License editions: To understand the applicable license editions, see Plans & Pricing.
Overview
When you have identified a set of malicious files doing rounds in your organization, you can add the SHA1 value of those files so that Druva scans the data for those hash values. Whenever Druva finds a match, it will block the file from being restored.
❗ Important
Restore scan is not supported for files beyond 1 GB in size.
Add a SHA1 value that you want Druva to scan
From the Druva Cloud Platform Console, go to Global Navigation menu -> Ransomware Recovery.
On the left pane, click the Restore Scan > Settings tab.
In the Indicators - File Hashes section, click Add File Hashes.
Add the file hashes and click Save.
If you want to add multiple SHA1 hash values, then use the Import CSV option.
Delete a SHA1 value from the list
From the Druva Cloud Platform Console, go to Global Navigation menu -> Ransomware Recovery
On the left pane, click the Restore Scan > Settings tab.
In the Indicators - File Hashes section, select the file hashes that you want to delete.
Click More Options > Delete.
On the Confirm Deletion confirmation pop-up, specify the reason for deletion (the reason is mandatory with a character limit between 10 and 150) and then click Delete. The reason for deletion will be captured in the Audit Trail for auditing purposes.