If Kaspersky Endpoint Security detects malicious code in a file while scanning a protected device, the application can block the file, assign to it a status of Infected, place a copy in Backup, and attempt to disinfect the file.
Backup keeps copies of files that have been deleted or modified during disinfection. A backup copy is created before disinfecting or deleting the file. Backup copies of files are stored in a special format and do not pose a threat.
If the file is successfully disinfected, the status of the backup copy changes to Disinfected. Sometimes it is not possible to maintain the integrity of files during disinfection. If you partially or completely lose access to important information in a disinfected file after disinfection, you can attempt to restore the file from the disinfected copy to the file's original directory.
We recommend restoring files from backup copies only if these have a status of Disinfected. Restoring infected objects may lead to a device infection.
Backup file copies may contain personal data. Root privileges are required to access Backup objects.
You can configure the following Backup settings:
When the specified retention period expires, or when the maximum Backup size is reached, the application automatically deletes backup copies regardless of their status.
You can delete the backup copy of a restored or unrestored file manually.
A general list of files placed in Backup by Kaspersky applications on client devices is generated in Kaspersky Security Center and is available in the Administration Console (Advanced → Storages → Backup) and in the Web Console (Operations → Storages → Backup). You can view the properties of backup copies on protected devices, run malware scans in Backup, and delete files. Kaspersky Security Center does not copy files from Backup to the Administration Server; all files are stored in the Backup storages on protected devices. File restore takes place on the protected device.