1315 - Error: Could not recover files marked as malware

Symptom

One or more files selected for recovery are not restored, with the following error presenting in ESE: "Could not restore [x] items in [location] as they have been marked as malware or deleted".

Cause

This happens because we do not allow recovery of files that have been found to contain malware.

Our system scans all files for malware and classifies them into one of two states:

1. Cleared - the file is free from malware and safe for recovery.
2. Quarantined - the file has been flagged as suspicious and is now unavailable for recovery selection.

For more on Redstor's malware detection service, see Article 1330.

Solution

Files that have been quarantined can be actioned in one of three ways:

1. Mark as safe - the suspicious file is removed from quarantine and returned to the backup selection
2. Delete - the suspicious file is permanently removed
3. Revert - the suspicious file is rolled back to a previous, malware-free state

These actions can only be performed via the RedApp (not via ESE).

To action quarantined files:

1. Log into the RedApp and go to Notifications. Under Suspicious files have been found, click on View. You can also access the list of affected files at any time by going to the machines overview page. On the Suspicious files card, click on View.

2. In the files list, locate the problematic file/s as highlighted in ESE. For any file you want to action, expand the menu to the right of the file listing in the RedApp.

3. Click Mark as safe if you are certain the file is not malicious, or Delete to remove the file from your backups permanently. If a previous, malware-free version of a file is available, you will have a third option, Revert, as explained above. You can also select multiple files and perform a bulk action using the buttons at the bottom right of the page.

Your selected action will be queued. Once the action has been completed, this will reflect in your notifications.

If you marked a file as safe or reverted it in the RedApp, the file will now be available for recovery in ESE once again.