elastioRequest a demo

Elastio Hunt

Know which copy is clean before you need to recover.

Hunt is the recovery intelligence layer for your data and its copies. It continuously analyzes them for ransomware, malware, and damage at the frequency you set, giving your team evidence of which copy is clean before recovery is required.

Request a demo

An attack can survive in your recovery copies.

At stage 6, encryption, attackers change the data. Snapshots, replicas, and backups can preserve that damage. Immutability protects a copy from alteration. It does not prove its contents clean.

At stage 7, recovery, you need evidence of which copy you can restore. Hunt builds that evidence before the incident. Pursuit investigates attacker activity at stages 3–5 to support containment before theft and encryption.

WHERE HUNT FITS

Pursuit · 3 Persistence · 4 Lateral Movement · 5 Exfiltration

HUNT · STAGE 6EncryptionIdentify encrypted and damaged data. New recovery copies can carry that damage.
HUNT · STAGE 7RecoveryEstablish the clean recovery point and review its evidence before restoring.
Stages describe the attack and recovery model. Controls overlap, and attacks can skip stages.

Find the clean point before the damage.

An infected system does not mean every recovery copy is lost. Hunt's recovery history separates copies with threats from earlier clean points.

Review the selected copy’s results and age. If no clean point is available, analyze earlier copies. If the clean point is too old, identify the unmet recovery commitment and address the cause. Elastio starts the recovery handoff; your tooling performs the restore.

Make your cyber vault's recovery promise provable. Hunt analyzes vaulted copies read-only for ransomware, malware, and corruption. Give security and recovery teams evidence of which copy is clean, how recent it is, and what was checked.

Explore Cyber Vaults

Two recent copies contain threats. The recovery window identifies earlier clean points.

Review a ransomware finding and its 75 affected files

A separate finding example from the recovery view above.

CRITICAL

Ransomware Multiple (2 families) detected · 75 files

Asset
i-0bc793d3b1312743f
Detected
2026-10-04T02:37:59.177Z
PathSizeModifiedSHA-256
/part3/file-sample_100kB.doc72.0 KB2024-05-14T07:56:40.000Z—
/part3/file_example_PPT_250kB.ppt149 KB2024-05-14T07:57:40.000Z—
/part3/file_example_XLSX_10.xlsx5.4 KB2024-05-14T07:57:46.000Z—
/part3/file-sample_500kB.docx539 KB2024-05-14T07:57:08.000Z—
/part2/file-sample_1MB.rtf515 KB2024-05-14T07:57:02.000Z—
Read all 75 affected-file records
PathSizeModifiedSHA-256
/part3/file-sample_100kB.doc72.0 KB2024-05-14T07:56:40.000Z—
/part3/file_example_PPT_250kB.ppt149 KB2024-05-14T07:57:40.000Z—
/part3/file_example_XLSX_10.xlsx5.4 KB2024-05-14T07:57:46.000Z—
/part3/file-sample_500kB.docx539 KB2024-05-14T07:57:08.000Z—
/part2/file-sample_1MB.rtf515 KB2024-05-14T07:57:02.000Z—
/part2/file-sample_1MB.docx1003 KB2024-05-14T07:56:56.000Z—
/part2/file_example_XLSX_100.xlsx9.2 KB2024-05-14T07:57:48.000Z—
/part2/file-sample_300kB.rtf127 KB2024-05-14T07:57:04.000Z—
/part3/file_example_PPT_500kB.ppt413 KB2024-05-14T07:57:42.000Z—
/part3/file-sample_100kB.rtf.WNCRY98.5 KB2025-08-01T13:59:22.829Z—
/part2/file_example_XLSX_50.xlsx7.3 KB2024-05-14T07:57:54.000Z—
/part3/file-sample_100kB.docx109 KB2024-05-14T07:56:42.000Z—
/part3/file_example_XLS_10.xls2.0 KB2024-05-14T07:58:02.000Z—
/part3/file_example_XLSX_1000.xlsx41.8 KB2024-05-14T07:57:52.000Z—
/part2/file_example_XLS_5000.xls.WNCRY657 KB2025-08-01T13:59:22.304Z—
/part3/file-sample_500kB.odt596 KB2024-05-14T07:57:10.000Z—
/part2/file_example_XLSX_10.xlsx5.4 KB2024-05-14T07:57:46.000Z—
/part2/file-example_PDF_1MB.pdf985 KB2024-05-14T07:56:36.000Z—
/part2/file_example_XLS_50.xls3.8 KB2024-05-14T07:58:10.000Z—
/part2/file_example_ODS_10.ods30.7 KB2024-05-14T07:57:22.000Z—
/part2/file_example_XLSX_1000.xlsx41.8 KB2024-05-14T07:57:52.000Z—
/part3/file_example_PPT_1MB.ppt892 KB2024-05-14T07:57:36.000Z—
/part2/file_example_PPT_1MB.ppt892 KB2024-05-14T07:57:36.000Z—
/part2/file-sample_100kB.docx109 KB2024-05-14T07:56:42.000Z—
/part2/file_example_XLS_5000.xls151 KB2024-05-14T07:58:12.000Z—
/part3/file_example_ODP_200kB.odp196 KB2024-05-14T07:57:18.000Z—
/part3/file_example_ODS_100.ods67.0 KB2024-05-14T07:57:28.000Z—
/part3/file_example_XLS_50.xls3.8 KB2024-05-14T07:58:10.000Z—
/part3/file-sample_1MB.doc952 KB2024-05-14T07:56:54.000Z—
/part2/file_example_ODP_200kB.odp196 KB2024-05-14T07:57:18.000Z—
/part3/file_example_ODP_1MB.odp949 KB2024-05-14T07:57:16.000Z—
/part3/file-sample_100kB.odt113 KB2024-05-14T07:56:46.000Z—
/part2/file_example_XLS_100.xls5.4 KB2024-05-14T07:58:04.000Z—
/part2/file-sample_100kB.doc72.0 KB2024-05-14T07:56:40.000Z—
/part3/file-sample_500kB.rtf238 KB2024-05-14T07:57:12.000Z—
/part2/file_example_ODS_5000.ods231 KB2024-05-14T07:57:34.000Z—
/part3/file-sample_1MB.rtf515 KB2024-05-14T07:57:02.000Z—
/part3/file-sample_100kB.rtf39.8 KB2024-05-14T07:56:48.000Z—
/part3/file-example_PDF_500_kB.pdf449 KB2024-05-14T07:56:38.000Z—
/part2/file-sample_100kB.rtf39.8 KB2024-05-14T07:56:48.000Z—
/part2/file-sample_500kB.doc452 KB2024-05-14T07:57:06.000Z—
/part2/file-sample_500kB.odt596 KB2024-05-14T07:57:10.000Z—
/part3/file-sample_300kB.rtf127 KB2024-05-14T07:57:04.000Z—
/part2/file-sample_1MB.doc952 KB2024-05-14T07:56:54.000Z—
/part2/file_example_XLSX_5000.xlsx185 KB2024-05-14T07:57:58.000Z—
/part3/file-sample_150kB.pdf135 KB2024-05-14T07:56:52.000Z—
/part3/file-sample_1MB.docx1003 KB2024-05-14T07:56:56.000Z—
/part3/file_example_XLSX_50.xlsx7.3 KB2024-05-14T07:57:54.000Z—
/part3/file_example_ODS_5000.ods231 KB2024-05-14T07:57:34.000Z—
/part3/file-example_PDF_1MB.pdf985 KB2024-05-14T07:56:36.000Z—
/part3/file_example_XLS_100.xls5.4 KB2024-05-14T07:58:04.000Z—
/part3/file-sample_1MB.odt1008 KB2024-05-14T07:56:58.000Z—
/part3/file_example_ODS_1000.ods93.8 KB2024-05-14T07:57:32.000Z—
/part2/file-sample_500kB.rtf238 KB2024-05-14T07:57:12.000Z—
/part2/file-sample_500kB.docx539 KB2024-05-14T07:57:08.000Z—
/part2/file_example_ODS_100.ods67.0 KB2024-05-14T07:57:28.000Z—
/part2/file_example_XLS_10.xls2.0 KB2024-05-14T07:58:02.000Z—
/part2/file-sample_100kB.odt113 KB2024-05-14T07:56:46.000Z—
/part2/file_example_ODP_500kB.odp466 KB2024-05-14T07:57:22.000Z—
/part3/file_example_XLS_1000.xls32.4 KB2024-05-14T07:58:06.000Z—
/part2/file-sample_1MB.odt1008 KB2024-05-14T07:56:58.000Z—
/part2/file_example_XLS_1000.xls32.4 KB2024-05-14T07:58:06.000Z—
/part3/file_example_XLSX_100.xlsx9.2 KB2024-05-14T07:57:48.000Z—
/part2/file_example_ODS_1000.ods93.8 KB2024-05-14T07:57:32.000Z—
/part3/file_example_ODP_500kB.odp466 KB2024-05-14T07:57:22.000Z—
/part3/file_example_XLS_5000.xls151 KB2024-05-14T07:58:12.000Z—
/part2/file_example_PPT_250kB.ppt149 KB2024-05-14T07:57:40.000Z—
/part3/file_example_XLSX_5000.xlsx185 KB2024-05-14T07:57:58.000Z—
/part3/file-example_PDF_1MB.pdf.WNCRY1018 KB2025-08-01T13:59:22.478Z—
/part2/file-example_PDF_500_kB.pdf449 KB2024-05-14T07:56:38.000Z—
/part2/file-sample_150kB.pdf135 KB2024-05-14T07:56:52.000Z—
/part2/file_example_ODP_1MB.odp949 KB2024-05-14T07:57:16.000Z—
/part3/file_example_ODS_10.ods30.7 KB2024-05-14T07:57:22.000Z—
/part2/file_example_PPT_500kB.ppt413 KB2024-05-14T07:57:42.000Z—
/part3/file-sample_500kB.doc452 KB2024-05-14T07:57:06.000Z—
Original finding export · October 4, 2026. Evidence values unchanged. SHA-256 values were not supplied. This finding and the fin-etl-04 recovery view are separate examples.

Check for infection, damage, and sensitive data.

Five built-in hunts examine the data:

Ransomware detection. Find known and zero-day ransomware, including variants with no known-family match.

Encryption detection. Find suspicious encryption and corruption caused by ransomware, destructware, or insider tampering.

Malware detection. Match known malware signatures, including threats inside archives.

File-system integrity. Identify corruption or tampering that could make a recovery copy unusable.

Data classification. Identify personal, health, and payment-card information, plus credentials, to help assess impact and prioritize response.

Find ransomware that signatures alone miss.

Three models work together: recognize researched families, detect unfamiliar variants, and identify encryption spread across successive copies.

See how we measure What is recovery intelligence?

DATA AND RECOVERY COPIESThree ways to find ransomware
  1. 01DETERMINISTIC

    Recognize known ransomware

    Matches files against reverse-engineered, detonated ransomware families.

    More than 2,300 families · 10,000 variants

    99.9995%detection precisionElastio internal benchmark

  2. 02ZERO-DAY RANSOMWARE MODEL · ZDR

    Find variants never seen before

    Finds known and unknown ransomware, including variants that match no known family.

    99.4%zero-day detection efficacyFamilies and variants not used in training

    Fewer than 5 false positives per 10 million benign files. Elastio internal benchmark.

  3. 03TEMPORAL

    Find encryption spread over time

    Compares successive copies to detect gradual and obfuscated encryption across hours or weeks.

    1. Earlier copy
    2. Later copy
    3. Latest copy
File-level findings and recovery evidence
Elastio internal benchmarks.See methods and measurement definitions

Hunt for threats specific to your environment.

Look for exposed AWS keys, webshells, ransom notes, or scripts that inhibit recovery. Create a Custom Hunt Rule or adapt an Elastio rule.

Use read-only SQL to search files, executables, and registry evidence, with optional YARA rules. Tune the rule, then activate it through a policy. Matches become findings for your security team.

Explore environment-specific rules and their YARA references.

Build the evidence for provable recovery.

Each completed Hunt adds a detection or clean result to the history. Review scope, completion, and time. Missing or partial analysis is not a clean result.

A clean data copy can still contain attacker persistence. Hunt finds no ransomware in the data. Pursuit finds no attack in the system. Together, they prove the same copy clean.

AI Attack Readiness adds protection requirements and clean-copy age against business commitments. Your team validates applications after the restore.

Explore Pursuit Explore AI Attack Readiness

ONE COPY / TWO RESULTS
Pursuit
No attack found in the system
Hunt
No ransomware found in the data

Proven cleanFor the copy, scope, and analysis time

Review completed Hunt checks and clean-result history

No open threats across the listed Hunt checks. Four violations remain. This screen does not show a Pursuit result.