Case description:

Another victim encountered ransomware attack again. It happened out of sudden. They are doing their daily routine normally, until he found out that they cannot access their accounting system. User failed to log in, while accessing their database files. All extension was changed to “Mr. Dec”. Entire Server data been encrypted by ransomware, their server backup drive was infected as well. Client took their Server and Backup drive to our recovery centre, and we took 2 business days to analyze the ransomware.  The result is positive, database files recovered!

Action (Solution):

As usual, various image was done from original source. Cloned drive was use for analyzing the ransomware. Subsequently, our recovery specialist tries to salvage the data by understand the logics and structure of ransomware.

The Outcome

Many database files successfully recovered. As we are not the accounting software specialist, the linkage of files is all affected. User got back the data base files and look for their vendors to repair it. The recovered data have valid data that needed by client.

Suggestion

For server that infected by ransomware, you may look for any recovery centre to diagnose the data. Normally ransomware infected through mail or other third parties application and seek for user acknowledgement to access which most of the user will click on suspicious link or click on “agree” without reading through the prompted message by Antivirus or software. Prevent is always better than solving. Please do not hesitate to seek for advice from Ever Higher Data Recovery Centre. We are always here to help.

Ever Higher Data Recovery Centre. We left no data behind.