# How do we know a backup is clean before restoring it?

You cannot be certain, but you can reduce the risk considerably. Start with the timeline: from logs, endpoint data and network history, work out when the intrusion actually began, not when the encryption happened, and prefer a restore point from before that date for critical systems. Restore into an isolated environment and scan the result with up-to-date security tools, including the indicators of compromise from your investigation or from the relevant CISA advisory. Look for things that should not be there: new local or domain accounts, scheduled tasks, services and startup items, remote-access tools, and web shells on web servers. Compare the restored configuration against documentation or a known-good copy. Then watch the restored system's network behaviour before trusting it. NetSenX helps here: a restored host that begins regular outbound connections or scans other machines shows up in the alerts, while several quiet days are a useful, though not absolute, sign.

FAQ: [Backups and recovery](https://netsenx.com/en/faq/backups) · https://netsenx.com/en/faq/how-to-know-a-backup-is-clean-before-restoring

## Read next

- https://netsenx.com/en/detect-ransomware-on-the-network
- https://netsenx.com/en/blog/2026-10-24_ransomware-protection

## Related questions

- [Who should be allowed to delete backups?](https://netsenx.com/en/faq/who-should-be-allowed-to-delete-backups)
- [Does NetSenX back up our data?](https://netsenx.com/en/faq/does-netsenx-back-up-our-data)
- [Should we back up the configuration of firewalls, switches and routers?](https://netsenx.com/en/faq/should-we-back-up-network-device-configurations)
- [Is a snapshot a backup?](https://netsenx.com/en/faq/is-a-snapshot-a-backup)
- [What is the 3-2-1 backup rule?](https://netsenx.com/en/faq/what-is-the-3-2-1-backup-rule)