Working with Ransomware Rollback

• Quick and efficient recovery: Ransomware Rollback swiftly restores files to their original state, minimizing downtime and enabling users to regain access to their documents.
• Lightweight and non-intrusive: The application operates seamlessly in the background without causing noticeable performance degradation or disruptions to daily operations.
• Custom minifilter driver for enhanced protection: By using a custom minifilter driver, Ransomware Rollback avoids reliance on Windows Shadow Copy, which is often targeted by ransomware attacks, ensuring a higher level of protection.
• Comprehensive ransomware detection: Our integrated ransomware detection feature enables the solution to work in tandem with the rollback mechanism for maximum effectiveness. The Rollback service also powers Enhanced Ransomware Detection. Refer to Working with Enhanced Ransomware Detection.
• Scalability: This solution is suitable for businesses of all sizes, ensuring that data remains protected no matter the scale of the organization.
• Robust file deletion handling: The handling of file deletions, through the creation of hard links in a tracking directory, ensures that users can quickly restore deleted files, even in the case of accidental removal.
• Application compatibility: Ransomware Rollback works with most host-based applications, including simpler file-based database applications such as QuickBooks and SQLite. Live files of complex database engines are deliberately not tracked. Refer to "How does this solution handle database applications...?" in the FAQs.

• Minimize downtime: Quickly recover from ransomware attacks, reducing the impact on productivity for your organization.
• Enhance business continuity: By enabling the rollback of critical files, our solution helps maintain business continuity, ensuring that essential operations can continue even in the face of a ransomware attack.
• Save costs: Recovering from ransomware attacks can be expensive, involving not only the potential ransom payment but also the costs of data recovery and IT support. Ransomware Rollback can help mitigate these expenses by streamlining the recovery process.
• Improve your security posture: Adding rollback functionality to your endpoint protection provides an additional layer of protection to your existing security measures, bolstering your organization's overall security posture and resilience against ransomware threats.
• Simplify the recovery process: Ransomware Rollback enables you to perform targeted rollbacks based on specific ransomware processes or time frames, making the recovery process more straightforward and efficient.
• Integrate with ease: Our solution works seamlessly with supported Windows client and server operating systems. It also integrates with the EDR portal, ensuring easy adoption and implementation for a wide range of businesses.
• Customize resource allocation: Because you can adjust disk space allocation for the ransomware rollback driver, you can tailor the solution to your specific needs, optimizing resource usage and efficiency.
• Feel confident: Knowing that your organization has an additional layer of protection against ransomware attacks provides peace of mind and a sense of security, enabling you to focus on your core business operations.

Ransomware Rollback is supported on Windows 10 and above and Windows Server 2012 and above, on x64, x86, and ARM64 architectures. Operating system support is the same for Enhanced Ransomware Detection and full (File Recovery) monitoring.

We do not recommend installing Ransomware Rollback on database, domain controller, Exchange, or Active Directory servers. These types of endpoints generate very high amounts of reads and writes to the disk, which may impact host performance. Instead, use a solution specifically designed to protect complex application servers, such as Datto BCDR's Rapid Rollback.

For more information, see Hardware and operating system requirements.

NOTE  Ransomware Rollback does not track changes on virtual disk images or virtual machine state files, including Hyper-V, and VirtualBox image formats (AVHDX, AVHD, VHD, VHDX, VDI, VMRS, VMCX, VMGS). USB-attached drives and FAT32-formatted volumes are also not tracked, even if Windows reports them as fixed drives.

Before you can start protecting your endpoints with Ransomware Rollback, your environment must meet the following criteria:

• You must have an active Datto EDR subscription.
• The Datto Endpoint Security agent must be installed on all endpoints you wish to monitor, and those devices must be able to communicate with your EDR instance.
• Ransomware detection must be enabled and configured. For more information, refer to Ransomware configuration options.

Procedure

To deploy the rollback agent and Rollback Driver Desktop application to your monitored endpoints, you'll need to enable a File Recovery option in your ransomware policy. Perform the following steps to do so.

IMPORTANT  If your endpoint requires managed reboots or must adhere to specific update policies, refer to the Managing Ransomware Rollback installation and updates section of this article for important information.

1. Navigate to the Policies page and locate your ransomware policy. Ensure that it is enabled. To learn how to do so, refer to Working with the Policies page.

2. Click the name of your ransomware policy to open its Edit Policy page.

3. Review the Details, Detection, and Response sections of the page. Make any configuration changes necessary. For feature definitions, refer to Ransomware monitoring options.

4. Scroll down to File Recovery and click the Full Disk Tracking OR Folders & Extensions toggle to activate Ransomware Rollback. Doing so automatically begins the deployment process of the rollback agent's components to all monitored and supported Windows endpoints.
   
5. Make any desired customizations to the cache configuration of the rollback agent. Review File Recovery options for details about the available options.
   

6. Once you've finished configuring your ransomware policy, click Save.

7. To verify that the rollback agent has successfully deployed to your endpoints, log into any protected system and check for the Rollback Desktop application in the Windows Start Menu (under the Datto folder) and in the Apps section of the Settings control panel.

NOTE  If the Enhanced detection option is selected in your ransomware policy, the rollback agent components are deployed even when File Recovery is set to Disable. In this configuration, the agent runs in a low-overhead monitoring mode that powers Enhanced Ransomware Detection. No file history is kept and file recovery is not available. Refer to Working with Enhanced Ransomware Detection.

Agent components

During the installation of the rollback agent, the following components are added to each protected system:

• Kernel minifilter driver (cbfilter24.sys)

• Datto Rollback Driver Service (Windows service)

• Datto Rollback Status, Datto Rollback Updater, and Datto Rollback Autorepair scheduled tasks (in the Datto\Datto Rollback Driver task folder)

• Rollback Driver Desktop application and Start Menu shortcut (Rollback Desktop, under the Datto folder)

• Program files at %ProgramFiles%\Datto\Datto Rollback Driver and logs at %SYSTEMDRIVE%\ProgramData\Datto\Datto Rollback Driver\Logs

• Cache folder at %SYSTEMDRIVE%\$.td and in the root directory of any additional tracked volumes

These resources are critical to the monitoring and protection of the endpoint's file system. The cache folder is hidden and protected by the driver. It cannot be opened or modified directly, including by administrators.

The rollback agent and its management application must be installed on all endpoints that you'd like to be able to restore. Once you've installed them, a link to the Rollback Driver Desktop application will become available in the Windows Start Menu. When you launch the program, you'll see the following features and fields.

Header menu
Feature	Definition
Drive	Volume filter; shows the alerts, history, and recovery options for each logical drive on the endpoint
	Refresh the current view
	Application is functioning without issue and connected to rollback system service
	Show Rollback Driver Desktop version information

Overview

We are continuously improving the Datto Rollback agent and Rollback Driver Desktop application. It will automatically update when a new release is available. You do not need to take any action to keep the endpoint software current. However, should you wish to manage the delivery of these updates, the following sections of this article will assist you in doing so.

Update types

Ransomware Rollback integrates deep within the Windows kernel. We may occasionally release updates that require a system reboot to complete the installation. We classify our updates as minor and major.

Minor updates are for bug fixes, performance updates, and other infrastructure enhancements that are part of the continuous improvement cycle of the solution. On average, we will release a minor update every four to eight weeks. Minor updates are silent, always installed, and happen in the background without any pop-ups or visible effect on screen.

Major updates may require a reboot of the host for the installation to finalize, because the underlying kernel minifilter driver cannot be replaced while it is loaded. Any update that will require a reboot will be announced in your Datto EDR instance at least one month in advance to enable you to schedule appropriate maintenance windows. Normally, we only release one major update per year. When a reboot is required to finalize a driver update, the update is deferred and completes at the endpoint's next restart. Rebooting during your normal maintenance window is recommended.

Major updates are installed if the following conditions are met:

• The HKEY_LOCAL_MACHINE\SOFTWARE\Datto\DisableRollbackReboot = TRUE Windows Registry value is not set; or...

• The --forceupdate command line switch is specified when running the updater.

When minor and major updates take place, the Datto Rollback Driver Service restarts. When an update requires a reboot to finalize, the updater creates a RestartFlag value under HKEY_LOCAL_MACHINE\SOFTWARE\Datto\RollbackDriver in the endpoint's Windows Registry. The value records the time the reboot was requested and is cleared automatically once the reboot completes.

Datto Rollback Updater scheduled task

Datto Rollback uses the Datto Rollback Updater scheduled task, which runs every three hours, to check for and download updates. The updater utility resides on protected endpoints at %\ProgramFiles%\Datto\Datto Rollback Driver\updater.exe.

IMPORTANT  If you disable this task, be sure to run Ransomware Rollback's updater.exe during your scheduled maintenance window to ensure that the latest patches and fixes are applied.

As described in the previous section of this article, the Datto Rollback Updater will set the RestartFlag Windows Registry value if it determines that a reboot is required to finalize an update. If you are updating during a service window, the presence of the flag enables you to know whether a reboot is actually required. Once the reboot completes, the RestartFlag clears.

Controlling Ransomware Rollback installation

If you do not want Ransomware Rollback installed on certain devices, you can avoid installation by creating a string value named DisableRollbackInstall within \HKEY_LOCAL_MACHINE\SOFTWARE\Datto\EDR in the registry and setting its value to 1. This also applies to endpoints monitored by a policy with the Enhanced detection option enabled.

If Ransomware Rollback has been installed on a device and you need to uninstall it while the policy is enabled, insert the value as instructed and the EDR agent will uninstall Ransomware Rollback. This value also blocks automatic reinstallation.

Controlling major Ransomware Rollback updates

If you'd like to prevent Datto EDR from installing major Ransomware Rollback updates while allowing minor updates to be applied, perform the following steps:

1. Set the following Windows Registry string value on the applicable endpoint: \HKEY_LOCAL_MACHINE\SOFTWARE\Datto\DisableRollbackReboot=TRUE. Doing so instructs updater.exe to skip major updates. Minor updates will continue to install.

2. Reboot the system to ensure that the registry change takes effect.

   

Controlling all Ransomware Rollback updates

If you'd like to prevent Datto EDR from installing any Ransomware Rollback updates on a system until you're ready to do so, perform the following steps on the applicable endpoint:

1. Disable the Windows scheduled task called Datto Rollback Updater (located in the Datto\Datto Rollback Driver task folder). Doing so prevents all automated updates.

2. During your service window, from an elevated Command Prompt or PowerShell session, run updater.exe --forceupdate, which will download and install any available updates, minor and major, including major updates on systems where DisableRollbackReboot is set.

3. At the end of your service window, reboot the endpoint to finalize the update if the RestartFlag registry value is present.

1. Navigate to the Alerts page by clicking Alerts in the top navigation menu.

2. The page will load. Locate the ransomware alert to which you'd like to respond and click its name.

3. The Alert Detail page loads.
   

4. To perform file rollback directly from the Alert Detail page:
   1. Click Rollback.
   2. In the Rollback dialog box, select one of the following options to recover and restore files:
      • Recover to Original Files & Paths: (Selected by default). Restores all encrypted and deleted files for the selected alert to their original file paths.
      • Recover defined path: Restores all encrypted and deleted files for the selected alert to the file path you specify.
   3. In the Rollback dialog box, click Rollback.
      The system automatically logs a comment on the alert with the timestamp and initiating user to maintain auditability.

5. To perform file rollback using the Rollback Driver Desktop application, proceed to the next section of this article.

1. Using an administrator-level account, log in to the endpoint with the host name you identified in the previous section of this article. If the machine has been isolated from the network and you need to access it remotely, you can do so from your Datto RMM platform.

2. Launch the Rollback Driver Desktop application and navigate to the Ransomware Alert tab.

3. Click the alert that corresponds to the Alert Time value you recorded from Datto EDR.

4. Ensure that the Extension value shown in Rollback Driver Desktop matches the Extension value from Datto EDR.
   

5. Review the impact of the ransomware attack by using the information provided by each of the application's tabs. If you chose to protect multiple volumes on the endpoint, be sure to repeat the process for each logical drive shown in the Drive drop-down.

6. When you're ready to take corrective action, you can click the Rollback button on the Process History tab or the File History tab to undo all file-level changes identified in the alert. If you'd prefer to take a more granular approach to recovery, you can use the options described in the Rollback Driver Desktop features section of this article to do so.

7. Once you've recovered your lost or compromised files, copy all business-critical data on the machine to a backup appliance, removable media, or NAS share.

8. Re-image the endpoint if you suspect that it still contains remnants of ransomware.

9. Restore all business-critical files to the machine.

Ransomware Rollback is a software agent that tracks changes made to files on a user's disk and provides a rollback mechanism to restore the original files if they become compromised by ransomware.

NOTE  Ransomware Rollback does not track changes on virtual disk images, including Hyper-V, VirtualBox, and Windows hard disk image files, including AVHDX, AVHD, VHD, VHDX, and VDI.

Our solution intercepts file system calls made by applications and performs lightweight tracking of the changes made. It uses a custom minifilter inside Microsoft's file I/O stack in Windows, a system service for tracking changes and performing rollbacks, and a desktop application for user interaction.

No, it focuses on tracking user documents rather than the entire system. It does not track changes to the Windows directory, Program Files, ProgramData, or per-user AppData folders.

While Ransomware Rollback is compatible with most host-based applications, it may conflict with applications that write or update a large volume of files. In the event that rollback impacts an application, we recommend creating an exclusion for the folder. Refer to How do I enable support for folder exclusions?

Ransomware Rollback restores files individually to their state at a selected point in time. Because it restores each file independently, it is not suitable for recovering complex databases.

Databases remain consistent only when their data files and transaction logs (such as redo logs or WAL files) are synchronized at the same internal recovery point. The database engine determines and manages these consistency points. Restoring database files to an arbitrary file system snapshot can create a mismatched or incomplete database state. As a result, the database engine may fail to mount the database or identify it as corrupted.

For this reason, Ransomware Rollback deliberately does not track or roll back the live files of running database engines, including Microsoft SQL Server, Oracle, PostgreSQL, MySQL/MariaDB, MongoDB, Mimer SQL, and Microsoft ESE/JET databases (Exchange, Active Directory). Attempting a file-level rollback of these would risk corrupting the database rather than recovering it.

Databases should instead be protected at the application layer, using database-native or VSS-aware (application-consistent) backups, which capture the database at an engine-consistent point. Ransomware Rollback continues to protect those backup files (for example, .bak, .trn, and dump files) which restore cleanly and are the files ransomware is most likely to reach.

Ransomware Rollback continues to support simpler file-based databases, such as QuickBooks and SQLite, saving the data being written on an operation-by-operation basis so that the update can be rolled back if it is compromised by ransomware.

Yes, ransomware detection is integrated with this solution, enabling the two to work together.

Yes. The Rollback service also powers Enhanced Ransomware Detection. When the Enhanced detection option is enabled in a ransomware policy, the Rollback service components are deployed to monitored endpoints even if File Recovery is set to Disable. In this case, the service runs in a low-overhead monitoring mode that provides process telemetry for detection but does not keep file history or enable recovery. Refer to Working with Enhanced Ransomware Detection.

No, our agent does not rely on Windows shadow copy, which is often targeted by ransomware attacks. Instead, it uses a custom minifilter to track file changes independently.

Yes, you can monitor the tracked changes through the included desktop application.

Upon a file's deletion, Ransomware Rollback creates a hard link to the file in a tracking directory while the original deletion operation proceeds. Doing so allows for easy restoration of the deleted file.

Yes, you can initiate a rollback manually through the desktop application or remotely from the Alert Detail page in the EDR portal.

Ransomware Rollback is supported on Windows 10 and above and Windows Server 2012 and above, ensuring a wide range of businesses can benefit from this added layer of protection.

No, the solution does not replace regular backup procedures. Instead, it serves as an additional layer of protection, enabling the rollback of critical files modified by ransomware attacks to ensure business continuity.

You can monitor ransomware alerts through the Endpoint Detection and Response (EDR) portal. To initiate a rollback, you can use the dedicated desktop application, which allows for targeted rollbacks based on the specific ransomware process or a specified timeframe (e.g., rolling back all changes made within the last four hours).

Yes. You'll need to allocate disk space for the ransomware rollback driver to intercept file operations and keep a copy of changes. By default, we reserve 5% of disk space for this purpose. However, you can adjust the quota based on your specific needs.

The rollback application's installation is approximately 10 megabytes in size.

The solution attempts to keep a history of changes for seven days. The duration may be shorter if there is heavy disk activity or a ransomware attack occurs.

Ransomware Rollback does not rely on snapshots. Instead, it continuously records all changes on the disk as they happen in real-time.

Even if a ransomware attack goes undetected, Ransomware Rollback is still recording the changes to the disk, which means you can roll them back and recover your files.

No, for these types of servers, you should use a solution like Datto BCDR's Rapid Rollback, which is designed to protect complex application servers.

Any program running on the background uses resources on the machine. The resources used are as follows:

• CPU: We only use the CPU when there is I/O activity. Utilization will always be 0% unless file activity takes place. Then, the general overhead is relatively low but measurable under stress tests. File operations will occur in milliseconds. There is no installation indexing happening or periods when the agent actively scans your files; instead, it applies all overhead to file activity instead.

• Memory: The service uses between 60 to 200 megabytes of RAM. Memory usage can vary based on the device's activity levels. As a safeguard, the service monitors its own memory usage and will restart itself if usage remains abnormally high for a prolonged period.

• Disk space: We default the cache to 5% of the volume size. You can adjust this allocation in the agent settings. By default, Ransomware Rollback preserves up to seven days of activity. If that seven-day period will consume more than 5%, the agent will preserve a shorter window of time. The rollback agent will only use the maximum allocation if it is necessary for storing the entire history. If the recorded history requires less storage, the agent will reserve less space.
  

  NOTE  Using up free space on the disk while simultaneously deleting files can result in additional, unexpected storage consumption. This phenomenon is due to the rollback agent attempting to preserve the deleted files while also recording any additional files being created. It is important that you observe good storage management practices for any endpoint protected by the rollback agent.

• Network traffic: Ransomware Rollback uses minimal network traffic. We periodically upload diagnostic information so that we can improve the solution.

No. The cache folder for each volume cannot be moved.

Ransomware Rollback supports multiple volumes and folder exclusions. Exclusions can be configured at the folder level only. Rollback file tracking on additional connected drives and optional folder blocklisting facilitate expanded granular control over the data you'd like to protect. Configurable from your ransomware policy, this feature delivers improved protection for endpoints that perform large numbers of read and write operations.

Clicking the settings icon in Rollback Driver Desktop allows you to enter folders to be excluded.

Exclusion examples:

• C:\Users\admin\A1
• C:\Users\admin\D2
• C:\Central

A minifilter is a small software component that works within your computer's file system. Its primary purpose is to monitor and sometimes modify how the operating system and applications access, read, and write files. For example, a minifilter might prevent unauthorized access to sensitive files or automatically encrypt certain types of files before they are saved to disk. In the context of a ransomware rollback solution, a minifilter is responsible for tracking changes made to files, allowing the system to revert those changes if a ransomware attack is detected.

Set File Recovery to Disable in the Ransomware Protection policy. Then, the EDR agent service (HUNTAgent) must be restarted on the device. While the service typically restarts upon system reboot, an administrator could manually restart it if waiting for a reboot is not feasible. When the policy no longer requires the rollback agent, the EDR agent uninstalls the Rollback service components from the endpoint.

NOTE  If tamper protection is enabled, a reboot will be required to restart the EDR agent.

NOTE  If the Enhanced detection option remains selected in the policy, the rollback agent components remain installed and continue to run in a low-overhead monitoring mode to support enhanced detection. To remove the rollback agent entirely, switch the detection option to Standard, or use the DisableRollbackInstall registry value described in the section "Controlling Ransomware Rollback installation."