{"id":86549,"date":"2026-09-23T12:18:51","date_gmt":"2026-09-23T19:18:51","guid":{"rendered":"https:\/\/drivesaversdatarecovery.com\/?p=86549"},"modified":"2026-09-24T08:50:25","modified_gmt":"2026-09-24T15:50:25","slug":"vmdk-data-recovery-after-an-akira-ransomware-attack","status":"publish","type":"post","link":"https:\/\/drivesaversdatarecovery.com\/da-dk\/case-studies\/vmdk-data-recovery-after-an-akira-ransomware-attack\/","title":{"rendered":"VMDK Data Recovery After an Akira Ransomware Attack"},"content":{"rendered":"<div class=\"wpb-content-wrapper\"><div id=\"case-study-image-and-title\" class=\"vc_section blog-header-top-padding vc_custom_1743006484198 wpex-vc-full-width-section wpex-vc-full-width-section--centered wpex-relative wpex-vc_section-has-fill wpex-vc-reset-negative-margin\"><div class=\"vc_row wpb_row vc_row-fluid wpex-relative no-bottom-margins\"><div class=\"wpb_column vc_column_container vc_col-sm-12\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\">\n\t<div class=\"wpb_raw_code wpb_raw_html wpb_content_element\" >\n\t\t<div class=\"wpb_wrapper\">\n\t\t\t  <style>\n\n.vcex-video.wpex-bg-black {\n  border-radius: 15px;\n  overflow: hidden;\n}\n\n.vcex-video-inner video {\n  border-radius: 15px;\n}\n\n.case-study-video {\nborder-radius: 15px !important;\n}\n\n.cs-red-heading {\n      color: #EC0912;\nfont-weight: 600;\n    }\n.vcex-heading-inner {\nmargin-bottom:12px;\n}\n        .single-post-title {\n            display: none;\n        }\n    ul.meta {\n       display:none;\n        }\n\n.parent-div {\n  display: flex !important;       \/* Lay the items out in a row by default (desktop) *\/\n  flex-wrap: nowrap !important;   \/* Prevent wrapping on large screens *\/\n}\n\n\/* When the screen is below, say, 768px, wrap and make each child 50% width *\/\n@media (max-width: 768px) {\n  .parent-div {\n    flex-wrap: wrap !important;   \/* Allow wrapping on smaller screens (mobile) *\/\nfont-size: 15px !important;\n  }\n  .parent-div > div {\n    width: 50% !important;        \/* 2 columns (two items per row) *\/\n    box-sizing: border-box !important; \n  }\n.cs-quote-headshot {text-align: center;margin-bottom:13px;}\n.cs-quote-box {\n    margin-left: 30px;\n    margin-right: 30px;\n\n}\n.cs-quote-headshot-image {\nmax-width: 170px;\nmargin-bottom:13px;\nmargin: auto;\n}\n.cs-quote-nametitle {\ntext-align: center !important;\nalign-items: center !important;\n}\n\n}\n\n.cs-main-image-header .wpex-p-30 {\n    padding: 0 !important;\n    padding-left: 3% !important;\npadding-bottom: 3% !important;\n}\n\n.cs-main-image-header .wpex-items-center {\n    align-items: end !important;\n}\n\n@media screen and (max-width: 1300px) {\n    .cs-main-image-header .vcex-ib-content .vcex-ib-title {\n        font-size: 3.5vw !important;\n    }\n\n    .cs-main-image-header .vcex-ib-content .vcex-ib-caption {\n        font-size: 5.5vw !important;\n    }\n}\n\n.cs-main-image-header .vcex-ib-content {\n text-shadow: 0 0 10px #000; \n}\n\n.vc_custom_1743006484198 {\n    margin-top: -10px !important;\n    padding-bottom: 4% !important;\n    background-color: #000000 !important;\n}\n\n.case-study-image-and-title\n{\n    margin-top: -10px !important;\n    padding-bottom: 4% !important;\n    background-color: #000000 !important;\n}\n.blog-header-top-padding\n\n{\n    margin-top: -10px !important;\n    padding-bottom: 4% !important;\n    background-color: #000000 !important;\n}\n  <\/style>\n\n\t\t<\/div>\n\t<\/div>\n<\/div><\/div><\/div><\/div><div class=\"vc_row wpb_row vc_row-fluid vc_custom_1764869151897 wpex-relative no-bottom-margins\"><div class=\"wpb_column vc_column_container vc_col-sm-12\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\"><style>.vcex-image-banner.vcex_6ab567329dd32 .vcex-ib-title{color:#fefefe;font-size:57px;font-family:'DM Sans', sans-serif;font-weight:600;}.vcex-image-banner.vcex_6ab567329dd32 .vcex-ib-caption{color:#ffffff;font-size:45px;font-family:'DM Sans', sans-serif;font-weight:600;}<\/style><div class=\"vcex-module vcex-image-banner wpex-flex wpex-flex-col wpex-w-100 wpex-justify-center wpex-relative wpex-overflow-hidden wpex-bg-gray-900 wpex-text-white wpex-hover-text-white wpex-text-left wpex-rounded-md vcex-has-img-tag cs-main-image-header vcex_6ab567329dd32\"><img  src=\"https:\/\/drivesaversdatarecovery.com\/wp-content\/uploads\/2026\/09\/VMDK-Data-Recovery-After-an-Akira-Ransomware-Attack-Header-1-1.png\" class=\"vcex-ib-img wpex-block wpex-transition-all wpex-duration-500\" alt=\"\"><div class=\"vcex-ib-content-wrap wpex-w-100 wpex-transition-all wpex-duration-500 wpex-absolute wpex-inset-0 wpex-flex wpex-items-center wpex-p-30\"><div class=\"vcex-ib-content wpex-flex-grow wpex-mr-auto\"><h3 class=\"vcex-ib-title wpex-heading\">VMDK-datagenoprettelse<\/h3><div class=\"vcex-ib-caption wpex-text-lg wpex-last-mb-0\">efter et Akira-ransomware-angreb<\/div><\/div><\/div><\/div><div class=\"vcex-spacing wpex-w-100 wpex-clear\" style=\"height:35px;\"><\/div><\/div><\/div><\/div><\/div><div class=\"vc_row wpb_row vc_row-fluid parent-div wpex-relative\"><div class=\"wpb_column vc_column_container vc_col-sm-1\/5\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\">\n\t<div style=\"color:#ffffff;\" class=\"wpb_text_column has-custom-color wpex-child-inherit-color wpb_content_element\" >\n\t\t<div class=\"wpb_wrapper\">\n\t\t\t<p class=\"translation-block\"><strong>Milj\u00f8:<\/strong><br>\n<span style=\"font-size: .8em\">VMware-milj\u00f8 sikkerhedskopieret af Nakivo til en 12-bay Synology RS3621RPXs, RAID 5, BTRFS<\/span><\/p>\n\n\t\t<\/div>\n\t<\/div>\n<\/div><\/div><\/div><div class=\"wpb_column vc_column_container vc_col-sm-1\/5\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\">\n\t<div style=\"color:#ffffff;\" class=\"wpb_text_column has-custom-color wpex-child-inherit-color wpb_content_element\" >\n\t\t<div class=\"wpb_wrapper\">\n\t\t\t<p class=\"translation-block\"><strong>Angreb:<\/strong><br>\n<span style=\"font-size: 0.8em\"><span style=\"font-weight: 400\">Akira-ransomware<\/span><\/span><\/p>\n\n\t\t<\/div>\n\t<\/div>\n<\/div><\/div><\/div><div class=\"wpb_column vc_column_container vc_col-sm-1\/5\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\">\n\t<div style=\"color:#ffffff;\" class=\"wpb_text_column has-custom-color wpex-child-inherit-color wpb_content_element\" >\n\t\t<div class=\"wpb_wrapper\">\n\t\t\t<p class=\"translation-block\"><strong>Data i fare:<\/strong><br>\n<span style=\"font-size: .8em\">Cirka 11 TB krypterede backups af virtuelle maskiner, resten slettet<\/span><\/p>\n\n\t\t<\/div>\n\t<\/div>\n<\/div><\/div><\/div><div class=\"wpb_column vc_column_container vc_col-sm-1\/5\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\">\n\t<div style=\"color:#ffffff;\" class=\"wpb_text_column has-custom-color wpex-child-inherit-color wpb_content_element vc_custom_1790182117035\" >\n\t\t<div class=\"wpb_wrapper\">\n\t\t\t<p class=\"translation-block\"><strong>Komplikation:<\/strong><br>\n<span style=\"font-size: .8em\">Cirka 15 TB skrevet til den samme diskenhed dagen efter angrebet<\/span><\/p>\n\n\t\t<\/div>\n\t<\/div>\n<\/div><\/div><\/div><div class=\"wpb_column vc_column_container vc_col-sm-1\/5\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\">\n\t<div style=\"color:#ffffff;\" class=\"wpb_text_column has-custom-color wpex-child-inherit-color wpb_content_element\" >\n\t\t<div class=\"wpb_wrapper\">\n\t\t\t<p class=\"translation-block\"><strong>Resultat:<\/strong><br>\n<span style=\"font-size: .8em\">99,91 % gendannet p\u00e5 den prioriterede databaseserver<\/span><\/p>\n\n\t\t<\/div>\n\t<\/div>\n<\/div><\/div><\/div><\/div><div class=\"vc_row wpb_row vc_row-fluid wpex-relative no-bottom-margins\"><div class=\"wpb_column vc_column_container vc_col-sm-12\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\">\n\t<div style=\"color:#ffffff;font-size:18px;\" class=\"wpb_text_column has-custom-color wpex-child-inherit-color wpb_content_element\" >\n\t\t<div class=\"wpb_wrapper\">\n\t\t\t<p>En flerlokations-virksomhed blev udsat for et Akira-ransomware-angreb, der forstyrrede adgangen til kritiske virtualiserede systemer og satte betydelige dele af dens produktionsmilj\u00f8 i fare. Cirka 11 TB backups af virtuelle maskiner, som l\u00e5 i kundens Nakivo-arkiv, blev krypteret. De resterende backups blev slettet.<\/p>\n\n\t\t<\/div>\n\t<\/div>\n<\/div><\/div><\/div><\/div><\/div><div id=\"case-study-blurb-and-scenario\" class=\"vc_section vc_custom_1772461320762 wpex-relative\"><div id=\"video\" class=\"vc_row wpb_row vc_row-fluid vc_row-o-content-middle vc_row-flex wpex-relative no-bottom-margins\"><div class=\"wpb_column vc_column_container vc_col-sm-12\" id=\"video\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\">\n\t<div style=\"color:#6f737e;font-size:18px;\" class=\"wpb_text_column has-custom-color wpex-child-inherit-color wpb_content_element\" >\n\t\t<div class=\"wpb_wrapper\">\n\t\t\t<p>Det samme angreb krypterede de virtuelle produktionsmaskiner, hvilket efterlod organisationen uden de data, der var n\u00f8dvendige for at genoprette forretningsdriften.<\/p>\n<p>Inden for f\u00e5 dage engagerede organisationen deres cyberforsikringsselskab og en incident response-virksomhed. Konventionelle genoprettelsesmetoder bragte dele af milj\u00f8et tilbage, men kunne ikke gendanne flere prioriterede virtuelle maskiner. Incident response-virksomheden eskalerede sagen til DriveSavers Data Recovery for at afg\u00f8re, om brugbare data stadig kunne gendannes fra den ber\u00f8rte lagring, og om beskadigede virtuelle maskindiske kunne genopbygges.<\/p>\n\n\t\t<\/div>\n\t<\/div>\n<\/div><\/div><\/div><\/div><\/div><div id=\"case-study-solution\" class=\"vc_section wpex-relative\"><div class=\"vc_row wpb_row vc_row-fluid vc_row-o-content-middle vc_row-flex wpex-relative no-bottom-margins\"><div class=\"wpb_column vc_column_container vc_col-sm-12\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\"><div class=\"vc_empty_space\"   style=\"height: 40px\"><span class=\"vc_empty_space_inner\"><\/span><\/div><style>.vcex-heading.vcex_6ab56732a1905{color:#3e3d3e;font-size:35px;font-weight:400;}@media (max-width:1024px){.vcex-heading.vcex_6ab56732a1905{font-size:25px;}}@media (max-width:959px){.vcex-heading.vcex_6ab56732a1905{font-size:25px;}}@media (max-width:767px){.vcex-heading.vcex_6ab56732a1905{font-size:25px;}}@media (max-width:479px){.vcex-heading.vcex_6ab56732a1905{font-size:25px;}}<\/style><div class=\"vcex-heading vcex-heading-plain vcex-module wpex-heading wpex-text-2xl wpex-div vcex_6ab56732a1905 translation-block\"><span class=\"vcex-heading-inner wpex-inline-block\">Situationen omkring <strong><span style=\"color: #e31f26\">datatabet<\/span><\/strong><\/span><\/div>\n\t<div style=\"color:#6f737e;\" class=\"wpb_text_column has-custom-color wpex-child-inherit-color wpb_content_element\" >\n\t\t<div class=\"wpb_wrapper\">\n\t\t\t<p>Da diskene n\u00e5ede frem til DriveSavers, var ransomware-krypteringen ikke l\u00e6ngere det eneste problem.<\/p>\n<p>Teknisk analyse ved hj\u00e6lp af vores propriet\u00e6re v\u00e6rkt\u00f8j til gendannelse af virtuelle diske identificerede cirka 15 TB data skrevet til diskenheden dagen efter angrebet \u2013 efter at Nakivo-backuppene allerede var blevet slettet. Disse skrivninger viste sig at f\u00e5 betydelige konsekvenser.<\/p>\n<p>At slette en fil p\u00e5 BTRFS sletter ikke dens indhold. Filsystemer af denne type markerer typisk de ber\u00f8rte blokke som tilg\u00e6ngelige til genbrug, mens selve dataene forbliver p\u00e5 plads, indtil noget skrives over dem. De skrivninger, der blev udf\u00f8rt efter angrebet, blev tildelt blokke, som de slettede backups havde optaget.<\/p>\n<p>Yderligere teknisk analyse viste, at en betydeligt st\u00f8rre del af de m\u00e5lrettede oplysninger, og potentielt det hele, sandsynligvis kunne v\u00e6re blevet gendannet, hvis den ber\u00f8rte lagring var forblevet u\u00e6ndret.<\/p>\n<p>Den diskenhed, der ankom til DriveSavers, indeholdt derfor en blanding af originale, intakte data, ransomware-krypterede data, slettede og omallokerede data, nyligt skrevet information, beskadigede filsystemstrukturer, og blokke, der delvist var blevet overskrevet. Cirka 3.600 filer, i alt 16,1 TB, forblev aktive, hvoraf 99 % var VMware virtuelle diske og snapshots med filtypenavne omskrevet til .AKIRA.<\/p>\n<p>Et kendetegn ved angrebet forbedrede udsigterne. Den krypteringsalgoritme, der blev brugt i denne h\u00e6ndelse, krypterede ikke hele filer. Den krypterede cirka 15 % af hver fil i tre b\u00e5nd, hvilket p\u00e5 de store VMDK-filer viste sig som cirka 5 % front-end-kryptering. Betydelige dele af hver virtuel disk forblev derfor intakte. Analyse p\u00e5 blokniveau var n\u00f8dvendig for at identificere disse intakte omr\u00e5der.<\/p>\n\n\t\t<\/div>\n\t<\/div>\n<\/div><\/div><\/div><\/div><\/div><div id=\"case-study-results\" class=\"vc_section vc_custom_1772464064344 wpex-vc-full-width-section wpex-vc-full-width-section--centered wpex-relative wpex-vc_section-has-fill wpex-vc-reset-negative-margin\"><div class=\"vc_row wpb_row vc_row-fluid vc_row-o-content-middle vc_row-flex wpex-relative no-bottom-margins\"><div class=\"wpb_column vc_column_container vc_col-sm-12\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\"><div class=\"vc_empty_space\"   style=\"height: 40px\"><span class=\"vc_empty_space_inner\"><\/span><\/div><style>.vcex-heading.vcex_6ab56732a2b84{color:#3e3d3e;font-size:35px;font-weight:400;}@media (max-width:1024px){.vcex-heading.vcex_6ab56732a2b84{font-size:25px;}}@media (max-width:959px){.vcex-heading.vcex_6ab56732a2b84{font-size:25px;}}@media (max-width:767px){.vcex-heading.vcex_6ab56732a2b84{font-size:25px;}}@media (max-width:479px){.vcex-heading.vcex_6ab56732a2b84{font-size:25px;}}<\/style><div class=\"vcex-heading vcex-heading-plain vcex-module wpex-heading wpex-text-2xl wpex-div vcex_6ab56732a2b84\"><span class=\"vcex-heading-inner wpex-inline-block\"><strong><span style=\"color: #e31f26\">The Recovery<\/span><\/strong> Process<\/span><\/div><div class=\"vc_empty_space\"   style=\"height: 20px\"><span class=\"vc_empty_space_inner\"><\/span><\/div><\/div><\/div><\/div><\/div><div class=\"vc_row wpb_row vc_row-fluid faq-accord-sec vc_custom_1790193320616 vc_row-o-content-middle vc_row-flex wpex-relative no-bottom-margins\"><div class=\"wpb_column vc_column_container vc_col-sm-12\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\"><div class=\"vc_tta-container\" data-vc-action=\"collapseAll\"><div class=\"vc_general vc_tta vc_tta-accordion vc_tta-color-grey vc_tta-style-total vc_tta-shape-rounded vc_tta-o-shape-group vc_tta-controls-align-default vc_tta-o-all-clickable  accord-column vc_custom_1746707767615\"><div class=\"vc_tta-panels-container\"><div class=\"vc_tta-panels\"><div class=\"vc_tta-panel vc_active faq-accord-title\" id=\"1716890254482-90592e71-20fa\" data-vc-content=\".vc_tta-panel-body\"><div class=\"vc_tta-panel-heading\"><h4 class=\"vc_tta-panel-title vc_tta-controls-icon-position-right\"><a href=\"#1716890254482-90592e71-20fa\" data-vc-accordion data-vc-container=\".vc_tta-container\"><span class=\"vc_tta-title-text\">Fjerngendannelse vurderet og afvist<\/span><i class=\"vc_tta-controls-icon vc_tta-controls-icon-chevron\"><\/i><\/a><\/h4><\/div><div class=\"vc_tta-panel-body\"><div class=\"vc_row wpb_row vc_inner vc_row-fluid wpex-relative no-bottom-margins\"><div class=\"wpb_column vc_column_container vc_col-sm-12\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\">\n\t<div style=\"color:#6f737e;\" class=\"wpb_text_column has-custom-color wpex-child-inherit-color wpb_content_element vc_custom_1790193004599\" >\n\t\t<div class=\"wpb_wrapper\">\n\t\t\t<p>En fjernevaluering bekr\u00e6ftede projektets omfang og blev brugt til at afg\u00f8re, om gendannelsen kunne gennemf\u00f8res eksternt, eller om den ville kr\u00e6ve arbejde i laboratoriet. At gendanne disse data bet\u00f8d at l\u00e6se alle tolv drev p\u00e5 sektorniveau, herunder omr\u00e5der, som filsystemet ikke l\u00e6ngere henviste til, og fjernadgang til en k\u00f8rende NAS n\u00e5r normalt den logiske diskenhed snarere end det underliggende fysiske medie. Fjerngendannelse var ikke mulig. En ingeni\u00f8r hentede diskene i San Francisco International Airport den f\u00f8lgende s\u00f8ndag aften.<\/p>\n\n\t\t<\/div>\n\t<\/div>\n<\/div><\/div><\/div><\/div><\/div><\/div><div class=\"vc_tta-panel\" id=\"1716980310195-cf5120dd-63bf\" data-vc-content=\".vc_tta-panel-body\"><div class=\"vc_tta-panel-heading\"><h4 class=\"vc_tta-panel-title vc_tta-controls-icon-position-right\"><a href=\"#1716980310195-cf5120dd-63bf\" data-vc-accordion data-vc-container=\".vc_tta-container\"><span class=\"vc_tta-title-text\">Ingen datagenoprettelsesoperation udf\u00f8rt p\u00e5 de originale drev<\/span><i class=\"vc_tta-controls-icon vc_tta-controls-icon-chevron\"><\/i><\/a><\/h4><\/div><div class=\"vc_tta-panel-body\"><div class=\"vc_row wpb_row vc_inner vc_row-fluid wpex-relative no-bottom-margins\"><div class=\"wpb_column vc_column_container vc_col-sm-12\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\">\n\t<div style=\"color:#6f737e;\" class=\"wpb_text_column has-custom-color wpex-child-inherit-color wpb_content_element vc_custom_1790193010867\" >\n\t\t<div class=\"wpb_wrapper\">\n\t\t\t<p>Alle tolv drev blev imaget inden for 24 timer efter ankomst, og enhver efterf\u00f8lgende operation blev k\u00f8rt mod disse images. De originale medier forblev i den stand, de var modtaget i, gennem hele processen, hvilket bevarede bevistilstanden, mens analysen skred frem.<\/p>\n\n\t\t<\/div>\n\t<\/div>\n<\/div><\/div><\/div><\/div><\/div><\/div><div class=\"vc_tta-panel\" id=\"1716892470635-67dc37f4-23f5\" data-vc-content=\".vc_tta-panel-body\"><div class=\"vc_tta-panel-heading\"><h4 class=\"vc_tta-panel-title vc_tta-controls-icon-position-right\"><a href=\"#1716892470635-67dc37f4-23f5\" data-vc-accordion data-vc-container=\".vc_tta-container\"><span class=\"vc_tta-title-text\">Ekstraktion k\u00f8rt parallelt<\/span><i class=\"vc_tta-controls-icon vc_tta-controls-icon-chevron\"><\/i><\/a><\/h4><\/div><div class=\"vc_tta-panel-body\"><div class=\"vc_row wpb_row vc_inner vc_row-fluid wpex-relative no-bottom-margins\"><div class=\"wpb_column vc_column_container vc_col-sm-12\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\">\n\t<div style=\"color:#6f737e;\" class=\"wpb_text_column has-custom-color wpex-child-inherit-color wpb_content_element vc_custom_1790193018704\" >\n\t\t<div class=\"wpb_wrapper\">\n\t\t\t<p>At scanne cirka 120 TB \u00e9t image ad gangen ville ikke have v\u00e6ret muligt. Ingeni\u00f8rerne opdelte arbejdet i terabyte-intervaller og k\u00f8rte ti scanninger samtidigt, hvilket drev gennemstr\u00f8mningen til gr\u00e6nserne for selve hardwaren. Et andet s\u00e6t images blev efterf\u00f8lgende bygget p\u00e5 et andet system, s\u00e5 ekstraktioner kunne foreg\u00e5 samtidigt p\u00e5 begge maskiner.<\/p>\n\n\t\t<\/div>\n\t<\/div>\n<\/div><\/div><\/div><\/div><\/div><\/div><div class=\"vc_tta-panel\" id=\"1716892533584-1defe13c-967c\" data-vc-content=\".vc_tta-panel-body\"><div class=\"vc_tta-panel-heading\"><h4 class=\"vc_tta-panel-title vc_tta-controls-icon-position-right\"><a href=\"#1716892533584-1defe13c-967c\" data-vc-accordion data-vc-container=\".vc_tta-container\"><span class=\"vc_tta-title-text\">Filsystemets allokeringskort kr\u00e6vede manuel rekonstruktion<\/span><i class=\"vc_tta-controls-icon vc_tta-controls-icon-chevron\"><\/i><\/a><\/h4><\/div><div class=\"vc_tta-panel-body\"><div class=\"vc_row wpb_row vc_inner vc_row-fluid wpex-relative no-bottom-margins\"><div class=\"wpb_column vc_column_container vc_col-sm-12\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\">\n\t<div style=\"color:#6f737e;\" class=\"wpb_text_column has-custom-color wpex-child-inherit-color wpb_content_element vc_custom_1790193024841\" >\n\t\t<div class=\"wpb_wrapper\">\n\t\t\t<p>Efterh\u00e5nden som data blev slettet, havde BTRFS begyndt at rydde det lag, der kortl\u00e6gger gemte data til deres fysiske placeringer. Cirka 7 TB af dette kort var ber\u00f8rt, hvilket gav ubrugeligt output fra ellers l\u00e6sbar lagring. Ingeni\u00f8rerne fastslog, at de ber\u00f8rte omr\u00e5der var blevet sammenh\u00e6ngende allokeret f\u00f8r sletningen, hvilket gjorde manuel rekonstruktion mulig. Genopbygning af kortet i h\u00e5nden genoprettede adgangen til cirka 5 TB backupdata, som filsystemet allerede havde frigivet.<\/p>\n\n\t\t<\/div>\n\t<\/div>\n<\/div><\/div><\/div><\/div><\/div><\/div><div class=\"vc_tta-panel\" id=\"1746706790263-0ece488a-c88d\" data-vc-content=\".vc_tta-panel-body\"><div class=\"vc_tta-panel-heading\"><h4 class=\"vc_tta-panel-title vc_tta-controls-icon-position-right\"><a href=\"#1746706790263-0ece488a-c88d\" data-vc-accordion data-vc-container=\".vc_tta-container\"><span class=\"vc_tta-title-text\">Virtuelle diske analyseret p\u00e5 blokniveau<\/span><i class=\"vc_tta-controls-icon vc_tta-controls-icon-chevron\"><\/i><\/a><\/h4><\/div><div class=\"vc_tta-panel-body\"><div class=\"vc_row wpb_row vc_inner vc_row-fluid wpex-relative no-bottom-margins\"><div class=\"wpb_column vc_column_container vc_col-sm-12\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\">\n\t<div style=\"color:#6f737e;\" class=\"wpb_text_column has-custom-color wpex-child-inherit-color wpb_content_element vc_custom_1790193030834\" >\n\t\t<div class=\"wpb_wrapper\">\n\t\t\t<p>En beskadiget VMDK-fil er sj\u00e6ldent blot l\u00e6sbar eller ul\u00e6selig. Ingeni\u00f8rerne adskilte intakte omr\u00e5der fra dem, der var krypterede, beskadigede, delvist overskrevet eller strukturelt beskadigede. De tre maskiner med h\u00f8jeste prioritet havde hver fem eller seks gendannelsespunkter, det seneste taget kort f\u00f8r angrebet, i alt 35 VMDK-filer. Skaden p\u00e5virkede 3-5 % af hver af disse filer. P\u00e5 \u00e9n af de tre havde krypteringsprogrammet slet ikke n\u00e5et de virtuelle diskfiler.<\/p>\n\n\t\t<\/div>\n\t<\/div>\n<\/div><\/div><\/div><\/div><\/div><\/div><div class=\"vc_tta-panel\" id=\"1746706820873-e77dbc09-0a20\" data-vc-content=\".vc_tta-panel-body\"><div class=\"vc_tta-panel-heading\"><h4 class=\"vc_tta-panel-title vc_tta-controls-icon-position-right\"><a href=\"#1746706820873-e77dbc09-0a20\" data-vc-accordion data-vc-container=\".vc_tta-container\"><span class=\"vc_tta-title-text\">At udfylde huller med produktionsdata medf\u00f8rte risiko<\/span><i class=\"vc_tta-controls-icon vc_tta-controls-icon-chevron\"><\/i><\/a><\/h4><\/div><div class=\"vc_tta-panel-body\"><div class=\"vc_row wpb_row vc_inner vc_row-fluid wpex-relative no-bottom-margins\"><div class=\"wpb_column vc_column_container vc_col-sm-12\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\">\n\t<div style=\"color:#6f737e;\" class=\"wpb_text_column has-custom-color wpex-child-inherit-color wpb_content_element vc_custom_1790193036872\" >\n\t\t<div class=\"wpb_wrapper\">\n\t\t\t<p>Hvor backupdata alene ikke d\u00e6kkede et datas\u00e6t, integrerede ingeni\u00f8rerne de ukrypterede omr\u00e5der af de virtuelle produktionsdiske. Denne tilgang var effektiv, men kr\u00e6vede forsigtighed. To af de tre prioriterede maskiner havde ogs\u00e5 snapshot-filer, som ikke har en en-til-en-relation til de data, de repr\u00e6senterer. De strukturer, der kortlagde snapshot-filerne til de data, de repr\u00e6senterede, befandt sig inden for de krypterede omr\u00e5der. At bruge de virtuelle produktionsdiske til at udfylde huller kunne derfor introducere \u00e6ldre data og for\u00e5rsage skader, der ville v\u00e6re sv\u00e6re at spore bagefter. Ingeni\u00f8rerne vurderede risikoen for hvert datas\u00e6t frem for at sammenl\u00e6gge som standard.<\/p>\n\n\t\t<\/div>\n\t<\/div>\n<\/div><\/div><\/div><\/div><\/div><\/div><div class=\"vc_tta-panel\" id=\"1790012399261-c4054605-890c\" data-vc-content=\".vc_tta-panel-body\"><div class=\"vc_tta-panel-heading\"><h4 class=\"vc_tta-panel-title vc_tta-controls-icon-position-right\"><a href=\"#1790012399261-c4054605-890c\" data-vc-accordion data-vc-container=\".vc_tta-container\"><span class=\"vc_tta-title-text\">Levering tilpasset m\u00e5lmilj\u00f8et<\/span><i class=\"vc_tta-controls-icon vc_tta-controls-icon-chevron\"><\/i><\/a><\/h4><\/div><div class=\"vc_tta-panel-body\"><div class=\"vc_row wpb_row vc_inner vc_row-fluid wpex-relative no-bottom-margins\"><div class=\"wpb_column vc_column_container vc_col-sm-12\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\">\n\t<div style=\"color:#6f737e;\" class=\"wpb_text_column has-custom-color wpex-child-inherit-color wpb_content_element vc_custom_1790193043155\" >\n\t\t<div class=\"wpb_wrapper\">\n\t\t\t<p>DriveSavers samarbejdede med incident response-virksomheden og kunden om p\u00e5 forh\u00e5nd at fastl\u00e6gge, hvilket milj\u00f8 diskene skulle importeres til. Udtrukket data p\u00e5 filniveau blev returneret f\u00f8rst over netv\u00e6rket, s\u00e5 kunden kunne f\u00e5 adgang til specifikke filer, mens det resterende arbejde fortsatte. Hele VMDK-filer, egnede til genimport, fulgte derefter.<\/p>\n\n\t\t<\/div>\n\t<\/div>\n<\/div><\/div><\/div><\/div><\/div><\/div><\/div><\/div><\/div><\/div><\/div><\/div><\/div><\/div><\/div><div class=\"vc_section vc_custom_1772464080847 vc_section-o-content-middle vc_section-flex wpex-vc-full-width-section wpex-vc-full-width-section--centered wpex-relative wpex-vc_section-has-fill wpex-vc-reset-negative-margin\"><div class=\"vc_row wpb_row vc_row-fluid vc_row-o-content-middle vc_row-flex wpex-relative no-bottom-margins\"><div class=\"wpb_column vc_column_container vc_col-sm-12\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\"><div class=\"vc_row wpb_row vc_inner vc_row-fluid wpex-relative\"><div class=\"wpb_column vc_column_container vc_col-sm-12\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\"><\/div><\/div><\/div><\/div><div class=\"vc_empty_space\"   style=\"height: 40px\"><span class=\"vc_empty_space_inner\"><\/span><\/div><style>.vcex-heading.vcex_6ab56732a805d{color:#3e3d3e;font-size:35px;font-weight:400;}@media (max-width:1024px){.vcex-heading.vcex_6ab56732a805d{font-size:25px;}}@media (max-width:959px){.vcex-heading.vcex_6ab56732a805d{font-size:25px;}}@media (max-width:767px){.vcex-heading.vcex_6ab56732a805d{font-size:25px;}}@media (max-width:479px){.vcex-heading.vcex_6ab56732a805d{font-size:25px;}}<\/style><div class=\"vcex-heading vcex-heading-plain vcex-module wpex-heading wpex-text-2xl wpex-div vcex_6ab56732a805d translation-block\"><span class=\"vcex-heading-inner wpex-inline-block\"><strong><span style=\"color: #e31f26\">Resultater: 99,91 %<\/span><\/strong> p\u00e5 den prioriterede databaseserver<\/span><\/div><div class=\"vc_empty_space\"   style=\"height: 10px\"><span class=\"vc_empty_space_inner\"><\/span><\/div><div id=\"TABLE-ROW\" class=\"vc_row wpb_row vc_inner vc_row-fluid vc_custom_1790193294209 wpex-relative\"><div class=\"wpb_column vc_column_container vc_col-sm-12\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\">\n\t<div class=\"wpb_raw_code wpb_raw_html wpb_content_element\" >\n\t\t<div class=\"wpb_wrapper\">\n\t\t\t<!-- ===================== RecoverNow Dataset\/Result Table ===================== -->\n<!-- Paste this entire block into a WPBakery \"Raw HTML\" element.            -->\n\n<div class=\"rnptds-wrap\">\n  <div class=\"rnptds-table\" id=\"rnptdsTable\">\n\n    <!-- HEADER ROW -->\n    <div class=\"rnptds-row rnptds-header-row\">\n      <div class=\"rnptds-cell rnptds-head\">Datas\u00e6t<\/div>\n      <div class=\"rnptds-cell rnptds-head\">v<\/div>\n    <\/div>\n\n    <div class=\"rnptds-row rnptds-shade\">\n      <div class=\"rnptds-cell rnptds-label\">VMDK'er for den prioriterede databaseserver, alene fra backuparkivet<\/div>\n      <div class=\"rnptds-cell rnptds-value\">99,4 % gendannet<\/div>\n    <\/div>\n\n    <div class=\"rnptds-row\">\n      <div class=\"rnptds-cell rnptds-label\">De samme VMDK'er, efter sammenl\u00e6gning af virtuelle produktionsdiskomr\u00e5der<\/div>\n      <div class=\"rnptds-cell rnptds-value\">99,91 % gendannet<\/div>\n    <\/div>\n\n    <div class=\"rnptds-row rnptds-shade\">\n      <div class=\"rnptds-cell rnptds-label\">10 GB database-dumpfil, leveret<\/div>\n      <div class=\"rnptds-cell rnptds-value\">99,88 % gendannet<\/div>\n    <\/div>\n\n    <div class=\"rnptds-row\">\n      <div class=\"rnptds-cell rnptds-label\">Hyper Backup-datas\u00e6t, 3,12 TB fordelt p\u00e5 763.384 filer<\/div>\n      <div class=\"rnptds-cell rnptds-value\">3,03 TB intakt, 86,74 GB beskadiget<\/div>\n    <\/div>\n\n  <\/div>\n<\/div>\n\n<style>\n  .rnptds-wrap {\n    --rnptds-line: #7a7a7a;\n    --rnptds-red: #E31F26;\n    --rnptds-label: #6F737E;\n    width: 100%;\n    overflow-x: auto;\n    -webkit-overflow-scrolling: touch;\n    box-sizing: border-box;\n    font-family: \"DM Sans\", sans-serif;\n  }\n  .rnptds-wrap * { box-sizing: border-box; }\n\n  .rnptds-table {\n    display: table;\n    width: 100%;\n    min-width: 500px;\n    border-collapse: separate;\n    border-spacing: 0;\n    border: 1px solid var(--rnptds-line);\n    border-radius: 15px;\n    overflow: hidden;\n  }\n\n  .rnptds-row {\n    display: table-row;\n  }\n\n  .rnptds-cell {\n    display: table-cell;\n    vertical-align: middle;\n    padding: 14px 18px;\n    border-bottom: 1px solid var(--rnptds-line);\n    border-right: 1px solid var(--rnptds-line);\n    text-align: left;\n    font-size: 18px;\n    font-family: \"DM Sans\", sans-serif;\n    background: transparent;\n  }\n\n  .rnptds-cell:last-child { border-right: none; }\n  .rnptds-row:last-child .rnptds-cell { border-bottom: none; }\n\n  .rnptds-cell:first-child { width: 62%; }\n\n  .rnptds-label { color: var(--rnptds-label); font-weight: 500; }\n  .rnptds-value { color: var(--rnptds-label); font-weight: 600; }\n\n  .rnptds-head {\n    background: transparent;\n    font-size: 20px;\n    font-weight: 700;\n    color: #e31f26;\n  }\n<\/style>\n\t\t<\/div>\n\t<\/div>\n<\/div><\/div><\/div><\/div><\/div><\/div><\/div><\/div><div class=\"vc_row wpb_row vc_row-fluid vc_row-o-content-middle vc_row-flex wpex-relative no-bottom-margins\"><div class=\"wpb_column vc_column_container vc_col-sm-12\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\"><div class=\"vc_empty_space\"   style=\"height: 20px\"><span class=\"vc_empty_space_inner\"><\/span><\/div>\n\t<div style=\"color:#6f737e;font-size:18px;\" class=\"wpb_text_column has-custom-color wpex-child-inherit-color wpb_content_element\" >\n\t\t<div class=\"wpb_wrapper\">\n\t\t\t<p>DriveSavers gennemf\u00f8rte opgaven som syv separat afgr\u00e6nsede delopgaver med flere ingeni\u00f8rer, der arbejdede parallelt, s\u00e5 de systemer med h\u00f8jeste prioritet kunne bearbejdes og returneres forud for resten af milj\u00f8et.<\/p>\n<p>DriveSavers oplyste hele vejen igennem incident response-virksomheden og kunden om, at det ikke kunne garanteres, at de genopbyggede VMDK-filer ville starte op. Mindst \u00e9n gendannet virtuel maskine startede op. Resten blev returneret som gendannede data og reparerede diske.<\/p>\n<p>Hver repareret virtuel disk blev ledsaget af en rapport p\u00e5 blokniveau, der identificerede, hvilke omr\u00e5der af disken der var sunde, og hvilke der bar urepar\u00e9rbar skade, med objekt-, fil-, mappe- og bytetal for hver. For tekniske teams, der genopbygger et milj\u00f8, giver denne type rapportering betydeligt mere information end en simpel betegnelse som gendannet eller ikke gendannet. Den giver administratorer mulighed for at vurdere kvaliteten af et gendannet image og afg\u00f8re, om yderligere gendannelse p\u00e5 applikationsniveau, filudtr\u00e6k eller genopbygning er n\u00f8dvendig.<\/p>\n\n\t\t<\/div>\n\t<\/div>\n<div class=\"vc_empty_space\"   style=\"height: 20px\"><span class=\"vc_empty_space_inner\"><\/span><\/div><div style=\"border-color:#000000!important;\" class=\"vc_row wpb_row vc_inner vc_row-fluid vc_custom_1790186340921 vc_row-o-content-middle vc_row-flex wpex-relative wpex-vc_row-has-fill wpex-vc-reset-negative-margin\"><div class=\"wpb_column vc_column_container vc_col-sm-12 vc_col-xs-4\"><div class=\"vc_column-inner vc_custom_1727284399200\"><div class=\"wpb_wrapper\"><style>.vcex-icon-box.vcex_6ab56732a9f95 .vcex-icon-box-content{color:#6f737e;}.vcex-icon-box.vcex_6ab56732a9f95 .vcex-icon-box-icon{color:#ec0912;}<\/style><div class=\"vcex-module vcex-icon-box vcex-icon-box-one wpex-flex wpex-text-left vc_custom_1790186401531 vcex_6ab56732a9f95\"><div class=\"vcex-icon-box-symbol vcex-icon-box-symbol--icon wpex-flex-shrink-0 wpex-mr-20\"><div class=\"vcex-icon-box-icon wpex-items-center wpex-justify-center wpex-child-inherit-color wpex-text-center wpex-leading-none wpex-flex wpex-text-1\"><span class=\"wpex-flex wpex-icon--w wpex-icon wpex-icon--bidi\" aria-hidden=\"true\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" viewbox=\"0 0 448 512\"><path d=\"M0 216C0 149.7 53.7 96 120 96h8c17.7 0 32 14.3 32 32s-14.3 32-32 32h-8c-30.9 0-56 25.1-56 56v8h64c35.3 0 64 28.7 64 64v64c0 35.3-28.7 64-64 64H64c-35.3 0-64-28.7-64-64V320 288 216zm256 0c0-66.3 53.7-120 120-120h8c17.7 0 32 14.3 32 32s-14.3 32-32 32h-8c-30.9 0-56 25.1-56 56v8h64c35.3 0 64 28.7 64 64v64c0 35.3-28.7 64-64 64H320c-35.3 0-64-28.7-64-64V320 288 216z\"\/><\/svg><\/span><\/div><\/div><div class=\"vcex-icon-box-text wpex-flex-grow\"><div class=\"vcex-icon-box-content wpex-last-mb-0 wpex-clr\"><p><em>Fort\u00e6l venligst hele teamet, hvor taknemmelig jeg er for alles hj\u00e6lp med dette projekt.<\/em><\/p>\n<p style=\"text-align: right\">\u2014 IT-direkt\u00f8r (CIO), kundeorganisationen<\/p>\n<\/div><\/div><\/div><\/div><\/div><\/div><\/div><\/div><\/div><\/div><\/div><\/div><div id=\"case-study-takeaways\" class=\"vc_section vc_custom_1772464095377 vc_section-o-content-middle vc_section-flex wpex-vc-full-width-section wpex-vc-full-width-section--centered wpex-relative wpex-vc_section-has-fill wpex-vc-reset-negative-margin\"><div class=\"vc_row wpb_row vc_row-fluid vc_row-o-content-middle vc_row-flex wpex-relative no-bottom-margins\"><div class=\"wpb_column vc_column_container vc_col-sm-12\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\"><div class=\"vc_empty_space\"   style=\"height: 40px\"><span class=\"vc_empty_space_inner\"><\/span><\/div><style>.vcex-heading.vcex_6ab56732ab25e{color:#3e3d3e;font-size:35px;font-weight:400;}@media (max-width:1024px){.vcex-heading.vcex_6ab56732ab25e{font-size:25px;}}@media (max-width:959px){.vcex-heading.vcex_6ab56732ab25e{font-size:25px;}}@media (max-width:767px){.vcex-heading.vcex_6ab56732ab25e{font-size:25px;}}@media (max-width:479px){.vcex-heading.vcex_6ab56732ab25e{font-size:25px;}}<\/style><div class=\"vcex-heading vcex-heading-plain vcex-module wpex-heading wpex-text-2xl wpex-div vcex_6ab56732ab25e\"><span class=\"vcex-heading-inner wpex-inline-block\"><strong><span style=\"color: #e31f26\">Konklusion<\/span><\/strong><\/span><\/div>\n\t<div style=\"color:#6f737e;\" class=\"wpb_text_column has-custom-color wpex-child-inherit-color wpb_content_element\" >\n\t\t<div class=\"wpb_wrapper\">\n\t\t\t<p>N\u00e5r en backup-applikation ikke kan gennemf\u00f8re en gendannelse, kan de underliggende data stadig v\u00e6re til stede i lagringen. Dette arkiv var blevet krypteret, t\u00f8mt og derefter overskrevet, f\u00f8r det n\u00e5ede frem til en genoprettelsesspecialist, og rekonstruktion p\u00e5 blokniveau fik alligevel de systemer tilbage, som virksomheden havde mest brug for.<\/p>\n<p>At gendanne data for virtuelle maskiner under s\u00e5danne forhold kr\u00e6ver specialiseret viden, propriet\u00e6re v\u00e6rkt\u00f8jer og skr\u00e6ddersyet udvikling tilpasset det p\u00e5g\u00e6ldende specifikke filsystem. N\u00e5r ransomware rammer produktionssystemer og backup-infrastruktur samtidig, kan specialiseret ransomware-datagenoprettelse tilbyde en teknisk vej, som konventionel genoprettelse ikke kan.<\/p>\n\n\t\t<\/div>\n\t<\/div>\n<div class=\"vc_empty_space\"   style=\"height: 20px\"><span class=\"vc_empty_space_inner\"><\/span><\/div><\/div><\/div><\/div><\/div><div class=\"vc_row wpb_row vc_row-fluid vc_custom_1776873720672 wpex-relative wpex-vc_row-has-fill no-bottom-margins wpex-vc-reset-negative-margin\" style=\"border-color:#000000!important;\"><div class=\"wpb_column vc_column_container vc_col-sm-12 wpex-vc_col-has-fill\"><div class=\"vc_column-inner vc_custom_1760029818507\"><div class=\"wpb_wrapper\">\n\t<div style=\"color:#6f737e;\" class=\"wpb_text_column has-custom-color wpex-child-inherit-color wpb_content_element vc_custom_1790194379795\" >\n\t\t<div class=\"wpb_wrapper\">\n\t\t\t<p style=\"text-align: center;\" class=\"translation-block\"><strong>St\u00e5r du i en lignende situation? <a href=\"\/da-dk\/contact\/\" target=\"_self\">Kontakt DriveSavers<\/a> p\u00e5 <a href=\"tel:+18882822227\" target=\"_self\">1 (888) 282-2227<\/a>.<\/strong><\/p>\n\n\t\t<\/div>\n\t<\/div>\n<\/div><\/div><\/div><\/div><\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"<p>DriveSavers gendannede 99,91 % af en kritisk databaseserver, efter at Akira-ransomware havde krypteret og slettet 11 TB VMware-backups p\u00e5 en Synology NAS.<\/p>","protected":false},"author":53,"featured_media":86585,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"om_disable_all_campaigns":false,"inline_featured_image":false,"footnotes":""},"categories":[10559],"tags":[11458],"post_series":[],"class_list":["post-86549","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-case-studies","tag-crypto","entry","has-media"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v28.2 (Yoast SEO v28.5) - https:\/\/yoast.com\/product\/yoast-seo-premium-wordpress\/ -->\n<title>VMDK Data Recovery After an Akira Ransomware Attack<\/title>\n<meta name=\"description\" content=\"DriveSavers recovered 99.91% of a critical database server after Akira ransomware encrypted and deleted 11TB of VMware backups on a Synology NAS.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/drivesaversdatarecovery.com\/da-dk\/case-studies\/vmdk-data-recovery-after-an-akira-ransomware-attack\/\" \/>\n<meta property=\"og:locale\" content=\"da_DK\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"VMDK Data Recovery After an Akira Ransomware Attack\" \/>\n<meta property=\"og:description\" content=\"DriveSavers recovered 99.91% of a critical database server after Akira ransomware encrypted and deleted 11TB of VMware backups on a Synology NAS.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/drivesaversdatarecovery.com\/da-dk\/case-studies\/vmdk-data-recovery-after-an-akira-ransomware-attack\/\" \/>\n<meta property=\"og:site_name\" content=\"DriveSavers Data Recovery Services\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/DriveSavers\" \/>\n<meta property=\"article:published_time\" content=\"2026-09-23T19:18:51+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-09-24T15:50:25+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/drivesaversdatarecovery.com\/wp-content\/uploads\/2026\/09\/VMDK-Data-Recovery-After-an-Akira-Ransomware-Attack1.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"627\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Andy Maus\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@drivesavers\" \/>\n<meta name=\"twitter:site\" content=\"@drivesavers\" \/>\n<meta name=\"twitter:label1\" content=\"Skrevet af\" \/>\n\t<meta name=\"twitter:data1\" content=\"Andy Maus\" \/>\n\t<meta name=\"twitter:label2\" content=\"Estimeret l\u00e6setid\" \/>\n\t<meta name=\"twitter:data2\" content=\"6 minutter\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"TechArticle\",\"@id\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/case-studies\\\/vmdk-data-recovery-after-an-akira-ransomware-attack\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/case-studies\\\/vmdk-data-recovery-after-an-akira-ransomware-attack\\\/\"},\"author\":{\"name\":\"Andy Maus\",\"@id\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/#\\\/schema\\\/person\\\/d294f7f00d1aee169b2910510fa7e092\"},\"headline\":\"VMDK Data Recovery After an Akira Ransomware Attack\",\"datePublished\":\"2026-09-23T19:18:51+00:00\",\"dateModified\":\"2026-09-24T15:50:25+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/case-studies\\\/vmdk-data-recovery-after-an-akira-ransomware-attack\\\/\"},\"wordCount\":3149,\"publisher\":{\"@id\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/case-studies\\\/vmdk-data-recovery-after-an-akira-ransomware-attack\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/VMDK-Data-Recovery-After-an-Akira-Ransomware-Attack1.png\",\"keywords\":[\"crypto\"],\"articleSection\":[\"Case Studies\"],\"inLanguage\":\"da-DK\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/case-studies\\\/vmdk-data-recovery-after-an-akira-ransomware-attack\\\/\",\"url\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/case-studies\\\/vmdk-data-recovery-after-an-akira-ransomware-attack\\\/\",\"name\":\"VMDK Data Recovery After an Akira Ransomware Attack\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/case-studies\\\/vmdk-data-recovery-after-an-akira-ransomware-attack\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/case-studies\\\/vmdk-data-recovery-after-an-akira-ransomware-attack\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/VMDK-Data-Recovery-After-an-Akira-Ransomware-Attack1.png\",\"datePublished\":\"2026-09-23T19:18:51+00:00\",\"dateModified\":\"2026-09-24T15:50:25+00:00\",\"description\":\"DriveSavers recovered 99.91% of a critical database server after Akira ransomware encrypted and deleted 11TB of VMware backups on a Synology NAS.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/case-studies\\\/vmdk-data-recovery-after-an-akira-ransomware-attack\\\/#breadcrumb\"},\"inLanguage\":\"da-DK\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/drivesaversdatarecovery.com\\\/case-studies\\\/vmdk-data-recovery-after-an-akira-ransomware-attack\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"da-DK\",\"@id\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/case-studies\\\/vmdk-data-recovery-after-an-akira-ransomware-attack\\\/#primaryimage\",\"url\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/VMDK-Data-Recovery-After-an-Akira-Ransomware-Attack1.png\",\"contentUrl\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/VMDK-Data-Recovery-After-an-Akira-Ransomware-Attack1.png\",\"width\":1200,\"height\":627},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/case-studies\\\/vmdk-data-recovery-after-an-akira-ransomware-attack\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"DriveSavers\",\"item\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"VMDK Data Recovery After an Akira Ransomware Attack\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/#website\",\"url\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/\",\"name\":\"DriveSavers Data Recovery Services\",\"description\":\"The Worldwide Leader in Data Recovery\",\"publisher\":{\"@id\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"da-DK\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/#organization\",\"name\":\"DriveSavers Data Recovery\",\"url\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"da-DK\",\"@id\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/wp-content\\\/uploads\\\/2021\\\/08\\\/Logo-01.png\",\"contentUrl\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/wp-content\\\/uploads\\\/2021\\\/08\\\/Logo-01.png\",\"width\":1092,\"height\":1087,\"caption\":\"DriveSavers Data Recovery\"},\"image\":{\"@id\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/DriveSavers\",\"https:\\\/\\\/x.com\\\/drivesavers\",\"https:\\\/\\\/www.instagram.com\\\/drivesavers\\\/\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/drivesavers-data-recovery\\\/\",\"https:\\\/\\\/www.pinterest.com\\\/drivesavers\\\/\",\"https:\\\/\\\/www.youtube.com\\\/channel\\\/UCBlynLMdFWQgid-Gwm0zJ1A\",\"https:\\\/\\\/en.wikipedia.org\\\/wiki\\\/DriveSavers\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/#\\\/schema\\\/person\\\/d294f7f00d1aee169b2910510fa7e092\",\"name\":\"Andy Maus\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"da-DK\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/d40862266d842cfd428c105a72654611de2d431617d5cf0d86aca1087aef2cd0?s=96&d=blank&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/d40862266d842cfd428c105a72654611de2d431617d5cf0d86aca1087aef2cd0?s=96&d=blank&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/d40862266d842cfd428c105a72654611de2d431617d5cf0d86aca1087aef2cd0?s=96&d=blank&r=g\",\"caption\":\"Andy Maus\"},\"description\":\"Andy Maus is Strategic Partnerships &amp; Cyber Recovery Services Leader at DriveSavers, leading initiatives that help organizations recover critical data following cyber incidents, ransomware attacks, and other security breaches. He joined DriveSavers in 2023 after more than two years at Arete Incident Response, where he introduced Data Recovery Services to the firm\u2019s restoration portfolio, expanded the technical operations team from 10 to over 70 specialists, and built strategic alliances with SentinelOne, Dell, and Presidio. Earlier, at Ontrack Data Recovery, he oversaw global sales, supporting complex data restorations for clients across 22 countries. With more than three decades in the technology industry\u2014including leadership roles at Dell, Mitel, and Level 3 Communications\u2014Andy brings deep experience in cyber incident response, data recovery methodologies, and large-scale technical operations.\",\"url\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/da-dk\\\/author\\\/andy-maus\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"VMDK Data Recovery After an Akira Ransomware Attack","description":"DriveSavers gendannede 99,91 % af en kritisk databaseserver, efter at Akira-ransomware havde krypteret og slettet 11 TB VMware-backups p\u00e5 en Synology NAS.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/drivesaversdatarecovery.com\/da-dk\/case-studies\/vmdk-data-recovery-after-an-akira-ransomware-attack\/","og_locale":"da_DK","og_type":"article","og_title":"VMDK Data Recovery After an Akira Ransomware Attack","og_description":"DriveSavers recovered 99.91% of a critical database server after Akira ransomware encrypted and deleted 11TB of VMware backups on a Synology NAS.","og_url":"https:\/\/drivesaversdatarecovery.com\/da-dk\/case-studies\/vmdk-data-recovery-after-an-akira-ransomware-attack\/","og_site_name":"DriveSavers Data Recovery Services","article_publisher":"https:\/\/www.facebook.com\/DriveSavers","article_published_time":"2026-09-23T19:18:51+00:00","article_modified_time":"2026-09-24T15:50:25+00:00","og_image":[{"width":1200,"height":627,"url":"https:\/\/drivesaversdatarecovery.com\/wp-content\/uploads\/2026\/09\/VMDK-Data-Recovery-After-an-Akira-Ransomware-Attack1.png","type":"image\/png"}],"author":"Andy Maus","twitter_card":"summary_large_image","twitter_creator":"@drivesavers","twitter_site":"@drivesavers","twitter_misc":{"Skrevet af":"Andy Maus","Estimeret l\u00e6setid":"6 minutter"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"TechArticle","@id":"https:\/\/drivesaversdatarecovery.com\/case-studies\/vmdk-data-recovery-after-an-akira-ransomware-attack\/#article","isPartOf":{"@id":"https:\/\/drivesaversdatarecovery.com\/case-studies\/vmdk-data-recovery-after-an-akira-ransomware-attack\/"},"author":{"name":"Andy Maus","@id":"https:\/\/drivesaversdatarecovery.com\/#\/schema\/person\/d294f7f00d1aee169b2910510fa7e092"},"headline":"VMDK Data Recovery After an Akira Ransomware Attack","datePublished":"2026-09-23T19:18:51+00:00","dateModified":"2026-09-24T15:50:25+00:00","mainEntityOfPage":{"@id":"https:\/\/drivesaversdatarecovery.com\/case-studies\/vmdk-data-recovery-after-an-akira-ransomware-attack\/"},"wordCount":3149,"publisher":{"@id":"https:\/\/drivesaversdatarecovery.com\/#organization"},"image":{"@id":"https:\/\/drivesaversdatarecovery.com\/case-studies\/vmdk-data-recovery-after-an-akira-ransomware-attack\/#primaryimage"},"thumbnailUrl":"https:\/\/drivesaversdatarecovery.com\/wp-content\/uploads\/2026\/09\/VMDK-Data-Recovery-After-an-Akira-Ransomware-Attack1.png","keywords":["crypto"],"articleSection":["Case Studies"],"inLanguage":"da-DK"},{"@type":"WebPage","@id":"https:\/\/drivesaversdatarecovery.com\/case-studies\/vmdk-data-recovery-after-an-akira-ransomware-attack\/","url":"https:\/\/drivesaversdatarecovery.com\/case-studies\/vmdk-data-recovery-after-an-akira-ransomware-attack\/","name":"VMDK Data Recovery After an Akira Ransomware Attack","isPartOf":{"@id":"https:\/\/drivesaversdatarecovery.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/drivesaversdatarecovery.com\/case-studies\/vmdk-data-recovery-after-an-akira-ransomware-attack\/#primaryimage"},"image":{"@id":"https:\/\/drivesaversdatarecovery.com\/case-studies\/vmdk-data-recovery-after-an-akira-ransomware-attack\/#primaryimage"},"thumbnailUrl":"https:\/\/drivesaversdatarecovery.com\/wp-content\/uploads\/2026\/09\/VMDK-Data-Recovery-After-an-Akira-Ransomware-Attack1.png","datePublished":"2026-09-23T19:18:51+00:00","dateModified":"2026-09-24T15:50:25+00:00","description":"DriveSavers gendannede 99,91 % af en kritisk databaseserver, efter at Akira-ransomware havde krypteret og slettet 11 TB VMware-backups p\u00e5 en Synology NAS.","breadcrumb":{"@id":"https:\/\/drivesaversdatarecovery.com\/case-studies\/vmdk-data-recovery-after-an-akira-ransomware-attack\/#breadcrumb"},"inLanguage":"da-DK","potentialAction":[{"@type":"ReadAction","target":["https:\/\/drivesaversdatarecovery.com\/case-studies\/vmdk-data-recovery-after-an-akira-ransomware-attack\/"]}]},{"@type":"ImageObject","inLanguage":"da-DK","@id":"https:\/\/drivesaversdatarecovery.com\/case-studies\/vmdk-data-recovery-after-an-akira-ransomware-attack\/#primaryimage","url":"https:\/\/drivesaversdatarecovery.com\/wp-content\/uploads\/2026\/09\/VMDK-Data-Recovery-After-an-Akira-Ransomware-Attack1.png","contentUrl":"https:\/\/drivesaversdatarecovery.com\/wp-content\/uploads\/2026\/09\/VMDK-Data-Recovery-After-an-Akira-Ransomware-Attack1.png","width":1200,"height":627},{"@type":"BreadcrumbList","@id":"https:\/\/drivesaversdatarecovery.com\/case-studies\/vmdk-data-recovery-after-an-akira-ransomware-attack\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"DriveSavers","item":"https:\/\/drivesaversdatarecovery.com\/"},{"@type":"ListItem","position":2,"name":"VMDK Data Recovery After an Akira Ransomware Attack"}]},{"@type":"WebSite","@id":"https:\/\/drivesaversdatarecovery.com\/#website","url":"https:\/\/drivesaversdatarecovery.com\/","name":"DriveSavers tjenester til datagendannelse","description":"The Worldwide Leader in Data Recovery","publisher":{"@id":"https:\/\/drivesaversdatarecovery.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/drivesaversdatarecovery.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"da-DK"},{"@type":"Organization","@id":"https:\/\/drivesaversdatarecovery.com\/#organization","name":"DriveSavers Danmark","url":"https:\/\/drivesaversdatarecovery.com\/","logo":{"@type":"ImageObject","inLanguage":"da-DK","@id":"https:\/\/drivesaversdatarecovery.com\/#\/schema\/logo\/image\/","url":"https:\/\/drivesaversdatarecovery.com\/wp-content\/uploads\/2021\/08\/Logo-01.png","contentUrl":"https:\/\/drivesaversdatarecovery.com\/wp-content\/uploads\/2021\/08\/Logo-01.png","width":1092,"height":1087,"caption":"DriveSavers Data Recovery"},"image":{"@id":"https:\/\/drivesaversdatarecovery.com\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/DriveSavers","https:\/\/x.com\/drivesavers","https:\/\/www.instagram.com\/drivesavers\/","https:\/\/www.linkedin.com\/company\/drivesavers-data-recovery\/","https:\/\/www.pinterest.com\/drivesavers\/","https:\/\/www.youtube.com\/channel\/UCBlynLMdFWQgid-Gwm0zJ1A","https:\/\/en.wikipedia.org\/wiki\/DriveSavers"]},{"@type":"Person","@id":"https:\/\/drivesaversdatarecovery.com\/#\/schema\/person\/d294f7f00d1aee169b2910510fa7e092","name":"Andy Maus","image":{"@type":"ImageObject","inLanguage":"da-DK","@id":"https:\/\/secure.gravatar.com\/avatar\/d40862266d842cfd428c105a72654611de2d431617d5cf0d86aca1087aef2cd0?s=96&d=blank&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/d40862266d842cfd428c105a72654611de2d431617d5cf0d86aca1087aef2cd0?s=96&d=blank&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/d40862266d842cfd428c105a72654611de2d431617d5cf0d86aca1087aef2cd0?s=96&d=blank&r=g","caption":"Andy Maus"},"description":"Andy Maus is Strategic Partnerships &amp; Cyber Recovery Services Leader at DriveSavers, leading initiatives that help organizations recover critical data following cyber incidents, ransomware attacks, and other security breaches. He joined DriveSavers in 2023 after more than two years at Arete Incident Response, where he introduced Data Recovery Services to the firm\u2019s restoration portfolio, expanded the technical operations team from 10 to over 70 specialists, and built strategic alliances with SentinelOne, Dell, and Presidio. Earlier, at Ontrack Data Recovery, he oversaw global sales, supporting complex data restorations for clients across 22 countries. With more than three decades in the technology industry\u2014including leadership roles at Dell, Mitel, and Level 3 Communications\u2014Andy brings deep experience in cyber incident response, data recovery methodologies, and large-scale technical operations.","url":"https:\/\/drivesaversdatarecovery.com\/da-dk\/author\/andy-maus\/"}]}},"_links":{"self":[{"href":"https:\/\/drivesaversdatarecovery.com\/da-dk\/wp-json\/wp\/v2\/posts\/86549","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/drivesaversdatarecovery.com\/da-dk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/drivesaversdatarecovery.com\/da-dk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/drivesaversdatarecovery.com\/da-dk\/wp-json\/wp\/v2\/users\/53"}],"replies":[{"embeddable":true,"href":"https:\/\/drivesaversdatarecovery.com\/da-dk\/wp-json\/wp\/v2\/comments?post=86549"}],"version-history":[{"count":10,"href":"https:\/\/drivesaversdatarecovery.com\/da-dk\/wp-json\/wp\/v2\/posts\/86549\/revisions"}],"predecessor-version":[{"id":86586,"href":"https:\/\/drivesaversdatarecovery.com\/da-dk\/wp-json\/wp\/v2\/posts\/86549\/revisions\/86586"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/drivesaversdatarecovery.com\/da-dk\/wp-json\/wp\/v2\/media\/86585"}],"wp:attachment":[{"href":"https:\/\/drivesaversdatarecovery.com\/da-dk\/wp-json\/wp\/v2\/media?parent=86549"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/drivesaversdatarecovery.com\/da-dk\/wp-json\/wp\/v2\/categories?post=86549"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/drivesaversdatarecovery.com\/da-dk\/wp-json\/wp\/v2\/tags?post=86549"},{"taxonomy":"post_series","embeddable":true,"href":"https:\/\/drivesaversdatarecovery.com\/da-dk\/wp-json\/wp\/v2\/post_series?post=86549"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}