During a ransomware restore: how do we tell which snapshot is still clean?

Attackers often sit quietly inside for days or weeks before encrypting. So yesterday's snapshot isn't automatically clean. Verifying snapshots is real work, but the alternative is restoring already-infected data.

Try this first

1. 1Establish the timeline first using SIEM, EDR or access logs. When was the first suspicious behaviour (lockouts, lateral movement, new processes) seen? That moment minus 1 day is your starting point.
2. 2Mount that snapshot read-only on an isolated network. Don't restore straight to production, that's exactly what the attacker hopes for.
3. 3Scan with an independent anti-malware tool (Defender Offline, Kaspersky, Bitdefender) and an EDR that hasn't run on this data before. 0 hits is a first signal, not a guarantee.
4. 4Check IoCs: new AD accounts, scheduled tasks, services, registry run keys, persistent RAT binaries in temp folders. If present, go one snapshot earlier.
5. 5Verify integrity of critical config: AD replication, GPOs, DNS records. A backup of a corrupted AD is corrupted AD.
6. 6Document which snapshot you picked and why. That's worth gold later for insurance, audit and your own learning.

None of the above fits?

Describe your situation below. We pass your input plus the steps you already saw to our AI and return tailored next-step advice. If it's too risky to DIY, we'll say so.