Virtual Machine and Backup Recovery After Ransomware
Attackers go for the hypervisor and the backups first, because that is what makes a business pay. Encrypted VMware, Hyper-V and Proxmox disks and wiped backup repositories can very often be rebuilt.
Why virtual machines are a target
One encrypted host takes every server on it down at once: the file server, the accounting system, the domain controller, email. Modern ransomware groups ship versions written for ESXi and Hyper-V for exactly that reason, and many of them encrypt only sections of each virtual disk so they can finish in minutes.
That shortcut is what makes recovery possible. A virtual disk of several hundred gigabytes that has been partly encrypted still holds most of its file system, and from it we can rebuild the guest's volumes, its files and often the whole machine.
What we work on
- VMware ESXi and vSphere: VMDK virtual disks, flat and snapshot files, VMFS datastores
- Microsoft Hyper-V: VHD and VHDX disks, checkpoints, Cluster Shared Volumes
- Proxmox and KVM: qcow2 and raw disks, LVM and ZFS storage
- Veeam: encrypted, deleted or damaged VBK and VIB backup files and repositories
- Other backups: Windows Server Backup, NAS backup shares, USB backup drives and image files
- The storage underneath: RAID arrays, SAN volumes and NAS units used as datastores
How we approach it
Stop the damage
Hosts and storage stay powered but cut off from the network, and nothing writes to the datastores or the backup repository.
Image everything
Every disk in the host or array is copied before any analysis. If the array needs it, it is reassembled from the copies, not the originals.
Map the encryption
We measure which parts of each virtual disk and backup file were encrypted and which were not.
Rebuild
Guest file systems, databases and backup chains are reconstructed from the readable data, the most important machines first.
Hand back
You check the list of recovered machines and files, then get the data back on new storage, ready to restore onto a clean host.
What to do before you call
- Do not reboot the hosts, delete snapshots or run a restore over the encrypted machines.
- Do not reinitialise the backup repository or run a "repair" on it.
- Disable scheduled backup and replication jobs so they do not overwrite the last good copies.
- Write down the hypervisor version, the storage model and the backup software, if you know them.
Done in partnership with Recoveo
Cases come to us from across the United States, Canada and Central and South America: we start remotely, and disks or whole hosts are shipped to the lab. This work is carried out with Recoveo, the specialised laboratory we run our Los Angeles ransomware lab with. Their engineers have recovered Veeam backups and SAN data for businesses hit by groups such as Akira.
Questions
The whole datastore was encrypted. Is anything left?
Usually, yes. Datastores are large, and ransomware rarely has time to encrypt all of every disk. The diagnosis shows how much can be rebuilt before you commit.
Can you recover a single server first?
Yes. Tell us which machines the business needs first, such as the domain controller or the accounting server, and we work in that order.
Our Veeam backups were deleted. Can they come back?
Often. Deleted backup files leave their data on the repository disks until it is overwritten, so stop all backup jobs and writes to that storage straight away.
Will you rebuild our servers afterwards?
Our IT team can rebuild hosts, restore the recovered machines and put backups the attackers cannot reach in place.
Start a ransomware case
Call (213) 986-4855 or open a case online and tell us the hypervisor, the storage and the backup software involved.