Merge files of damaged backup with corresponding virtual files
The Client
A manufacturing company
Challenge
An international manufacturing company and supplier for airport transportation was hit by a cyberattack. Following their IT guidelines, the company was AIR GAPPING their tape backups on a regular basis. Unfortunately, the restoration of the virtual backup from tape failed and they quickly detected that some tapes were missing. The tapes were found left in the tape library being quick formatted. Originally these tapes belonged to different virtual backup sets. The LTO6 set consisted of 13 tapes and two tapes were missing. In fact, the company was missing three months’ worth of data!
Solution
The Ontrack team was able to join the client’s team for a consultation and scoped out the loss of data, including identifying which tapes needed to be worked on. Based on the scope, Ontrack determined a project plan, expected timing, and expected costs for the recovery.
All tapes from the tape library and the AIR GAPPED tapes were sent to Ontrack. Additionally, the customer provided all fully intact incremental virtual files separately on external USB drives.
Twenty-four tapes had to be unformatted in several steps. In a subsequent step, two missing tapes had to be identified and the exact order and offsets within a set of 13 tapes had to be determined. As a result, the required 25TB virtual file could be merged.
An enormous challenge was still ahead since the virtual backup contained 19 flat files, two of them partly damaged. As expected, the missing data caused native virtual extractor to produce integrity and decompression error messages. Using Ontrack’s proprietary tools, the engineers extracted the virtual files. But, that still left the problem of the 68 incremental virtual files to update to the latest version. Ontrack’s just-in-time software development team provided the necessary tools to complete the merge of the damaged files with the corresponding virtual files to create the most recent irtual files with a total 34TB of data.
As a final step, the other virtual files were analyzed and only some had to be repaired.
Result
When the client initially introduced the issue, there was little hope for a full recovery, or any recovery, given the complex nature of this specific data recovery task. However, our engineers’ diligence resulted in the creation an unprecedented data recovery solution for all damaged virtual backups, now solely available through Ontrack.
The customer was able to fire up most of the VMs with nearly all current data available!