> you can recover from it by simply ignoring it as it does not overwrite any prior valid data
The point I'm trying to make is that a lot of systems interact with other systems.
For example, imagine my system generates an invoice, sends the invoice to a third-party for collection, the collection system replies with a token to track the invoice in their system. Finally the invoice is marked as paid once the third-party system returns an "invoice paid" message with that token.
Now imagine the system generated an invoice and sent it to collection, and is then hit by ransomware. I restore from backup or as you say ignore the data since the attack. Except now I don't have the token, so when I get an "invoice paid" message I don't know which invoice that was for.
We have several integrations which work not entirely unlike this, and disentangling the mess of these "desynchronization events" is what has taken the majority of our time when helping a customer after after a ransomware attack. Fortunately it's only been one or two a year.
