HD Doctor Blog
Technical articles on data-loss prevention, immutable backup, ransomware hardening and incident response. Written by HD Doctor engineers.
The 3-2-1-1-0 Rule: Modern Backup Standard
The 3-2-1-1-0 rule is the corporate evolution of the classic 3-2-1: three copies, on two different media, one offsite, one immutable, and zero restore errors. Adopted after the 2020-2024 ransomware wave proved that online backups can also be encrypted.
Read articleImmutable Backup: Practical Guide in 3 Technologies
Immutable backup is the highest defensive-ROI control against corporate ransomware in 2026. This guide shows how to implement it on S3 Object Lock, Veeam Hardened Repository and LTO WORM tape, with criteria to choose each.
Read articleMFA on VPN: The Most Critical Control Against Ransomware
55% of Akira attacks documented by CISA (advisory AA24-109A) originated from Cisco VPN without MFA. The control is cheap (a few dollars per user/month), fast to implement (hours to days) and blocks the #1 corporate ransomware vector in 2026.
Read articlePreventing Data Loss on SSD
SSDs fail differently from HDDs: no noise, no visible warning, and TRIM makes deleted files physically disappear in minutes. To mitigate this, combine immutable backup, SSD-specific SMART monitoring and proactive replacement when critical attributes grow.
Read articlePost-Incident Windows Server Hardening
Restoring Windows Server after ransomware without applying hardening invites reinfection in weeks. These 10 items, applied in sequence, reduce roughly 80% of the typical corporate environment attack surface.
Read articleVeeam Hardened Repository: Complete Setup
Veeam Hardened Repository (introduced in v11) is the cheapest and most robust on-premise way to implement immutable backup. Dedicated Linux server with chattr +i flag on backup files prevents deletion even by root. Full setup in ~2 hours with this guide.
Read articleRTO and RPO Explained
RTO (Recovery Time Objective) is how long your company can stay down. RPO (Recovery Point Objective) is how much data you can lose. These two values defined by business (not IT) dictate the entire backup, replication and DR architecture.
Read articleSnapshot is Not Backup: 5 Reasons
A snapshot is an instant photo of the volume, created via copy-on-write or redirect-on-write. It is fast, useful and cheap, but depends on the original storage. If storage fails or is encrypted, snapshots fall together. Backup is an INDEPENDENT copy on another medium.
Read articleHow to Test Backup Restore
Most companies discover that backup does not restore at the worst moment — during the real incident. These 5 tests, executed on regular cadence, eliminate that surprise and reveal blind spots before the critical hour.
Read article24-Hour Post-Ransomware Checklist
The first 24h after ransomware discovery define whether recovery will be viable. Wrong decisions in the first 6h destroy evidence, trigger reinfection, and make decryption infeasible. This time-window checklist is based on real HD Doctor playbooks.
Read articleHDD Stopped Working: What NOT to Do
When an HDD stops working or is not detected by BIOS, amateur actions in the first hours destroy data that was still recoverable. These are the 7 most common mistakes we see in the lab, and what to do instead.
Read articleHow to Preserve Media for Forensic Analysis
Correct media preservation turns a technical case into legally valid evidence. SHA-256 hash, documented chain of custody and bit-by-bit copy before any analysis are mandatory. 6 steps ensure court acceptance.
Read articlePay Ransomware or Not: 7 Criteria Before Deciding
Paying ransomware is a critical decision mixing technical, legal, ethical and financial. In 2026 the technical recommendation is increasingly clear: in most cases NO. But there are specific scenarios where the analysis changes. This article presents 7 objective criteria.
Read articlePublic Decryptor: How to Find and Validate
Public decryptors released by FBI, NCA, Avast, Kaspersky and partners can decrypt ransomware without payment. But misusing destroys still-recoverable files. This guide shows where to find, how to identify variant, and how to safely test.
Read articleChain of Custody for Judicial Use
Chain of custody is the set of records that proves digital evidence arrived unchanged from seizure to court. Failure in any link allows challenge and discard. Standard ABNT NBR ISO/IEC 27037 and similar regulations define requirements.
Read articleDetect Lateral Movement Before Encryption
Between initial breach and ransomware encryption, the attacker spends on average 7-30 days in the network in lateral movement. That is the window where detection and containment prevent disaster. 8 behavioral signs identify the attack in progress before the end point.
Read articleRecover VMware ESXi After Encryption
Linux-ESXi ransomware (BlackCat, LockBit-Linux, Akira .powerranges) encrypts only the header of each VMDK file for speed. In many cases the internal VM data survives. This guide shows how to recover when backup failed.
Read articleCompromised Active Directory Forensics
When AD is compromised, the critical question is: did the attacker obtain a golden ticket (total control via KRBTGT)? Correct forensics answers this and determines if 2× KRBTGT reset solves or if full domain rebuild is required.
Read articleStakeholder Communication During Incident
Wrong incident communication becomes a second incident. Premature press leak creates speculation. Late client communication becomes lawsuit. Regulator not notified in 72h becomes fine. This matrix aligns audience, message, moment and what NOT to say.
Read articleHospital IT After Ransomware
A hospital paralyzed by ransomware has different pressure: every hour without EHR is real clinical risk. Tasy, MV, Epic, Cerner, DICOM PACS and HIPAA/regulator compliance create specific priorities differing from any other sector.
Read articleRecovery for Law Firm Under Deadline
Law firm has unique urgency: missed court deadline = case lost. When the system goes down 48h before deadline, the recovery window is zero. Express service + attorney-client privilege are mandatory.
Read articleSending HDD to the US: When It's Worth It
Sending HDD to a US lab (Ontrack, Secure Data Recovery, DriveSavers) is an option in specific cases, but adds 7-21 days of international logistics, USD cost and customs risk. When it really makes sense.
Read articleHow to Audit a Data Recovery Vendor
Before handing over critical media, audit the vendor. Market has real and improvised companies side by side. These 10 verifiable items distinguish genuine technique from empty marketing.
Read articleRAID 5 vs 6 vs 10: Which to Choose
RAID 5 is technically obsolete for modern disks > 4TB. RAID 6 and RAID 10 are the viable choices in 2026. This comparative analysis shows technical criteria to choose by workload, cost and fault tolerance.
Read articleESXi vs Proxmox for SMB in 2026
After Broadcom acquired VMware (2023) and discontinued free ESXi while substantially raising licensing, Proxmox VE became a serious alternative for SMBs. Technical comparison updated for 2026 decision.
Read articleDR: AWS vs Azure vs On-Premise
Choosing DR architecture defines whether your company comes back in 4h or 4 days after incident. AWS, Azure and on-prem have specific trade-offs. This comparison shows technical and financial criteria by size and workload.
Read articleData Protection Law in Data Recovery
Handing over HDD or backup with personal data to recovery vendor constitutes data sharing under data protection laws (LGPD, GDPR, CCPA). Without correct contract, your company can face fines up to 2-4% of turnover. See what to demand.
Read articleSynology vs QNAP in Failure: Practical Comparison
Synology DSM and QNAP QTS are the two dominant NAS systems in SMB. In failure (disk, controller, ransomware), they behave differently. Practical comparison with typical recovery time.
Read articleMinimal Forensic Kit for SOC
Corporate SOC (internal or outsourced) needs minimal forensic capability for incident response without depending 100% on external lab. When the kit is worth it, and what to buy.
Read articleBusiness Continuity Plan for Law Firms
Law firm has unique continuity requirements: every missed court deadline = potentially million-dollar lost case. Generic IT plan is not enough. These 6 critical elements differentiate legal BCP.
Read article