Put back what was hit. Nothing else.
The audit trail already knows which files the blocked account touched. Those are the files that come back — individually or in bulk, from the snapshots that are already being taken.
Syslog CEF and REST, into the tool you already run
A full restore is not a recovery plan.
Rolling a volume back to last night returns every untouched file as well, and everyone loses a morning’s work to clean up after one account. The question is not whether you have snapshots. It is whether you know exactly which files to take out of them.
- Which files did that account actually change?
- Can you restore those, and only those?
- How long would a full-volume rollback cost everyone else?
- Who authorized the restore, and is that on record?
What it does.
Let’s solve your data challenges.
Connect with our engineers to find the right approach for your infrastructure.
It works with the snapshots you already have.
Recovery reads the snapshots that are already being taken — no second copy, no separate restore product, and no rollback of data that was never touched.
Talk to an engineer who knows your data.
Four fields, and somebody who knows ONTAP, PowerScale and what FPolicy does. Not a qualification call.