This article applies to:

Overview

This article provides information about the steps to follow to exclude folders having names starting with $ followed by a hexadecimal string get backed up under C:\Users folder for Windows OS

Problem description

Folders having names starting with $ followed by a hexadecimal string get backed up under C:\Users folder for Windows OS

For example, these type of folders will get backed up -

The above folder got backed up as “All Drives” option is selected as the backup set in the inSync profile.

Hidden folders starting with $ are present in the “C:\” (root) drive and in the "C:\Users\" directory. When the "All Drives" option is selected in the inSync profile, these folders will get backed up.

These hidden folders starting with $ are created by antivirus applications like SentinelOne / Carbon Black - these generate decoy files in new decoy folders, under C:\, C:\Users, and shared folders. The names of the new decoy folders begin with the $ character and are followed by 32 random hex characters.

These are a part of the Enhanced Ransomware Detection feature. You can confirm this with the vendor of the antivirus application that is present on the user's device.

On the same page of Restore Data - Snapshot Viewer, you can validate / verify that there will be other folders under the C:\Users folder and these will be the actual user's folders like Desktop / Documents / Downloads etc.. Where the user's data will be present / backed up as per the inclusions and exclusions.

Resolution

Add a global exclusion in the inSync profile so that the folders starting with $ do not get backed up.

Following global exclusions to add in the inSync profile -

^(Users/[$])

^([$])

Note that any folder name starting with $ will get excluded from the backups due to the above global exclusion.

Reference -

Configure the global exclude list -

https://help.druva.com/en/articles/8702773-configure-the-global-exclude-list