{"id":31724,"date":"2026-10-07T11:53:35","date_gmt":"2026-10-07T09:53:35","guid":{"rendered":"https:\/\/mu.wedoback.com\/?page_id=31724"},"modified":"2026-10-07T12:22:57","modified_gmt":"2026-10-07T10:22:57","slug":"what-to-do-if","status":"publish","type":"page","link":"https:\/\/mu.wedoback.com\/en\/guides\/what-to-do-if\/","title":{"rendered":"What to do if\u2026: the right moves when an incident occurs"},"content":{"rendered":"\t\t
\n\t\t\t\t
\n\t\t
\n\t\t
\n\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Home<\/a>\u203a<\/span>Guides<\/a><\/p>

6 guides<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t

What to do if\u2026: the right moves when an incident occurs<\/h1>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Server down, ransomware, missing file, emptied mailbox: the steps in the right order, before restoring anything.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t
\"An<\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t
My server is down: what should I do?<\/b>Isolate the failure, check the data, find the last clean restore point, restore, then decide whether this server belongs in your DRP.<\/span><\/a>Ransomware has just struck<\/b>Disconnect the affected machines, do not pay on the spot, do not reformat, and look for a backup taken before the intrusion.<\/span><\/a>A file or folder has disappeared<\/b>Check the recycle bin and local versions first, then restore the most recent backup point that still contains a good copy of the file.<\/span><\/a>A mailbox has been emptied or hacked<\/b>Revoke sessions and forwarding first, then restore the mailbox to a date before it was emptied. Restoring without stopping the leak is pointless.<\/span><\/a>The NAS is not responding<\/b>Tell an unreachable NAS from one whose disks have died. Restore from the external copy, not from the RAID in the same device.<\/span><\/a>Last night’s backup failed<\/b>One failed night can be caught up. Several failed nights wipe out the promised RPO. Fix the cause the same day and check again the next day.<\/span><\/a><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t
<\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
\n\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Dealing with an incident right now?<\/h2>

Our teams help you identify the right copy and restore it, Monday to Friday, 9 am to 1 pm and 2 pm to 5:30 pm (Paris time).<\/p>

Call +33 9 72 50 78 28<\/a>Write to the team<\/a><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"","protected":false},"author":1,"featured_media":0,"parent":31720,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"elementor_header_footer","meta":{"_seopress_titles_title":"What to do if\u2026: incident response steps | WeDoBack","_seopress_titles_desc":"Server down, ransomware, missing file, emptied mailbox: the steps in the right order, before restoring anything.","_seopress_robots_index":"","_seopress_robots_follow":"","_seopress_robots_imageindex":"","_seopress_robots_snippet":"","_seopress_robots_primary_cat":"","_seopress_robots_breadcrumbs":"","_seopress_robots_freeze_modified_date":"","_seopress_robots_custom_modified_date":"","_seopress_robots_canonical":"","_seopress_social_fb_title":"","_seopress_social_fb_desc":"","_seopress_social_fb_img":"https:\/\/www.wedoback.com\/wp-content\/uploads\/sites\/4\/2026\/10\/wdb-og-que-faire-si.jpg","_seopress_social_fb_img_attachment_id":0,"_seopress_social_fb_img_width":0,"_seopress_social_fb_img_height":0,"_seopress_social_twitter_title":"","_seopress_social_twitter_desc":"","_seopress_social_twitter_img":"https:\/\/www.wedoback.com\/wp-content\/uploads\/sites\/4\/2026\/10\/wdb-og-que-faire-si.jpg","_seopress_social_twitter_img_attachment_id":0,"_seopress_social_twitter_img_width":0,"_seopress_social_twitter_img_height":0,"_seopress_redirections_value":"","_seopress_redirections_enabled":"","_seopress_redirections_enabled_regex":"","_seopress_redirections_logged_status":"","_seopress_redirections_param":"","_seopress_redirections_type":0,"_seopress_analysis_target_kw":"","_seopress_news_disabled":"","_seopress_video_disabled":"","_seopress_video":[],"_seopress_pro_schemas_manual":[],"_seopress_pro_rich_snippets_disable_all":"","_seopress_pro_rich_snippets_disable":[],"_seopress_pro_schemas":[],"footnotes":"","_members_access_role":[],"_members_access_error":""},"class_list":["post-31724","page","type-page","status-publish","hentry"],"blocksy_meta":{"styles_descriptor":{"styles":{"desktop":"","tablet":"","mobile":""},"google_fonts":[],"version":8}},"_links":{"self":[{"href":"https:\/\/mu.wedoback.com\/en\/wp-json\/wp\/v2\/pages\/31724","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mu.wedoback.com\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/mu.wedoback.com\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/mu.wedoback.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mu.wedoback.com\/en\/wp-json\/wp\/v2\/comments?post=31724"}],"version-history":[{"count":1,"href":"https:\/\/mu.wedoback.com\/en\/wp-json\/wp\/v2\/pages\/31724\/revisions"}],"predecessor-version":[{"id":31835,"href":"https:\/\/mu.wedoback.com\/en\/wp-json\/wp\/v2\/pages\/31724\/revisions\/31835"}],"up":[{"embeddable":true,"href":"https:\/\/mu.wedoback.com\/en\/wp-json\/wp\/v2\/pages\/31720"}],"wp:attachment":[{"href":"https:\/\/mu.wedoback.com\/en\/wp-json\/wp\/v2\/media?parent=31724"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}