# What is isolated or clean-room recovery?

It means restoring systems first into a separate, isolated environment, cut off from the production network and the internet, where they can be checked before they are trusted again. After a ransomware attack you rarely know at first whether the backups contain the attacker's tools or accounts, or whether the attacker still has access to the network. In a clean room, a small set of known-good infrastructure is built from scratch, often with fresh identity services; restored systems are scanned, their accounts and scheduled tasks reviewed and their behaviour observed, and only then are they moved into production. Larger companies prepare such an environment in advance, sometimes with a backup provider's help; smaller ones can plan for a spare server or a cloud account kept for this purpose. The point is not perfection but avoiding the most common recovery failure: restoring straight back into a compromised network and being encrypted a second time.

FAQ: [Backups and recovery](https://netsenx.com/en/faq/backups) · https://netsenx.com/en/faq/what-is-isolated-or-clean-room-recovery

## Read next

- https://netsenx.com/en/detect-ransomware-on-the-network
- https://netsenx.com/en/blog/2026-10-24_ransomware-protection

## Related questions

- [How do we know a backup is clean before restoring it?](https://netsenx.com/en/faq/how-to-know-a-backup-is-clean-before-restoring)
- [Who should be allowed to delete backups?](https://netsenx.com/en/faq/who-should-be-allowed-to-delete-backups)
- [Does NetSenX back up our data?](https://netsenx.com/en/faq/does-netsenx-back-up-our-data)
- [Should we back up the configuration of firewalls, switches and routers?](https://netsenx.com/en/faq/should-we-back-up-network-device-configurations)
- [Is a snapshot a backup?](https://netsenx.com/en/faq/is-a-snapshot-a-backup)