Backup

In this section, SVM refers to an SVM with the File Threat Protection component.

Backup is a special storage for backup copies of files that are deleted or modified during disinfection.

A backup copy of a file is a copy of a virtual machine file that is created when this file is disinfected or removed. Backup copies of files are stored in Backup in a special format and pose no danger.

When Kaspersky Security detects an infected file on a virtual machine, it blocks the virtual machine user from accessing this file and moves a copy of the file to Backup. The application then subjects the file to the action that is configured in the protection profile of this virtual machine. For example, it disinfects or deletes the file. 

Sometimes it is not possible to maintain the integrity of files during disinfection. If the disinfected file contained information that becomes fully or partially unavailable after disinfection, you can save the file from the backup copy to the hard drive of a computer on which Kaspersky Security Center Administration Console is installed.

Backup is located on the SVM with the File Threat Protection component. Use of Backup is enabled by default on each SVM.

When an SVM with the File Threat Protection component is removed or updated, copies of files that were placed in Backup are automatically deleted.

The size of Backup on an SVM is 1 GB. If the total size of backup copies of files in Backup exceeds this value, Kaspersky Security removes the oldest backup copies of files to keep the size of Backup under 1 GB.

The default maximum storage period for backup copies of files in Backup is 30 days. After this time, Kaspersky Security automatically deletes backup copies of files from Backup.

You can change the maximum storage term for backup copies of files. Backup settings are specified in the policy settings.

The Kaspersky Security Center Administration Console lets you manage backup copies of files stored in Backup on SVMs. Kaspersky Security Center Administration Console displays a combined list of backup copies of files that Kaspersky Security placed in Backup on each SVM with the File Threat Protection component.

To prevent deletion of backup copies of files when deleting or updating SVMs, you can configure the use of network data storage for SVMs. If the use of network data storage is enabled, backup copies of files with each SVM are saved in a separate folder in the network data storage. An SVM connects to the storage every 10 minutes for data synchronization. If backup copies on an SVM were deleted automatically as a result of deletion or update of the SVM, they will be automatically restored. If you manually deleted backup copies of files on an SVM, these copies are also deleted from the folder in the network data storage. The term for storing backup copies of files in network data storage is determined by the Backup settings on SVMs.

To use network data storage, create an SMB network folder accessible via the SMBv3 protocol for hosting the network data storage and a user account for connecting SVMs. The amount of space necessary for the network data storage can be estimated based on the following formula: (N+1) GB, where N is the number of SVMs that connect to the network data storage.

You need to make sure that the amount of space allocated for network data storage is sufficient for storing backup copies of files. Kaspersky Security does not monitor availability of free space in the network data storage and does not notify you if backup copies of files cannot be stored. It is recommended to use third-party tools to monitor the available space in the network folder.

You can configure the use of network data storage for SVMs during installation of the application (procedure for registering Kaspersky Security services) or by using the Kaspersky Security reconfiguration procedure.