United States | English Locations

855.558.3856 Start Your Data Recovery
855.558.3856
855.558.3856
Start Your Data Recovery

Data Recovery from Malware-Infected Virtual Files

Written By: Ontrack

Date Published: August 14, 2022

Data Recovery from Malware-Infected Virtual Files

Arrow Left Back to listing

Challenge

The customer suffered a cyberattack that left 100 servers partially encrypted. The ransom demanded by the hacker was over 400,000€. Federal police were unable to identify the ransomware type but determined that it had been designed specifically to target the organisation. 

The customer had a SAN with 50 drives. After forensic analysis, it was found that all data inside the LUNs had either been deleted or overwritten. The attack affected six LUNs, each 25TB in size, with different file systems: four ReFS and two NTFS.

Solution

Ontrack’s engineers managed to repair the logical damage, allowing the recovery of every file in the four ReFS systems. The Ontrack team then created a custom tool that allowed them to piece together the NTFS file system and duplicate the database, so that the data from a backup could be extracted and delivered to the customer.

Result

Ontrack engineers were able to overcome the odds and recover the client’s critical data, avoiding a large ransom payment.

Subscribe

Related Topics

Only Available at Ontrack: IBM Storwize Data Recovery

Ontrack Retrieves Lost Images for Photographer

A Deep Dive for Dell/EMC Isilon Data
Services
Products
Resources
About

KLDiscovery Ontrack, LLC, 9023 Columbine Road Eden Prairie, MN 55347, United States (see all locations)

© 2024 KLDiscovery Ontrack - All Rights Reserved.