Hong Kong | English Locations

+852 5808 7353 Start Your Data Recovery
+852 5808 7353
+852 5808 7353
Start Your Data Recovery

Ransomware Recovery – Veeam Agent for Windows

Written By: Ontrack

Date Published: August 28, 2022 9:27:59 pm GMT-04:00

Ransomware Recovery – Veeam Agent for Windows

Arrow Left Back to listing

The Situation

A health care customer was affected by a ransomware attack that not only targeted their server data, but also “Veeam Agent for Windows” backups located on an external HDD. Their IT / managed services provider agreement did not include regular off-site backups, so this was the only copy of the data that existed.

The Solution

 

The customer was able to send the affected HDD to Ontrack, where an image of the drive was taken to preserve the original state of the customer media.

Ontrack engineers assessed the damage to the affected Veeam backup files and identified that partial recovery would be possible as the files had not been fully encrypted, meaning there was a chance that some data could be recovered from within the files. However, it was determined that the version of Veeam used was newer than Ontrack could support with current tools and required development assistance.

With a global engineering presence, as well as internal development teams that maintain and improve our proprietary tools, Ontrack was able to research, develop and implement support for the new version quickly. In fact, much of the time-intensive research required had already been completed for similar jobs seen in our European offices. This allowed Ontrack developers to quickly and efficiently modify tools to the level required to be able to support this restore scenario. Rather than building out a fully-fledged tool, Ontrack engineers were able to use the improved version of the tools to complete searches for required structures to allow them to manually rebuild internal components critical to the recovery of data from within the file.

The Resolution

Once repairs to the files had been completed, engineers were able to use their remaining Veeam tool set to complete an extraction of data from within the repaired files. The recoverable data consisted of many flat file data types that had been completely lost to the customer during the ransomware attack.

Subscribe

Related Topics

Merge files of damaged backup with corresponding virtual files

Ransomware attacks server – backup tapes erased

New tools made recovery from highly specialized EMC® Isilon® possible
Services
Products
Resources
About

KLDiscovery Ontrack (H.K.) Limited, 148 Electric Road 12/F, Unit 1203A, North Point, Hong Kong (see all locations)

© 2024 KLDiscovery Ontrack - All Rights Reserved.