Ransomware attackers specifically target and attempt to destroy backup systems to increase the probability of payment. Hardening your system is critical. Please ensure you have reviewed your platform security using the Security Hardening Checklist
Cohesity

COHESITY Documentation

Explore our documentation to get started, discover products & new features, access troubleshooting guides, register sources, platforms support.

Products
Data Security Alliance
Visit Cohesity.com
Demos
Support
Blogs
Developers
Partner Portals
Cohesity Community
© 2026 Cohesity, Inc. All Rights Reserved.
Terms of Use|
Privacy Policy|
Legal|
  1. Home
  2. Cohesity Solution Guide for Sheltered Harbor
  3. About Cohesity Sheltered Harbor solutions
  4. About Cohesity Alta solution for Sheltered Harbor
  5. Archive restoration using Cohesity Alta Recovery Vault for Sheltered Harbor
Cohesity Solution Guide for Sheltered Harbor

Archive restoration using Cohesity Alta Recovery Vault for Sheltered Harbor

Data restoration is carried out to restore the data if required using the restore command option. The Sheltered Harbor solution on the NetBackup client decrypts and restores the data. The following diagram depicts the process to restore the data from Cohesity Alta Recovery Vault.

Figure: Archive restoration using Cohesity Alta Recovery Vault for Sheltered Harbor

Archive restoration using Cohesity Alta Recovery Vault for Sheltered Harbor

The process flow is as follows:

  1. Archive retrieval: From the NetBackup client, you need to manually restore the backup data using NetBackup Backup Archive Restore (BAR) UI or NetBackup web UI. You need to use the backup keyword to restore the data.

    See Restore backup data using NetBackup web UI.

  2. Data restoration: The recovery storage contains the retrieved encrypted data files along with the secure envelope. You can use any portable medium (such as pen drive, hard disk) to store the restored data. The portable media can be transferred to the third-party restoration platform to restore data and services.

    Note:

    Ensure that you specify the correct recovery storage path while you restore the backup data files using the BAR GUI or web UI.

  3. External or cloud provider KMS: The NetBackup Sheltered Harbor solution decrypts the data encryption key (DEK) with the help of a configured external KMS or a cloud-provider based KMS. The DEK is further used to decrypt the recovery storage data. It ensures that the encryption or decryption keys do not leave the KMS boundaries. If cloud KMS is not configured, you can use on-premises KMS.

    Note:

    The decryption of data by the solution is required only for data recovery and verification test, or for service restoration by a self-restorer.

  4. Restored data storage: Once you perform the data restoration using the Sheltered Harbor solution, the data files are decrypted and stored in the restored data storage.

    The data restoration using the Sheltered Harbor solution can be done on a completely isolated NetBackup client that does not have a connectivity with a primary server. Such isolated NetBackup client can be installed by skipping host certificate deployment during NetBackup client install. The data restoration needs a connectivity with KMS where envelope decryption key is stored.

    Note:

    Ensure that you specify the correct restoration storage path while performing the data restoration operation.

Feedback

Was this page helpful?
Previous

Archive data vaulting using Cohesity Alta Recovery Vault for Sheltered Harbor

Next

About NetBackup for Sheltered Harbor

Feedback

Was this page helpful?