A ransomware attack of a company server encrypted the Microsoft Dynamics 365 data and demanded payment. Recent backups of the server were stored on multiple LTO-6 backup tapes, which had been erased by the malware. 

After assessing the extent of the ransomware attack, Ontrack representatives identified the company’s backup tapes as the best option for data recovery—even though the malware had erased them. 23 LTO-6 backup tapes from the backup library were sent to the Ontrack office in Böblingen, Germany. Working in conjunction with the R&D department in the United Kingdom, Ontrack developed a custom solution to recover the data from the erased backup tapes.

The attacked volume was originally also used to back up data to LTO8 tapes at regular intervals. Most of these backup tapes were also in the tape library at the time of the incident and were quickly formatted by the attackers. However, the customer was able to save an original unformatted tape with a fairly old backup date, which was then completely restored to the now empty Windows volume with a total of 6 TB. Only then was Ontrack commissioned to examine data recovery options. The HP server DL380 with the 55 3TB hard disks were transported to Ontrack in Böblingen Germany.

During the diagnosis, a large number of the searched VEEAM vbk files were successfully found on the Windows volume with Ontrack Tools and 27 records were extracted according to a priority list. The restore of the LTO8 tape partially overwrote some of the data sets and damaged the backup files. 

Meet Doug, Director of Client Services from ViewLift, a digital content distribution technology company located in the NoHo neighborhood of New York City. Doug experienced both a computer crash and an operating system that was wiped clean, and found himself asking those exact questions.

After some initial research and numerous referrals from computer retail and repair businesses, including a local Apple retail store that said it no longer performed data recovery work, Doug found answers to all his questions at the uBreakiFix store in Greenwich Village.

The uBreakiFix team introduced him to Ontrack, the global leader in data recovery. The in-store team talked Doug through his data recovery options and explained the process.

“I really didn’t have a preconceived notion of what uBreakiFix actually did. I thought that they were only a cell phone repair store, but they do much more,” said Doug. “The experience was great, the prices were fair and it was great to know that when I walked in the store I was greeted by the staff in an friendly manner—and in New York that is not always the case.”

A marketing freelancer based in Switzerland entrusted all of their business and personal data to two RAID drives attached to their Apple Macintosh and asked their IT service partner for help when the data disappeared. The partner called on Ontrack to provide specialist engineering skills and know-how to fix the problem.

A flooded data center left a client’s servers and storage systems partially submerged in water.

At the center of the damage was a HP Storage Works EVA (Enterprise Virtual Array) 6000 containing business critical SQL database files as well as employee file shares. The EVA sustained substantial physical damage due to the flood water preventing access to the data. The severity of the damage from the flood was increased when an attempt was made to access the data by powering on the drives that were still wet. The customer contacted HP Support for help and they handed the project over to Ontrack.

The SAN consisted of 80 hard disk drives which were divided into 2 EVA disk groups; in total there were 18 virtual RAID volumes consisting of both VRAID1 and VRAID5.

A HP EVA system is fully virtualized and has a unique way to write data which adds to the complexity of any data recovery effort. It works with disk groups and virtual disks instead of normal RAID sets and logical drive volumes. The disk groups consist of physical drives organized in a proprietary manner. LUNs or Virtual disks (vDisks) in an EVA are then distributed over all of the installed HDDs.

Due to the physical damage, all of the drives were sent to one of Ontrack´s cleanroom facilities to be assessed.

Once the 80 drives were decontaminated and cleaned, 55 were found to be fully recoverable. 25 of the drives had severe water damage and were not recoverable. To regain access to the data on the damaged drives, the engineers needed to research how the EVA RAID and file system was structured. After the engineers were able to map the disk groups and determine how the vDisks were distributed, they had to rebuild the whole EVA system. To recover the data included in the vDisks, the R&D team and its software developers had to create completely new tools to extract the data. Once the development was complete, Ontrack engineers virtually assembled the disk groups and virtually rebuilt the vDisks which allowed access to the underlying file systems. The file systems were virtually repaired and the data extracted.