Even though the automatic recovery techniques of workflow have attracted enough attention in recent years, several critical issues regarding the distributed recovery have not been addressed. For example, if we do the recovery under sustained attacks, in which condition the recovery can terminate? Is a synchronized clock necessary for distributed recovery? In this paper, we proposed a dead-lock free attack recovery algorithm for coordinated recovery and answered related questions. We defined different IDS report orders, and discussed the termination of the recovery under the given IDS report orders. We also proved that under specific situations, we have to freeze the recovery scheme to guarantee that the recovery can make progress.