Restart copy vs rebuilding from scratch
Rebuilding is not a strategy anyone chooses. It is what happens when the copies meant for recovery died with the network. Since attackers target the recovery estate deliberately, rebuilding is the default outcome for most victims, which is why published incident reporting puts average restoration around 24 days.
What rebuilding actually involves
Week one: forensics and triage. Nothing can be trusted, so nothing can be restored yet. Identity comes first; rebuilding a domain from nothing while under pressure is its own project. Week two: reimaging machines, reconstructing configurations from memory, PDFs, and whatever a retired contractor still has on a laptop. Week three and onward: applications return one by one, data gaps surface, and finance discovers what three weeks of pen and paper did to receivables. Somewhere in there, the ransom conversation happens, not because anyone wants it, but because day twelve makes people practical.
What changes with a restart copy
The forensics still happen. The difference is that operations restart in parallel, from a copy verified clean and physically beyond the attack, instead of waiting for the rebuild. The extortion conversation never starts, because the leverage is gone. The 24 days become the attacker's problem, not yours.
Put numbers on it
The gap between rebuilding and restoring is measurable in your own figures: revenue interrupted, payroll idle, external services engaged for weeks instead of days.