elastioRequest a demo

Elastio Hunt

Know which copy is clean before you need to recover.

Hunt analyzes live data, replicas, and backups for ransomware, malware, and corruption on your chosen schedule. Give your team the evidence to assess recovery copies before they are needed.

Request a demo

Find the clean point before the damage.

Snapshots, replicas, and backups can preserve ransomware damage. Immutability protects a copy from alteration; content analysis helps determine whether it contains threats. Hunt’s recovery history separates affected copies from earlier copies with clean results.

Review the selected copy’s results and age. If no clean point is available, analyze earlier copies. If the clean point is too old, identify the unmet recovery commitment and address the cause. Elastio starts the recovery handoff; your tooling performs the restore.

Make your cyber vault's recovery promise provable. Hunt analyzes vaulted copies read-only for ransomware, malware, and corruption. Give security and recovery teams evidence of which copy is clean, how recent it is, and what was checked.

Explore Cyber Vaults

Illustrative product scenario · example values, not a customer result

Review a ransomware finding and its 75 affected files

A separate finding example from the recovery view above.

CRITICAL

Ransomware Multiple (2 families) detected · 75 files

Asset
i-0bc793d3b1312743f
Detected
2026-10-04T02:37:59.177Z
PathSizeModifiedSHA-256
/part3/file-sample_100kB.doc72.0 KB2024-05-14T07:56:40.000Z—
/part3/file_example_PPT_250kB.ppt149 KB2024-05-14T07:57:40.000Z—
/part3/file_example_XLSX_10.xlsx5.4 KB2024-05-14T07:57:46.000Z—
/part3/file-sample_500kB.docx539 KB2024-05-14T07:57:08.000Z—
/part2/file-sample_1MB.rtf515 KB2024-05-14T07:57:02.000Z—
Read all 75 affected-file records
PathSizeModifiedSHA-256
/part3/file-sample_100kB.doc72.0 KB2024-05-14T07:56:40.000Z—
/part3/file_example_PPT_250kB.ppt149 KB2024-05-14T07:57:40.000Z—
/part3/file_example_XLSX_10.xlsx5.4 KB2024-05-14T07:57:46.000Z—
/part3/file-sample_500kB.docx539 KB2024-05-14T07:57:08.000Z—
/part2/file-sample_1MB.rtf515 KB2024-05-14T07:57:02.000Z—
/part2/file-sample_1MB.docx1003 KB2024-05-14T07:56:56.000Z—
/part2/file_example_XLSX_100.xlsx9.2 KB2024-05-14T07:57:48.000Z—
/part2/file-sample_300kB.rtf127 KB2024-05-14T07:57:04.000Z—
/part3/file_example_PPT_500kB.ppt413 KB2024-05-14T07:57:42.000Z—
/part3/file-sample_100kB.rtf.WNCRY98.5 KB2025-08-01T13:59:22.829Z—
/part2/file_example_XLSX_50.xlsx7.3 KB2024-05-14T07:57:54.000Z—
/part3/file-sample_100kB.docx109 KB2024-05-14T07:56:42.000Z—
/part3/file_example_XLS_10.xls2.0 KB2024-05-14T07:58:02.000Z—
/part3/file_example_XLSX_1000.xlsx41.8 KB2024-05-14T07:57:52.000Z—
/part2/file_example_XLS_5000.xls.WNCRY657 KB2025-08-01T13:59:22.304Z—
/part3/file-sample_500kB.odt596 KB2024-05-14T07:57:10.000Z—
/part2/file_example_XLSX_10.xlsx5.4 KB2024-05-14T07:57:46.000Z—
/part2/file-example_PDF_1MB.pdf985 KB2024-05-14T07:56:36.000Z—
/part2/file_example_XLS_50.xls3.8 KB2024-05-14T07:58:10.000Z—
/part2/file_example_ODS_10.ods30.7 KB2024-05-14T07:57:22.000Z—
/part2/file_example_XLSX_1000.xlsx41.8 KB2024-05-14T07:57:52.000Z—
/part3/file_example_PPT_1MB.ppt892 KB2024-05-14T07:57:36.000Z—
/part2/file_example_PPT_1MB.ppt892 KB2024-05-14T07:57:36.000Z—
/part2/file-sample_100kB.docx109 KB2024-05-14T07:56:42.000Z—
/part2/file_example_XLS_5000.xls151 KB2024-05-14T07:58:12.000Z—
/part3/file_example_ODP_200kB.odp196 KB2024-05-14T07:57:18.000Z—
/part3/file_example_ODS_100.ods67.0 KB2024-05-14T07:57:28.000Z—
/part3/file_example_XLS_50.xls3.8 KB2024-05-14T07:58:10.000Z—
/part3/file-sample_1MB.doc952 KB2024-05-14T07:56:54.000Z—
/part2/file_example_ODP_200kB.odp196 KB2024-05-14T07:57:18.000Z—
/part3/file_example_ODP_1MB.odp949 KB2024-05-14T07:57:16.000Z—
/part3/file-sample_100kB.odt113 KB2024-05-14T07:56:46.000Z—
/part2/file_example_XLS_100.xls5.4 KB2024-05-14T07:58:04.000Z—
/part2/file-sample_100kB.doc72.0 KB2024-05-14T07:56:40.000Z—
/part3/file-sample_500kB.rtf238 KB2024-05-14T07:57:12.000Z—
/part2/file_example_ODS_5000.ods231 KB2024-05-14T07:57:34.000Z—
/part3/file-sample_1MB.rtf515 KB2024-05-14T07:57:02.000Z—
/part3/file-sample_100kB.rtf39.8 KB2024-05-14T07:56:48.000Z—
/part3/file-example_PDF_500_kB.pdf449 KB2024-05-14T07:56:38.000Z—
/part2/file-sample_100kB.rtf39.8 KB2024-05-14T07:56:48.000Z—
/part2/file-sample_500kB.doc452 KB2024-05-14T07:57:06.000Z—
/part2/file-sample_500kB.odt596 KB2024-05-14T07:57:10.000Z—
/part3/file-sample_300kB.rtf127 KB2024-05-14T07:57:04.000Z—
/part2/file-sample_1MB.doc952 KB2024-05-14T07:56:54.000Z—
/part2/file_example_XLSX_5000.xlsx185 KB2024-05-14T07:57:58.000Z—
/part3/file-sample_150kB.pdf135 KB2024-05-14T07:56:52.000Z—
/part3/file-sample_1MB.docx1003 KB2024-05-14T07:56:56.000Z—
/part3/file_example_XLSX_50.xlsx7.3 KB2024-05-14T07:57:54.000Z—
/part3/file_example_ODS_5000.ods231 KB2024-05-14T07:57:34.000Z—
/part3/file-example_PDF_1MB.pdf985 KB2024-05-14T07:56:36.000Z—
/part3/file_example_XLS_100.xls5.4 KB2024-05-14T07:58:04.000Z—
/part3/file-sample_1MB.odt1008 KB2024-05-14T07:56:58.000Z—
/part3/file_example_ODS_1000.ods93.8 KB2024-05-14T07:57:32.000Z—
/part2/file-sample_500kB.rtf238 KB2024-05-14T07:57:12.000Z—
/part2/file-sample_500kB.docx539 KB2024-05-14T07:57:08.000Z—
/part2/file_example_ODS_100.ods67.0 KB2024-05-14T07:57:28.000Z—
/part2/file_example_XLS_10.xls2.0 KB2024-05-14T07:58:02.000Z—
/part2/file-sample_100kB.odt113 KB2024-05-14T07:56:46.000Z—
/part2/file_example_ODP_500kB.odp466 KB2024-05-14T07:57:22.000Z—
/part3/file_example_XLS_1000.xls32.4 KB2024-05-14T07:58:06.000Z—
/part2/file-sample_1MB.odt1008 KB2024-05-14T07:56:58.000Z—
/part2/file_example_XLS_1000.xls32.4 KB2024-05-14T07:58:06.000Z—
/part3/file_example_XLSX_100.xlsx9.2 KB2024-05-14T07:57:48.000Z—
/part2/file_example_ODS_1000.ods93.8 KB2024-05-14T07:57:32.000Z—
/part3/file_example_ODP_500kB.odp466 KB2024-05-14T07:57:22.000Z—
/part3/file_example_XLS_5000.xls151 KB2024-05-14T07:58:12.000Z—
/part2/file_example_PPT_250kB.ppt149 KB2024-05-14T07:57:40.000Z—
/part3/file_example_XLSX_5000.xlsx185 KB2024-05-14T07:57:58.000Z—
/part3/file-example_PDF_1MB.pdf.WNCRY1018 KB2025-08-01T13:59:22.478Z—
/part2/file-example_PDF_500_kB.pdf449 KB2024-05-14T07:56:38.000Z—
/part2/file-sample_150kB.pdf135 KB2024-05-14T07:56:52.000Z—
/part2/file_example_ODP_1MB.odp949 KB2024-05-14T07:57:16.000Z—
/part3/file_example_ODS_10.ods30.7 KB2024-05-14T07:57:22.000Z—
/part2/file_example_PPT_500kB.ppt413 KB2024-05-14T07:57:42.000Z—
/part3/file-sample_500kB.doc452 KB2024-05-14T07:57:06.000Z—
Original finding export · October 4, 2026. Evidence values unchanged. SHA-256 values were not supplied. This finding and the fin-etl-04 recovery view are separate examples.

Check for infection, damage, and sensitive data.

Five built-in hunts examine the data:

Ransomware detection. Find known and zero-day ransomware, including variants with no known-family match.

Encryption detection. Find suspicious encryption and corruption caused by ransomware, destructware, or insider tampering.

Malware detection. Match known malware signatures, including threats inside archives.

File-system integrity. Identify corruption or tampering that could make a recovery copy unusable.

Data classification. Identify personal, health, and payment-card information, plus credentials, to help assess impact and prioritize response.

Find ransomware that signatures alone miss.

Three models work together: recognize researched families, detect unfamiliar variants, and identify encryption spread across successive copies.

See how we measure What is recovery intelligence?

DATA AND RECOVERY COPIESThree ways to find ransomware
  1. 01DETERMINISTIC

    Recognize known ransomware

    Matches files against reverse-engineered, detonated ransomware families.

    More than 2,300 families · 10,000 variants

  2. 02ZERO-DAY RANSOMWARE MODEL · ZDR

    Find variants never seen before

    Finds known and unknown ransomware, including variants that match no known family.

    Unseen familiesHunt model evaluationFamilies and variants not used in training

  3. 03TEMPORAL

    Find encryption spread over time

    Compares successive copies to detect gradual and obfuscated encryption across hours or weeks.

    1. Earlier copy
    2. Later copy
    3. Latest copy
File-level findings and recovery evidence
Hunt model evaluation is separate from Pursuit investigation. Review the benchmark protocol, held-out sample counts, model version, and exclusions with the Elastio team.See methods and measurement definitions

Hunt for threats specific to your environment.

Look for exposed AWS keys, webshells, ransom notes, or scripts that inhibit recovery. Create a Custom Hunt Rule or adapt an Elastio rule.

Use Structural Query (SQL), Content Signature (YARA), and Pattern Match (RegEx) as applicable to the Hunt Rule. Tune the rule, then activate it through a policy. Matches become findings for your security team.

Explore the Custom Hunt Rule example

Explore environment-specific rules and their YARA references.

Build the evidence for provable recovery.

Each completed Hunt adds a detection or clean result to the history. Review scope, completion, and time. Missing or partial analysis is not a clean result.

A clean result means no threats were detected by the completed checks on that copy, within the recorded scope and analysis time. For supported system copies, review Pursuit’s compromise investigation as well as Hunt’s data analysis. Review copy age and protection requirements before recovery.

AI Attack Readiness adds protection requirements and clean-copy age against business commitments. Your team validates applications after the restore.

Explore Pursuit Explore AI Attack Readiness

ONE COPY / TWO RESULTS
Pursuit
No attack found in the system
Hunt
No ransomware found in the data

Recovery evidenceFor the copy, scope, and analysis time

Review completed Hunt checks and clean-result history

No open threats across the listed Hunt checks. Four violations remain. This screen does not show a Pursuit result.