• The data node is the single point of failure in every High Speed Discovery cluster—and when it goes down, every worker node goes with it.
• Symantec DLP's Cluster Admin Tool lets you reconnect your cluster and restore all scan states to a new Data Node, without reinstalling a single worker node.
• With Symantec DLP, you can protect both your Incremental Index and Automatic Remediation Tracking history, allowing scans to resume right where they left off. 

Finding sensitive data across sprawling environments is much easier said than done. File shares, NAS devices, cloud storage, and collaboration platforms can hold millions (or even billions) of files, making data discovery a challenge for even the most mature security teams. But high-speed scanning flips the script. Built to inspect massive data repositories quickly, organizations can maintain continuous visibility into their sensitive data without turning every scan into a days-long project. 

But speed is only as valuable as it is resilient. One data node failure could take down your entire discovery program. Not anymore.  

The hidden fragility at the heart of HSD

High Speed Discovery (HSD) is built to be fast. A single cluster can inspect data at terabytes per hour, distributing work across dozens of worker nodes coordinated by a single data node. That architecture is powerful. It’s also structurally exposed.

This is because the data node holds everything: the work queue, the configuration synced from Enforce, and the Incremental Index that tells the cluster what it has already seen. If that server fails and cannot recover, the cluster goes dark. Worker nodes are orphaned. The only path back used to be reinstalling each worker node, one by one, pointing it at a new data node, a time-consuming process.  Every hour of that recovery is an hour your discovery program is rendered blind.

What disaster recovery for HSD changes

Starting with Symantec DLP 25.1 and extended in Symantec DLP 26.1, Symantec introduced native Disaster Recovery support through the Network Discover Cluster Admin Tool—a command-line utility that gives administrators direct, scriptable control over cluster recovery and other cluster management tasks. The headline result: Recovery from a total data node loss now means installing one new data node and running a handful of commands—not reinstalling every worker node in the cluster.

Two pillars of cluster state—both protected

The incremental index: Your scan memory

High Speed Discovery's Incremental mode builds an index of every file scanned—what was found and when. This is what makes subsequent scans focus only on changed content instead of re-inspecting the entire repository.

Before HDR support, that index lived solely on the data node. A hardware failure erased it, forcing every subsequent scan to restart from scratch. The incremental-index-backup command (Symantec DLP 25.1) captures the index as a timestamped zip file; incremental-index-restore brings it back to a new data node so the next scan resumes as incremental. Not a cold restart.

ART History: Your remediation intelligence

Automatic Remediation Tracking (ART) accumulates its intelligence over successive scan cycles, comparing current findings against prior incidents to determine whether a violation is still active, a file was modified, or a policy change resolved the issue.

Losing that history to a data node failure doesn't just inconvenience your team.  It actively breaks ART. Previously resolved incidents can re-open; files already evaluated appear fresh to the engine. The art-backup command (Symantec DLP 26.1) protects this history, and art-restore brings it back coherent and continuous to the new data node.

A single command for both

The backup-all and restore-all commands Symantec DLP 26.1 give administrators a single operation that covers both: one zip file, one restore command, and a complete cluster state is recovered. No sequencing, no risk of restoring one without the other.

How the recovery process works

The full recovery sequence is documented in the Symantec DLP Help Center. But in practice, it can be summarized  to three phases:

1. Before the disaster: Establish a backup routine. Run backup-all periodically from the data node, storing the output zip on storage outside the data node server. The frequency you choose determines how much work might need to be repeated after recovery.
2. When disaster strikes: Install one server, reconnect the rest. Install the data node software on a new server. Update the cluster IP in the Enforce console if needed (all policies and profiles re-sync automatically). Then run update-cluster-details on each worker node. This single command re-associates the worker node with the new data node—no reinstallation required.
3. After the disaster: Restore and resume. Run restore-all pointing at the backup zip. Once complete, run your existing scan targets unchanged. The cluster resumes from its last backup checkpoint.

Built for recovery with zero disruptions

Disaster recovery shouldn’t create new problems while it’s solving existing ones. That’s why the Cluster Admin Tool is deliberately designed for safe production use. This tool:

☑️ Respects active scans. Backup and restore skip targets that are actively scanning, rather than interfering. Results are reported per-target in the backup manifest.

☑️ Protects in-progress operations. If a backup or restore is running for a target and a scan is triggered for that same target, the scan simply queues and waits. A Walk activity log entry explains exactly what’s happening.

☑️ Survives its own crashes. If the tool or the Detector process restarts mid-operation, the operation continues to completion on the data node. The tool reports the results the next time it’s launched.

☑️ Gives you visibility. The get-pending-command command reports the status of any in-progress operation — no black boxes during recovery.

Picking up where you left off 

We know how much time goes into building and maintaining a resilient discovery program. That’s why disaster recovery isn’t just about getting a cluster back online. It’s about protecting the work your team has already accomplished. 

If you’re using Incremental Scan, disaster recovery support protects every investment your program has made in scan efficiency. Instead of starting from scratch after a data node failure, you can pick up right where your last backup left off. The same is true for ART. Support is not optional, but a prerequisite for reliable ART operation. Without it, a single outage resets the incident history that ART's classifications depend on.

These benefits also extend beyond day-to-day operations. Compliance teams won’t have to worry that a data node failure will derail scheduled scan cycles, with recovery measured in command executions rather than business days.

For operations teams, planned maintenance windows no longer need to be scheduled around active scan cycles. They can take the data node offline, restore when back, and resume scanning—all without touching a single scan target configuration.

Don’t just recover, resume 

Disaster Recovery support is available now in Symantec DLP 25.1 with Incremental Index backup and restore,  and expanded in Symantec DLP 26.1 to include ART backup and restore with backup-all and restore-all commands. Best of all, the Cluster Admin Tool ships as a standalone package, making it easier than ever to add these capabilities without modifying your existing installation.

For a complete breakdown of command syntax, parameters, prerequisites, and a step-by-step configuration, see the Network Discover Cluster Admin Tool documentation.

Not yet running High Speed Discovery? Reach out to your in-region expert for a 1:1 demo.