Data recovery method and data recovery system

Abstract

To solve the problem that, when the latest data and a backup of the latest data are infected, the data is recovered from the backup older than the data, thus, the data is restored using the very old data, therefore, it is necessary to eliminate a difference from the latest data, leading to loss of business opportunities.SOLUTION: A data recovery system recovers data stored in a storage system. The data recovery system includes: a storage device that holds original data; an analyzing server that holds copy data which is a copy of the original data, and generates formatted data obtained by formatting the copy data for analysis; a managing server that holds the copy data and data history management information storing a history of the formatted data; and a data recovery section that refers to the data history management information, selects the copy data or the formatted data as recovery data, and recovers the data from the selected recovery data when a security threat is detected in the data.SELECTED DRAWING: Figure 2

Description

[Technical field]

[0001] The present invention relates to a data recovery method and a data recovery system. [Background technology]

[0002] In recent years, there has been a sharp increase in service-destroying cyber attacks, with ransomware at the forefront. These attacks not only shut down IT systems in operation, but also destroy data and backups of IT systems, causing severe damage to IT systems and businesses themselves.

[0003] Therefore, it is necessary to avoid losing business opportunities by recovering IT systems using as up-to-date data as possible. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] Patent document US2021 / 0216628 discloses that if it is determined that there is a possibility of exposure to a security threat, parameters related to protection such as retention and backup are changed to prevent loss of recovery datasets / increase the frequency of generation of recovery datasets. Summary of the Invention [Problem to be solved by the invention]

[0005] In the invention of Patent Document 1, when the latest data and its backup are infected, recovery is performed from an older backup, so the data is restored using very old data. This requires filling in the gap with the latest data, which leads to lost business opportunities.

[0006] In other words, no consideration is given to recovery from a copy of the data, preferably one that has been used in data utilization. [Means for solving the problem]

[0007] The above problem is solved by a data recovery system for data stored in a storage system, comprising: a storage device for holding original data; an analysis server for holding copy data that is a copy of the original data and for generating shaped data by shaping the copy data for analysis; a management server for holding data history management information that stores the history of the copy data and the shaped data; and a data recovery unit for, when a security threat is detected in the data, referring to the data history management information, selecting the copy data or the shaped data as recovery data, and recovering the data from the selected recovery data. Effect of the Invention

[0008] Even if you are exposed to a security threat such as a ransomware infection, the latest data used for formatting and analysis will increase the chances of recovering data from your IT system. [Brief description of the drawings]

[0009] [Figure 1] FIG. 1 is a block diagram illustrating an example of a system configuration according to an embodiment of the present invention. [Diagram 2] FIG. 2 is a block diagram showing an example of a hardware configuration according to an embodiment of the present invention. [Diagram 3] FIG. 11 is a diagram showing an example of data history management information in an embodiment of the present invention. [Figure 4] 11 is a flowchart illustrating an example of a data history information collection process according to an embodiment of the present invention. [Diagram 5] 11 is a flowchart illustrating an example of a file and volume mapping acquisition process in an embodiment of the present invention. [Figure 6] 10 is a flowchart illustrating an example of a data recovery process in an embodiment of the present invention. [Figure 7] 1 is a flowchart illustrating an example of a security threat detection and data management process according to an embodiment of the present invention. [Figure 8]FIG. 11 is a diagram showing an example of data similarity information in the embodiment of the present invention. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0010] By using data lineage, which shows a copy of data and the history of converted data when the data was used, data recovery can be achieved using the most recent data possible.

[0011] When recovering from copy data, the relationship between the source and destination of the data that occurs when the data is used is maintained as lineage.

[0012] This means that even if the original data or backup data is infected with ransomware, the copy data can be found using data lineage and the found data can be used to recover. If the copy data used at the time of data use is treated as a cache, when ransomware infection of the original data or backup data is detected, the data will be stored in non-volatile memory instead of the cache. Once the infection has been cured, the data will be returned to the cache.

[0013] If an infection is detected during data reformatting, recovery will occur from the previous generation of data. If the copy data is infected, errors will occur during reformatting and analysis processes, making it possible to detect ransomware infection. Therefore, the previous version of the copy data is saved, and if analysis is not possible with the latest copy, processing can be performed using the previous version of the copy data.

[0014] In data processing, tags are inserted into the data to make it easier to analyze, the data is formatted, interpolated, etc. The data after these processes is almost the same as the original data.

[0015] Therefore, if recovery using backup data or cache data is not possible, the system can determine whether or not the data can be used based on the similarity between the processed and analyzed data and the original data. In this case, the system inquires about recovery using the reformatted data to the data administrator or infrastructure administrator, and recovers the data after receiving information indicating the approval of the data administrator or infrastructure administrator.

[0016] An embodiment of the present invention will be described with reference to the drawings. EXAMPLES

[0017] FIG. 1 is a block diagram showing an example of a system configuration according to an embodiment of the present invention.

[0018] In the site 10-1, the storage device 300 is connected to the management server 100 and the server 20 via a LAN-1.

[0019] The server 20 writes data to the storage device 300. Original data is stored in the storage device 300, and backups are periodically performed. The backup data is backed up to the cloud storage 400 in the site 10-2 via the WAN.

[0020] Data_Backup_latest-2 and Data_Backup_latest-3 in the cloud storage 400 are backup data whose backup generations are two or three generations older than the latest data Data_latest in the storage device 300 .

[0021] Furthermore, the compute server 200 of the site 10-2 performs data analysis using a data reforming unit P21 and a data analysis unit P22.

[0022] For this purpose, a snapshot of the latest data is acquired on the storage device 300, and the data, Data_latest-1 and Data_latest-2, are stored in the cloud storage 400 via the WAN. Data_latest-1 and Data_latest-1 are snapshot data that are one or two years older than the latest data, Data_latest. The snapshot acquired by the storage device 300 is transferred to the cloud storage 400 and then deleted.

[0023] The data reforming unit P21 running on the compute server 200 performs a reforming process on the data using, for example, Data_latest-1 stored in the cloud storage 400, creates Data_latest-1_formed, and stores it in the cloud storage 400.

[0024] The data analysis unit P22 performs analytical processing, including machine learning and deep learning, using the formatted Data_latest-1_formatted.

[0025] When restoring data based on data lineage, the check processing unit P23 performs a check process to confirm that the selected data is not infected with a virus such as ransomware.

[0026] The management server 100 manages the storage apparatus 300, and creates a data lineage (data history) that collects data copy transitions and data conversion transitions.

[0027] In the present invention, if the latest data Data_latest stored in the storage device 300 is exposed to a security threat such as ransomware, the data lineage managed by the management server 100 is referenced and recovery is performed using the latest data as much as possible.

[0028] For example, the update times of the latest backup data Data_backup_latest-2 and Data_latest-1 copied for data processing are compared, and recovery is performed using the more recent data.

[0029] This will minimize loss of business opportunities.

[0030] FIG. 2 is a block diagram showing an example of a hardware configuration according to an embodiment of the present invention.

[0031] Site 10-1 and site 10-2 are connected by a WAN. Site 10-1 and site 10-2 may be either an on-premise private cloud or a public cloud.

[0032] In this embodiment, a case will be described in which the site 10-1 is an on-premise private cloud and the site 10-2 is a public cloud.

[0033] At site 10-1, a storage device 300 and a management server 100 are connected via LAN-1. The management server 100 may be included within the storage device 300. In this embodiment, the case where the management server 100 is an independent physical device will be described. The storage device 300 may be a cluster made up of one or more devices.

[0034] The storage device 300 is composed of a CPU 310, a memory 320, a storage device unit 330, and a NW IF 350. The memory 320 comprises a storage control unit P31, a data transfer unit P32, and a data history management unit P20.

[0035] The storage control unit P31 stores IO data sent from a host not shown in the figure in a storage device using data protection such as RAID or Erasure Coding, and controls the storage, such as taking snapshots, and applying processes such as compression and deduplication.

[0036] The data transfer unit P32, for example, backs up data held in the storage device 300 to the cloud storage 400 at site 10-2, transfers data for data utilization, and returns data held in the cloud storage 400 to the storage device 300.

[0037] When a backup or data copy process is performed, the data history management unit P20 acquires and holds the data transfer source, the data transfer process, the data transfer destination, the date and time the transfer process was performed, and a flag indicating whether the data is normal.

[0038] For example, when a backup process is performed, the data source is stored as the storage device 300, the data process is stored as backup, the data destination is stored as the cloud storage 400, the time when the data transfer process was performed, and if the backup was successful, the normality flag is stored as "normal".

[0039] If the target data at the data transfer source is a volume, the volume name or number is stored; if it is a file system, the file system name is stored; if it is a directory or file, the path is stored.

[0040] The data history management unit P20 may include a data transfer unit P32, a data formatting unit P21, and a data analysis unit P22.

[0041] The management server 100 is composed of a CPU 110 , a memory 120 , a storage device 130 , and a NW IF 150 .

[0042] The memory 120 holds a data history collection section P10, data history management information T11, and original data similarity information T13 for each data processing.

[0043] The data history collection unit P10 acquires history information on data copying and data conversion / processing held by the data history management unit P20 of the storage device 300 and the data history management unit P20 of the compute server 200, and stores the information in data history management information T11, which will be described later. The original data similarity information T13 for each data process will be described in the third embodiment.

[0044] When an error occurs in a compute server due to a virus infection in a DB or file, the data recovery unit P11 searches for usable data by referring to the data history management information T11 and the like, and performs data recovery.

[0045] At site 10-2, a compute server 200 and a cloud storage 400 are connected via LAN-2.

[0046] The compute server 200 is composed of a CPU 210, a memory 220, a storage device 230, and a NW IF 250. In the memory 220, a data reforming unit P21, a data analysis unit P22, and a data history management unit P20 are deployed.

[0047] The data reforming unit P21 reforms and processes the data stored in the cloud storage 400 so that the data analysis unit P22 can easily process the data. The reformed and processed data is stored in the cloud storage 400 as separate data.

[0048] The data analysis unit P22 performs analysis processing, including deep learning and machine learning, on the shaped and processed data. The data created by this processing is stored in the cloud storage 400 as separate data.

[0049] The data reforming unit P21 and the data analysis unit P22 may be managed services provided by the cloud.

[0050] The data history management unit P20 acquires and stores the data before processing, the processing content, the processed data, the date and time of processing, and a flag indicating whether the data is normal when data conversion / processing is performed by the data formatting unit P21 or analysis processing such as deep learning or machine learning is performed by the data analysis unit P22.

[0051] For example, when data processing is performed, the data Data_latest-1 stored in the cloud storage 400 is stored as the data before data processing, the data formatting process is stored as the processing content, Data_latest-1_formatting is stored as the data after processing, Data_latest-1_formatting storage time is stored as the processing date and time, and if the data processing is successful without generating an error, the normal flag is stored as normal. The cloud storage 400 is a storage service built on the cloud.

[0052] FIG. 3 is a diagram showing an example of the data history management information T11.

[0053] The data history management information T11 consists of pre-processing data C11, processing C13, post-processing data C15, a timestamp C17, a normality flag C19 which indicates that the data is normal if no errors are found when processing C13 is performed, and a similarity C20 which indicates how similar the post-processing data is to the original data.

[0054] In this example, the similarity is classified into three levels: A, B, and C, with A indicating that the data is almost identical to the original; B indicating that tag data and / or complementary data have been added but that the data is almost identical to the original; and C indicating that the data has been used for machine learning analysis and is different from the original data.

[0055] It is not necessary to classify into three levels, and the matching rate with the original data may be stored. By storing the processed data C15 and the similarity C20 in association with each other in this way, it becomes possible to recover data using data with a large matching rate based on the similarity.

[0056] In addition, when the similarity is determined by the content of process C13, the priority of the processed data to be used for data recovery may be determined based on the content of the process. For example, the priority may be set so that the processed data that has been subjected to copying, formatting, and analysis, which are processes that are considered to have a high similarity, is used for data recovery.

[0057] For example, an example of a data transfer unit is shown below. If the storage device 300 acquires a backup on a daily basis by the data transfer unit P32, as shown in entry E1, Data_latest@storage 300 is stored in the pre-processing data C11, Backup is stored in the processing C13, Data_backup_latest-2@cloud storage 400 is stored in the post-processing data C15, the date and time when the processing was performed and the data was stored is stored in the TimeStamp C17, normal is stored in the normal flag C19, and A indicating the highest similarity is stored in the similarity C20 because the stored data is backup data.

[0058] Here, "Data_latest" of the pre-processing data C11 and "Data_backup_latest-2" of the post-processing data need to be names that can be specified by the user, such as DB names and file names.

[0059] Therefore, in order to use the results of copying or backing up on a volume basis in a storage device, the mapping process shown in FIG. 5 is required.

[0060] Data_backup_latest-3@cloud storage 400 in the processed data C15 shown in entry E2 indicates a backup that was performed on the day before the above backup.

[0061] Next, examples of the data conversion unit are shown in entries E3 to E5. The data on the storage device 300 is shaped and analyzed by a data shaping unit P21 and a data analysis unit P22 on the compute server 200.

[0062] First, the storage device 300 performs a data copy process using the data transfer unit P32.

[0063] At this time, as shown in entry E3, pre-processing data C11 stores Data_latest@storage 300, processing C13 stores Copy, post-processing data C15 stores Data_latest-1@cloud storage 400, TimeStamp C17 stores the date and time when the processing was performed and the data was stored, and normal is stored in the normal flag C19.

[0064] Entry E4 shows the data copied for data analysis before E3.

[0065] Next, the copied data is used to perform a data formatting process. As shown in entry E5, Data_latest-1@cloud storage 400 is stored in pre-processing data C11, formatting is stored in processing C13, Data_latest-1_formatting@cloud storage 400 is stored in post-processing data C15, the date and time when the data was stored after processing is stored in TimeStamp C17, and normal is stored in normal flag C19.

[0066] Finally, analysis processing is performed using the reformatted data. As shown in entry E6, Data_Latest-1_Formatting@Cloud Storage 400 is stored in pre-processing data C11, analysis is stored in processing C13, Data_Latest-1_Formatting_Analysis@Cloud Storage 400 is stored in post-processing data C15, the date and time when the data was stored after processing is performed is stored in TimeStamp C17, and normality is stored in normality flag C19.

[0067] In this way, the data copy process history and the data processing and analysis history can be managed in the same format. In this embodiment, these are called data history management information.

[0068] Figure 4 shows a flowchart for collecting data provenance information when data backup, data copying for data utilization, and data processing / analysis are being performed.

[0069] S101: The data history collection unit P10 on the management server 100 requests the history of data processing and analysis processing from the data history management unit P20 on each server performing data processing and analysis processing, and the data history management unit P20 of each server returns the history.

[0070] When the data history collection unit P10 acquires the history of data processing and analysis of each server, it stores the history in data history management information T11.

[0071] S103: The data history collection unit P10 on the management server 100 requests the history of the data copy process from the data history management unit P20 on each storage device performing the data copy process, and the data history management unit P20 of each server returns the history.

[0072] S105: If data copying in storage is done on a volume basis, the DB stored data used in data processing is file data, and so mapping must be performed between the data and the volumes to which data copies, such as backups, have been made.

[0073] Therefore, the data history collection unit P10 judges whether the data copy is in volume units, and if it is in volume units, executes S200, and if it is not in volume units, executes S119.

[0074] S119: The data history collection unit P10 stores the data copy history in the data history management information T11.

[0075] S199: The data history collection unit P10 completes the data history information collection process.

[0076] The process of S101 for acquiring the history of data processing and analysis processing of each server and the process of S103 to S119 for acquiring the data copy history of the storage may be performed in the reverse order or in parallel.

[0077] FIG. 5 shows a process S200 in which the data history collection unit P10 running on the management server 100 checks the history of data copy processing and backup processing performed by the data transfer unit P32 of the storage device 300, and maps DB or file data to block volumes if the data copy processing and backup processing were performed on a block volume basis.

[0078] S201: The data history collection unit P10 on the management server 100 judges whether the compute server is using the volume provided by the storage device 300 as a DB or as a file system system.

[0079] It is assumed that the access rights to the DB and the file system have been registered in advance in the management server by the administrator. In the case of the DB, S202 is executed, and in the case of the file system, S205 is executed.

[0080] S202: When the compute server is used as a DB, the data history collection unit P10 acquires the path on the file system where the DB table is stored.

[0081] This path may be obtained by identifying the file name or directory name on the file system based on the API provided by the DB or the DB table name.

[0082] S203: The root path of the file system is identified from the above path.

[0083] S205: A logical volume is identified from the root path of the file system. This can be done by executing a command provided by the OS or by referring to a configuration file that associates the file system with the logical volume.

[0084] S207: Identifying the volume group corresponding to the logical volume. This is done by executing a command provided by the OS, etc.

[0085] S209: Identify the physical volumes that correspond to the volume group. This is done by executing commands provided by the OS, etc.

[0086] S211: The block volume provided by the storage corresponding to the physical volume is identified by executing a command provided by the OS or the storage device.

[0087] These processes enable mapping of block volumes to DB or file data used by the compute server.

[0088] S221: From the above mapping, DB or file data for the block volume that was actually backed up is identified.

[0089] S223: An entry of the data copy history as a data copy and backup history of the identified DB or file data is added to the data history management information T11.

[0090] S299: This process is completed.

[0091] FIG. 6 is a flowchart illustrating the processing of the data recovery unit P11, showing the data recovery process S300, when data stored in the storage device 300 is exposed to a security threat such as ransomware.

[0092] S301: The storage device 300 detects a security threat.

[0093] This may be detected by a tool running on the storage device or a tool running on the computing side that uses the storage device.

[0094] S303: The data recovery unit P11 of the management server 100 refers to the data history management information T11 and identifies the latest copy of the suspected infected data.

[0095] The pre-processing data C11 of the data history management information T11 is referenced to identify the entry of the data that needs to be restored, and the latest copy data for that data is searched for and identified by reference to the process C13, the time stamp C17, and within the range in which the normal flag C19 is normal.

[0096] Process C13 makes it possible to know whether the process is a data copy process, and also makes it possible to determine the time when the copy was made by using the timestamp.

[0097] S305: The administrator is asked whether it is OK to restore the data found in the search results, and if the administrator approves, the data is restored.

[0098] In the first embodiment, by utilizing the history of data backups and copies for data utilization, data exposed to a security threat can be recovered from the most recent copy data to the extent possible.

[0099] In the second embodiment, an example of a security threat is shown in which infection is detected when reformatting data during data utilization and recovery is performed from data from one generation ago.

[0100] For example, when a security threat such as ransomware occurs, and a data copy is made for backup or data processing, the copied data may already be infected.

[0101] In that case, it is necessary to detect and recover from security threats as quickly as possible.

[0102] Therefore, in the second embodiment, if the copied data is infected during data processing, the formatting and analysis process will fail and an error will occur, and a security threat will be detected by the failure.

[0103] In addition, data recovery involves saving copy data of one generation before during data processing, and if the latest copy becomes unanalyzable, recovery is performed using the copy data of the previous generation. The same processes as those in the first embodiment will be omitted, and the differences, that is, the detection of security threats during data processing and the data management process, will be explained.

[0104] FIG. 7 is a flow chart illustrating an example of a security threat detection and data management process in an embodiment of the present invention.

[0105] S501: The data formatting unit P21 or the data analysis unit P22 on the compute server 200 performs formatting processing or analysis processing on the data.

[0106] S502: If no error occurs, the data formatting unit P21 or the data analysis unit P22 executes S551. If an error occurs, the data formatting unit P21 or the data analysis unit P22 executes S505.

[0107] S505: The data reforming unit P21 or the data analysis unit P22 determines whether an error is due to a security threat.

[0108] For example, if the data cannot be read due to encryption or the like, the process is determined to be a security threat. If it is determined to be a security threat, S507 is executed. If not, S551 is executed.

[0109] S507: The data history management unit P20 holds the data determined to be a security threat as abnormal.

[0110] S509: The data history management part P20 notifies the occurrence of a security threat to the management server 100. The management server 100 collects data history S100 and performs data recovery processing S300.

[0111] S551: The data history management unit P20 determines whether data of N generations or earlier exists in the cloud storage 400 for copy data for data processing. N may be a value specified in a configuration file or the like. If it exists, execute S553. If it does not exist, execute S599 and complete the process.

[0112] S553: ​​The data history management unit P20 deletes data prior to the Nth version.

[0113] S555: Update the data history to reflect the deleted data.

[0114] In the second embodiment, when a security threat such as ransomware occurs, when a data copy is made for backup or data processing, the copy data may already be infected.

[0115] Therefore, if the copied data is infected during data processing, the formatting and analysis process will fail, and security threats will be detected by analyzing this failure.

[0116] In addition, the data processing side stores a copy of the previous generation of data, and if the latest copy becomes unable to be analyzed, the data is managed so that recovery is carried out using the copy of the previous generation of data. This allows for earlier detection of security threats and data recovery using the most recent data possible.

[0117] In the third embodiment, an example of recovering from a security threat using data after data reformatting during data processing will be described.

[0118] In data processing, tags are inserted into the data, the data is formatted, and the data is interpolated to make the data easier to analyze later.

[0119] The data after this processing is almost the same as the original data. Therefore, if the data cannot be restored in the first or second embodiment, the system proposes the restoration of the data using the reformatted data to the data administrator and infrastructure administrator, and the restoration is performed after obtaining the approval of the data administrator and infrastructure administrator.

[0120] Regarding the third embodiment, only the original data similarity information T13 for each data process used in the data recovery process S300, which is different from the first embodiment, and the changes in the data recovery process S300 using this information will be described. 8 is a diagram showing an example of data similarity information in the embodiment of the present invention. This information is composed of data processing C131 and similarity C133 between the data before processing.

[0121] The data processing C131 indicates processing for processing and analyzing data. The similarity C133 with the data before processing indicates the similarity with the original data for the data processing C131. This similarity may be determined using a tool for determining similarity, or may be set by an administrator including a data analyst.

[0122] For example, since backups and copies are the same as the original data, the similarity C133 is set to A, whereas data interpolation processing and tag addition formatting processing are small changes from the original data, so the similarity C133 is set to B, which indicates a high similarity.

[0123] In contrast, data created by analytical processing such as deep learning has no similarity to the original data, and the similarity C133 is set to C.

[0124] It is not necessary to use three levels of similarity, and an index such as the degree of match with the original data may also be used.

[0125] The original data similarity information T13 makes it possible to manage the similarity between the original data and each data processing.

[0126] This shows a data recovery method using the original data similarity information T13. When normal copy data is not found in the search for the original (copy) data using the data history information in the data recovery process S300, the original data similarity information T13 is referenced to identify data with high similarity. Then, S305 is executed.

[0127] In the third embodiment, when a security threat such as ransomware occurs and recovery using normal copy data is difficult, a recovery method is provided using data that is highly similar to the original data through data processing and analysis during data processing. This makes it possible to recover data using the most recent data possible. [Explanation of symbols]

[0128] 20 server, 100 management server, 130, 230 storage device, 200 compute server, 300 storage device, 400 cloud storage, P10 data history collection unit, P11 data recovery unit, P21 data formatting unit, P22 data analysis unit, P23 check processing unit, P31 storage control unit, P32 data transfer unit, P20 data history management unit, T11 data history management information, T13 original data similarity information, 330 storage device unit

Claims

1. A method for recovering data stored in a storage system, comprising: The storage device holds the original data, An analysis server including a data analysis unit holds copy data which is a copy of the original data, and generates formatted data by formatting the copy data for analysis; A management server holds data history management information that stores the history of the copy data and the formatted data; When a security threat is detected in the data, a data recovery unit refers to data history management information, selects the copy data or the rectified data as recovery data, and recovers the data from the selected recovery data. Data recovery methods.

2. 2. The data recovery method according to claim 1, wherein the security threat is detected when an error occurs in the data formatting or analysis process.

3. The data history management information includes flag information that indicates that data processed without error is normal, 2. The data recovery method according to claim 1, wherein the data recovery section uses the data indicating that the flag information is normal as the recovery data.

4. The storage device performs a backup process to back up data to other storage devices, The data history management information includes time information indicating the time when processing was performed on the data, 3. The data recovery method according to claim 2, wherein the data recovery section selects data to be used as recovery data based on time information related to the copy process and the backup process.

5. The processing type of data history management information includes copying, formatting, and analysis types.

2. The data recovery method according to claim 1, wherein the data recovery unit selects data to be recovered in the order of priority: copying, formatting, and analysis.

6. The data history management information holds similarity information that indicates the difference with the data before and after processing. If the processing type is either formatting or analysis, the output unit outputs the similarity of the selected data.

6. The data recovery method according to claim 5, wherein the data recovery section uses the selected data as the recovery data when the input section receives information permitting the use of the selected recovery data.

7. A data recovery system for data stored in a storage system, comprising: A storage device for storing original data; an analysis server that holds copy data that is a copy of the original data and generates formatted data by formatting the copy data for analysis; a management server that holds data history management information that stores the histories of the copy data and the shaped data; A data recovery system comprising a data recovery unit that, when a security threat is detected in the data, refers to data history management information, selects the copy data or the reformatted data as recovery data, and recovers the data from the selected recovery data.

Images