If I remember correctly, we were able to restore folders from the shadow copies. I certainly didn’t go file by file. I might have used a tool to do it. But as you pointed out, it’s not a proper backup so we had to do quite a bit of reconciliation to make sure we restored everything and document anything we couldn’t restore.










Actually yes. The attack actually happened during the first week of the new director being there.
No, there is no indication that the old director had anything to do with it.