{"id":32685,"date":"2026-10-07T18:13:11","date_gmt":"2026-10-07T16:13:11","guid":{"rendered":"https:\/\/eu.wedoback.com\/?page_id=32685"},"modified":"2026-10-07T18:37:18","modified_gmt":"2026-10-07T16:37:18","slug":"what-to-do-if","status":"publish","type":"page","link":"https:\/\/eu.wedoback.com\/en\/guides\/what-to-do-if\/","title":{"rendered":"What to do if\u2026: the right steps during an incident"},"content":{"rendered":"\t\t
\n\t\t\t\t
\n\t\t
\n\t\t
\n\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Home<\/a>\u203a<\/span>Guides<\/a><\/p>

6 guides<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t

What to do if\u2026: the right steps during an incident<\/h1>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Server down, ransomware, missing file, emptied mailbox: the steps in the right order, before you restore anything.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t
\"A<\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t
My server is down: what should I do?<\/b>Isolate the failure, check the data, find the last clean restore point, restore, then decide whether this server belongs in your DRP.<\/span><\/a>Ransomware has just struck<\/b>Disconnect the affected machines, do not pay on the spot, do not reformat, and look for a backup that predates the intrusion.<\/span><\/a>A file or folder has disappeared<\/b>Check the recycle bin and local versions first, then restore the most recent backup point that still contains a sound copy of the file.<\/span><\/a>A mailbox has been emptied or hacked<\/b>Revoke sessions and forwarding first, then restore the mailbox to a date before it was emptied. Restoring without stopping the leak achieves nothing.<\/span><\/a>The NAS is not responding<\/b>Tell an unreachable NAS apart from one whose disks have died. Restore from the external copy, not from the RAID on the same device.<\/span><\/a>Last night’s backup failed<\/b>One failed night can be caught up. Several failed nights wipe out your stated RPO. Fix the cause the same day and check again the next morning.<\/span><\/a><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t
<\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
\n\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Dealing with an incident right now?<\/h2>

Our teams help you identify the right copy and restore it, Monday to Friday, 9 am to 1 pm and 2 pm to 5:30 pm (Paris time).<\/p>

Call +33 9 72 50 78 28<\/a>Write to the team<\/a><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"","protected":false},"author":1,"featured_media":0,"parent":32684,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"elementor_header_footer","meta":{"_seopress_titles_title":"What to do if\u2026: the right steps in an incident | WeDoBack","_seopress_titles_desc":"Server down, ransomware, missing file, emptied mailbox: the steps in the right order, before you restore anything.","_seopress_robots_index":"","_seopress_robots_follow":"","_seopress_robots_imageindex":"","_seopress_robots_snippet":"","_seopress_robots_primary_cat":"","_seopress_robots_breadcrumbs":"","_seopress_robots_freeze_modified_date":"","_seopress_robots_custom_modified_date":"","_seopress_robots_canonical":"","_seopress_social_fb_title":"","_seopress_social_fb_desc":"","_seopress_social_fb_img":"https:\/\/www.wedoback.com\/wp-content\/uploads\/sites\/6\/2026\/10\/wdb-og-que-faire-si.jpg","_seopress_social_fb_img_attachment_id":0,"_seopress_social_fb_img_width":0,"_seopress_social_fb_img_height":0,"_seopress_social_twitter_title":"","_seopress_social_twitter_desc":"","_seopress_social_twitter_img":"https:\/\/www.wedoback.com\/wp-content\/uploads\/sites\/6\/2026\/10\/wdb-og-que-faire-si.jpg","_seopress_social_twitter_img_attachment_id":0,"_seopress_social_twitter_img_width":0,"_seopress_social_twitter_img_height":0,"_seopress_redirections_value":"","_seopress_redirections_enabled":"","_seopress_redirections_enabled_regex":"","_seopress_redirections_logged_status":"","_seopress_redirections_param":"","_seopress_redirections_type":0,"_seopress_analysis_target_kw":"","_seopress_news_disabled":"","_seopress_video_disabled":"","_seopress_video":[],"_seopress_pro_schemas_manual":[],"_seopress_pro_rich_snippets_disable_all":"","_seopress_pro_rich_snippets_disable":[],"_seopress_pro_schemas":[],"footnotes":"","_members_access_role":[],"_members_access_error":""},"class_list":["post-32685","page","type-page","status-publish","hentry"],"blocksy_meta":{"styles_descriptor":{"styles":{"desktop":"","tablet":"","mobile":""},"google_fonts":[],"version":8}},"_links":{"self":[{"href":"https:\/\/eu.wedoback.com\/en\/wp-json\/wp\/v2\/pages\/32685","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/eu.wedoback.com\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/eu.wedoback.com\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/eu.wedoback.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/eu.wedoback.com\/en\/wp-json\/wp\/v2\/comments?post=32685"}],"version-history":[{"count":1,"href":"https:\/\/eu.wedoback.com\/en\/wp-json\/wp\/v2\/pages\/32685\/revisions"}],"predecessor-version":[{"id":33041,"href":"https:\/\/eu.wedoback.com\/en\/wp-json\/wp\/v2\/pages\/32685\/revisions\/33041"}],"up":[{"embeddable":true,"href":"https:\/\/eu.wedoback.com\/en\/wp-json\/wp\/v2\/pages\/32684"}],"wp:attachment":[{"href":"https:\/\/eu.wedoback.com\/en\/wp-json\/wp\/v2\/media?parent=32685"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}