United States | English Locations

855.558.3856 Start Your Data Recovery
855.558.3856
855.558.3856
Start Your Data Recovery

NetApp and Ontrack vs. CryptoLocker Ransomware

Written By: Ontrack

Date Published: Apr 27, 2020 12:00:00 AM

NetApp and Ontrack vs. CryptoLocker Ransomware

Arrow Left Back to listing

Ontrack and NetApp recently battled the CryptoLocker ransomware virus.

The Damage of CryptoLocker

The battle begins with a single laptop at a large pharmaceutical company infected with CryptoLocker ransomware, a malware that encrypts files and holds the key until the user pays the ransom amount.  Once the laptop was on the company’s network it was able to access a CIFS volume set up as a file share on a NetApp FAS. The virus was able to infiltrate the file share and encrypt the majority of the files. This infection impacted the user’s entire department, bringing their day to day operations to a grinding halt.

The customer’s IT team was not notified of the CryptoLocker infection until after the backup retention period had expired.

The total damage count:

46 drives

1 aggregate (needed to be taken offline which affected 17 volumes)

1 infected volume on a RAID DP

Enter Ontrack

The customer brought everything into the Ontrack lab in New Jersey for evaluation. Our engineers suited up and started work on a solution. They rebuilt the RAID groups written across 10 different shelves, the aggregate and the critical volume. Additional damage was found on the aggregate when we discovered that it had been used for two weeks after the infection and data was overwritten.

NetApp’s Secret Weapon

Due to the way, NetApp’s proprietary file system WAFL is set up, Ontrack engineers were able to ‘walk back in time’ and recover the data.  Data recovery on NetApp systems occurs at the aggregate layer. Being WAFL creates checkpoints every 10 seconds, our engineers were able to identify multiple checkpoints and merge the data to provide the customer access to unencrypted copies of their original data.

Victory

Ontrack’s data recovery expertise combined with NetApp’s technology and data writing methods enabled us to declare victory over the CryptoLocker ransomware. We were able to find a way to recover unencrypted copies of the data that had been encrypted (and being held for ransom) and return them to the customer.

Live Recap

Ontrack engineering teamed up with NetApp to discuss the fight against ransomware. Watch our recent webinar that discusses NetApp's data protection capabilities and Ontrack's enterprise storage recovery offerings. 

Subscribe

Related Topics

Encryption - What Would it Take to Crack It?

What Does Encrypted Mean? The Various Levels of Encryption

6 simple tips to protect yourself against ransomware
Services
Products
Resources
About

KLDiscovery Ontrack, LLC, 9023 Columbine Road Eden Prairie, MN 55347, United States (see all locations)

© 2024 KLDiscovery Ontrack - All Rights Reserved.