<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Implementing Ransomware Recovery Procedures — API Reference

## Veeam PowerShell Recovery

```powershell
# List available restore points
Get-VBRBackup -Name "Daily-Servers" | Get-VBRRestorePoint |
  Sort-Object CreationTime -Descending | Select-Object -First 10

# Start file-level restore
Start-VBRWindowsFileRestore -RestorePoint $rp -Reason "Ransomware recovery"

# Start full VM restore
Start-VBRRestoreVM -RestorePoint $rp -Server $esxi -Folder "Recovery"

# Instant VM recovery (fast RTO)
Start-VBRInstantRecovery -RestorePoint $rp -VMName "srv-critical"
```

## Restic Restore Commands

```bash
# List available snapshots
restic -r /backup/repo snapshots

# Restore latest to isolated path
restic -r /backup/repo restore latest --target /restore/isolated/

# Restore specific snapshot
restic -r /backup/repo restore abc123 --target /restore/srv01/

# Restore specific files only
restic -r /backup/repo restore latest --target /restore/ \
  --include "/etc/" --include "/var/lib/mysql/"
```

## ClamAV Scanning

```bash
# Scan backup before restore
clamscan -r --infected --log=scan.log /backup/latest/

# Update signatures first
freshclam

# Scan with all signatures
clamscan -r --infected --detect-pua=yes /backup/latest/
```

## Credential Rotation

```powershell
# Reset krbtgt (MUST do twice, wait for replication between)
Reset-KrbtgtKeyInteractive -Force

# Reset all user passwords
Get-ADUser -Filter * | Set-ADUser -ChangePasswordAtLogon $true

# Reset service accounts
Get-ADUser -Filter {ServicePrincipalName -ne "$null"} |
  ForEach-Object { Set-ADAccountPassword $_ -Reset }
```

## Key Parameters

| Parameter | Description | Example |
|-----------|-------------|---------|
| `backup_path` | Backup location to validate | `/backup/latest/srv01` |
| `rto_target` | Recovery time objective | `4h` |
| `rpo_target` | Recovery point objective | `24h` |
| `tier` | Recovery priority tier | `0` (immediate) |
