Great Britain | English Locations

+44 (0)13 7274 1999 Start Your Recovery
+44 (0)13 7274 1999
+44 (0)13 7274 1999
Start Your Recovery

Ransomware Recovery – Veeam Agent for Windows

Written By: Ontrack

Date Published: 15 August 2022 21:23:53 EDT

Ransomware Recovery – Veeam Agent for Windows

Arrow Left Back to listing

The Situation

A health care customer was affected by a ransomware attack that not only targeted their server data, but also “Veeam Agent for Windows” backups located on an external HDD. Their IT / managed services provider agreement did not include regular off-site backups, so this was the only copy of the data that existed.

The Solution

The customer was able to send the affected HDD to Ontrack, where an image of the drive was taken to preserve the original state of the customer media.

Ontrack engineers assessed the damage to the affected Veeam backup files and identified that partial recovery would be possible as the files had not been fully encrypted, meaning there was a chance that some data could be recovered from within the files. However, it was determined that the version of Veeam used was newer than Ontrack could support with current tools and required development assistance.

With a global engineering presence, as well as internal development teams that maintain and improve our proprietary tools, Ontrack was able to research, develop and implement support for the new version quickly. In fact, much of the time-intensive research required had already been completed for similar jobs seen in our European offices. This allowed Ontrack developers to quickly and efficiently modify tools to the level required to be able to support this restore scenario. Rather than building out a fully-fledged tool, Ontrack engineers were able to use the improved version of the tools to complete searches for required structures to allow them to manually rebuild internal components critical to the recovery of data from within the file.

The Resolution

Once repairs to the files had been completed, engineers were able to use their remaining Veeam tool set to complete an extraction of data from within the repaired files. The recoverable data consisted of many flat file data types that had been completely lost to the customer during the ransomware attack.

 

Subscribe

Related Topics

Ontrack helps global pharmaceutical restore 400 virtual disks

Accounting Database Recovered from a lost VMware Virtual Disk

Ransomware attacks server – backup tapes erased
Services
Products
Resources
About

KLDiscovery Ontrack Limited, Nexus, 25 Farringdon Street, London, EC4A 4AB, United Kingdom (see all locations)

© 2024 KLDiscovery Ontrack - All Rights Reserved.