Earlier signal
GuardMode Scan checks mounted file systems for indicators such as high entropy, file signature mismatch, and blocklist patterns.
DPX use case
Proactive Ransomware Protection
Proactive ransomware protection means finding suspicious data early, protecting backup copies from tampering, and restoring from a clean point instead of guessing under pressure.
Know which recovery points are safe
A ransomware response fails when every restore point is suspect. DPX helps teams build a safer process by combining protected backup storage with GuardMode scanning. GuardMode Scan can scan mounted file systems for signs of ransomware infection or malicious encryption before data is restored to production. Scan results help administrators identify suspicious files, review the affected snapshot, move back to earlier snapshots when needed, and choose an earliest clean recovery point. That turns recovery from guesswork into a controlled decision.
Build ransomware recovery into the backup plan
DPX supports a layered ransomware recovery strategy that protects both data and the recovery workflow:
- Scan mounted vStor snapshots with GuardMode before restoring data to production.
- Use automatic GuardMode scanning at the volume level for newly created filesystem snapshots.
- Review suspicious files, entropy results, magic number results, and blocklist pattern matches.
- Combine scan results with immutable vStor snapshots and air-gapped copies for safer recovery.
What proactive protection changes
Ransomware readiness requires a workflow that begins before the attack and continues through restore.
Safer copies
Immutable vStor snapshots and protected replicated copies reduce the chance that attackers can alter or delete recovery data.
Cleaner restore
If a snapshot appears compromised, teams can move to earlier snapshots and scan again until they find a clean recovery point.
Ransomware protection questions
Does DPX detect ransomware inside backups?
GuardMode Scan can scan mounted file systems for potential ransomware infections or malicious encryption. It reports suspicious files and helps administrators decide whether a snapshot should be avoided for restore.
What happens if a scan finds suspicious files?
The safer workflow is to review the results, avoid restoring that snapshot, scan earlier snapshots, and use the earliest clean snapshot for recovery. This helps avoid reintroducing encrypted or malicious data.
How does this connect to immutable storage?
Scanning helps choose a clean recovery point; immutability helps preserve that recovery point. See immutable backup storage for the storage layer behind ransomware-resilient recovery.
Related DPX resources
Learn more about ransomware recovery and data protection with Catalogic DPX.
Catalogic DPX Product Brief
Catalogic DPX product brief: block-level and agentless VM backup, Instant VM Restore, GuardMode ransomware detection, immutable vStor storage, and long-term retention to tape or cloud.
DPX for DataCore Swarm
Product brief: DPX adds an independent, S3-connected backup copy on vStor for DataCore Swarm data, with licensing that scales with deployment size to protect partner margin.
Catalogic DPX for Proxmox VE Datasheet
DPX 4.16 adds agentless Proxmox VE backup to Catalogic's enterprise data protection platform, giving mixed VMware, Hyper-V, and Proxmox estates a single console for backup, recovery, and ransomware resilience.
Prepare for ransomware recovery
See how DPX combines GuardMode scanning, immutable snapshots, and clean restore workflows to support ransomware recovery.
Request Demo