Analyzing Encrypted Data Events

When Veeam Backup & Replication registers an Encrypted data event, you can analyze the affected restore point in the console to identify the files that may contain encrypted blocks.

Veeam Backup & Replication creates these events only if the inline scan is enabled. For more information, see Encryption Detection.

To analyze an Encrypted data event, do the following:

In the History view, navigate to Malware Detection > Malware Events and select an Encrypted data event.
Click Analyze on the ribbon. Alternatively, open the Event Details window and click Start entropy analysis.

Veeam Backup & Replication mounts the restore point, analyzes it for encrypted files, and unmounts it. When the analysis finishes, click Download logs to save the results.

The results are saved as a ZIP archive that contains one CSV file for each analyzed disk or volume. Each CSV file lists the paths of the files that may contain encrypted data, along with statistics such as the file size and the estimated encryption percentage.

Note

Before you use entropy analysis, consider the following:

Entropy analysis applies only to Encrypted data events.
Entropy analysis is available only in the Veeam Backup & Replication console.
The Download logs option saves the ZIP archive to the machine where the console runs, not to the backup server.