select the target website.

5. Select whether to recover the sharing permissions of the recovered items.

6. Click Start recovery , and then confirm the action.

310

12.23.2 Protecting web hosting servers

Web hosting administrators that use the Plesk or cPanel platforms can integrate these platforms with the Cyber Protection service.

The integration enables an administrator to do the following:

Back up an entire Plesk or cPanel server to the cloud storage, with disk-level backup

Recover the entire server, including all of the websites

For Plesk: perform granular recovery of websites, individual files, mailboxes, or databases

For cPanel: perform granular recovery of websites, individual files, mailboxes, mail filters, mail forwarders, databases, and accounts

Enable self-service recovery for Plesk and cPanel customers

The integration is performed by using the Cyber Protection service extension. If you need the extension for Plesk or cPanel, contact the provider of the Cyber Protection service.

Supported Plesk and cPanel versions

Plesk for Linux 17.0 and later

Any cPanel version with PHP 5.6 and later

Quotas

Each backed-up Plesk or cPanel server consumes the Web hosting servers quota. If this quota is disabled or the overage for this quota is exceeded, the following will happen:

If the server is physical, the Servers quota will be used. If this quota is disabled or the overage for this quota is exceeded, the backup will fail.

If the server is virtual, the Virtual machines quota will be used. If this quota is disabled or the overage for this quota is exceeded, the backup will fail.

12.24 Special operations with virtual machines

12.24.1 Running a virtual machine from a backup (Instant Restore)

You can run a virtual machine from a disk-level backup that contains an operating system. This operation, also known as instant restore, enables you to spin up a virtual server in seconds. The virtual disks are emulated directly from the backup and thus do not consume space on the datastore

(storage). The storage space is required only to keep changes to the virtual disks.

We recommend running this temporary virtual machine for up to three days. Then, you can completely remove it or convert it to a regular virtual machine (finalize) without downtime.

As long as the temporary virtual machine exists, retention rules cannot be applied to the backup being used by that machine. Backups of the original machine can continue to run.

311

Usage examples

Disaster recovery

Instantly bring a copy of a failed machine online.

Testing a backup

Run the machine from the backup and ensure that the guest OS and applications are functioning properly.

Accessing application data

While the machine is running, use application's native management tools to access and extract the required data.

Prerequisites

At least one Agent for VMware or Agent for Hyper-V must be registered in the Cyber Protection service.

The backup can be stored in a network folder or in a local folder of the machine where Agent for

VMware or Agent for Hyper-V is installed. If you select a network folder, it must be accessible from that machine. A virtual machine can also be run from a backup stored in the cloud storage, but it works slower because this operation requires intense random-access reading from the backup.

The backup must contain an entire machine or all of the volumes that are required for the operating system to start.

Backups of both physical and virtual machines can be used. Backups of Virtuozzo containers cannot be used.

Backups that contain Linux logical volumes (LVM) must be created by Agent for VMware or Agent for Hyper-V. The virtual machine must be of the same type as the original machine (ESXi or Hyper-

V).

Running the machine

1. Do one of the following:

Select a backed-up machine, click Recovery , and then select a recovery point.