CODEWITHSUNDEEP
powershellcopyrestore
Coxswain
Coxswain

Reputation: 153

Copying files while preserving directory structure

One of our sites was recently hit by a CryptoLocker infection. Fortunately we caught it early and only have about 8k files encrypted out of the 200k or so on the file-system. Our backups were good too, so I can restore the files

I have a list of all ~8k of the encrypted files in roughly the following format, one file per new line:

\\nas001\DATA\IQC\file.xls
\\nas001\DATA\IQC\file2.xls
\\nas001\DATA\IQC\folder1\file1.xls
\\nas001\DATA\IQC\folder3\file1.xls

I did an ndmp copy of a snapshot of good data, so the backup I am restoring form is another volume on the nas with the same folder structure after a certain point:

\\nas001\IQC_restore\file.xls
\\nas001\IQC_restore\file2.xls
\\nas001\IQC_restore\folder1\file1.xls
\\nas001\IQC_restore\folder3\file1.xls

Is there an easy way with powershell (or really, with batch scripting or robocopy) parse the files with the list of encrypted files and copy only those files from our backup to the original location, overwriting the encrypted files? On another solution I found the following script:

$a = Get-Content "C:\script\hname.txt" 
foreach ($i in $a) 
    {$files= get-content "C:\script\src.txt"
    foreach ($file in $files)
    {Copy-Item $file -Destination \\$i\C$\temp -force}
    }

Which is almost what I need - the foreach $i in $a statement is redundant because I only have one $i, and it's copying all the files listed in the to a single folder rather than copying them in a way to preserve folder structures.

What's the best way to do this? Can I pass it two separate files and tell it to link the two line for line, so for each line in file a it copies the file to the path in file b? Is it easier to pass it one set of files (file a), perform a string replacement, and copy to that location?

Thank you!

Upvotes: 2

Views: 1100

Answers (1)

Goyuix
Goyuix

Reputation: 24330

I am perhaps making too broad an assumption here - but really the paths between encrypted and restored files are identical as long as you make the appropriate substitution between \\nas001\DATA\IQC and \\nas001\IQC_restore correct? If so....

You can simply take each file from the "known bad files" file (hname.txt?) and substitute the correct path for the destination using the String.Replace method:

$files = Get-Content C:\script\hname.txt
foreach ($file in $files) {
    $src = $file.Replace("\\nas001\DATA\IQC","\\nas001\IQC_restore")
    Copy-Item $src -Destination $file -Force
}

Or, to be even more brief:

$enc = '\\nas001\DATA\IQC'      # encrypted files share/folder
$good = '\\nas001\IQC_restore'  # clean share/folder
gc c:\scripts\hname.txt | % { copy $_.replace($enc,$good) -dest $_ -force }

The secret decoder ring:

  • gc is an alias for the Get-Content cmdlet
  • % is an alias for the ForEach-Object cmdlet
  • $_ is a special variable inside a foreach scriptblock that represents the "current item" that is being passed in from the pipeline - in this case each line from the input file hname.txt

Upvotes: 2

Related Questions