{"id":86549,"date":"2026-09-23T12:18:51","date_gmt":"2026-09-23T19:18:51","guid":{"rendered":"https:\/\/drivesaversdatarecovery.com\/?p=86549"},"modified":"2026-09-24T08:50:25","modified_gmt":"2026-09-24T15:50:25","slug":"vmdk-data-recovery-after-an-akira-ransomware-attack","status":"publish","type":"post","link":"https:\/\/drivesaversdatarecovery.com\/de-de\/case-studies\/vmdk-data-recovery-after-an-akira-ransomware-attack\/","title":{"rendered":"VMDK Data Recovery After an Akira Ransomware Attack"},"content":{"rendered":"<div class=\"wpb-content-wrapper\"><div id=\"case-study-image-and-title\" class=\"vc_section blog-header-top-padding vc_custom_1743006484198 wpex-vc-full-width-section wpex-vc-full-width-section--centered wpex-relative wpex-vc_section-has-fill wpex-vc-reset-negative-margin\"><div class=\"vc_row wpb_row vc_row-fluid wpex-relative no-bottom-margins\"><div class=\"wpb_column vc_column_container vc_col-sm-12\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\">\n\t<div class=\"wpb_raw_code wpb_raw_html wpb_content_element\" >\n\t\t<div class=\"wpb_wrapper\">\n\t\t\t  <style>\n\n.vcex-video.wpex-bg-black {\n  border-radius: 15px;\n  overflow: hidden;\n}\n\n.vcex-video-inner video {\n  border-radius: 15px;\n}\n\n.case-study-video {\nborder-radius: 15px !important;\n}\n\n.cs-red-heading {\n      color: #EC0912;\nfont-weight: 600;\n    }\n.vcex-heading-inner {\nmargin-bottom:12px;\n}\n        .single-post-title {\n            display: none;\n        }\n    ul.meta {\n       display:none;\n        }\n\n.parent-div {\n  display: flex !important;       \/* Lay the items out in a row by default (desktop) *\/\n  flex-wrap: nowrap !important;   \/* Prevent wrapping on large screens *\/\n}\n\n\/* When the screen is below, say, 768px, wrap and make each child 50% width *\/\n@media (max-width: 768px) {\n  .parent-div {\n    flex-wrap: wrap !important;   \/* Allow wrapping on smaller screens (mobile) *\/\nfont-size: 15px !important;\n  }\n  .parent-div > div {\n    width: 50% !important;        \/* 2 columns (two items per row) *\/\n    box-sizing: border-box !important; \n  }\n.cs-quote-headshot {text-align: center;margin-bottom:13px;}\n.cs-quote-box {\n    margin-left: 30px;\n    margin-right: 30px;\n\n}\n.cs-quote-headshot-image {\nmax-width: 170px;\nmargin-bottom:13px;\nmargin: auto;\n}\n.cs-quote-nametitle {\ntext-align: center !important;\nalign-items: center !important;\n}\n\n}\n\n.cs-main-image-header .wpex-p-30 {\n    padding: 0 !important;\n    padding-left: 3% !important;\npadding-bottom: 3% !important;\n}\n\n.cs-main-image-header .wpex-items-center {\n    align-items: end !important;\n}\n\n@media screen and (max-width: 1300px) {\n    .cs-main-image-header .vcex-ib-content .vcex-ib-title {\n        font-size: 3.5vw !important;\n    }\n\n    .cs-main-image-header .vcex-ib-content .vcex-ib-caption {\n        font-size: 5.5vw !important;\n    }\n}\n\n.cs-main-image-header .vcex-ib-content {\n text-shadow: 0 0 10px #000; \n}\n\n.vc_custom_1743006484198 {\n    margin-top: -10px !important;\n    padding-bottom: 4% !important;\n    background-color: #000000 !important;\n}\n\n.case-study-image-and-title\n{\n    margin-top: -10px !important;\n    padding-bottom: 4% !important;\n    background-color: #000000 !important;\n}\n.blog-header-top-padding\n\n{\n    margin-top: -10px !important;\n    padding-bottom: 4% !important;\n    background-color: #000000 !important;\n}\n  <\/style>\n\n\t\t<\/div>\n\t<\/div>\n<\/div><\/div><\/div><\/div><div class=\"vc_row wpb_row vc_row-fluid vc_custom_1764869151897 wpex-relative no-bottom-margins\"><div class=\"wpb_column vc_column_container vc_col-sm-12\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\"><style>.vcex-image-banner.vcex_6ab56867d5683 .vcex-ib-title{color:#fefefe;font-size:57px;font-family:'DM Sans', sans-serif;font-weight:600;}.vcex-image-banner.vcex_6ab56867d5683 .vcex-ib-caption{color:#ffffff;font-size:45px;font-family:'DM Sans', sans-serif;font-weight:600;}<\/style><div class=\"vcex-module vcex-image-banner wpex-flex wpex-flex-col wpex-w-100 wpex-justify-center wpex-relative wpex-overflow-hidden wpex-bg-gray-900 wpex-text-white wpex-hover-text-white wpex-text-left wpex-rounded-md vcex-has-img-tag cs-main-image-header vcex_6ab56867d5683\"><img  src=\"https:\/\/drivesaversdatarecovery.com\/wp-content\/uploads\/2026\/09\/VMDK-Data-Recovery-After-an-Akira-Ransomware-Attack-Header-1-1.png\" class=\"vcex-ib-img wpex-block wpex-transition-all wpex-duration-500\" alt=\"\"><div class=\"vcex-ib-content-wrap wpex-w-100 wpex-transition-all wpex-duration-500 wpex-absolute wpex-inset-0 wpex-flex wpex-items-center wpex-p-30\"><div class=\"vcex-ib-content wpex-flex-grow wpex-mr-auto\"><h3 class=\"vcex-ib-title wpex-heading\">VMDK-Datenrettung<\/h3><div class=\"vcex-ib-caption wpex-text-lg wpex-last-mb-0\">nach einem Akira-Ransomware-Angriff<\/div><\/div><\/div><\/div><div class=\"vcex-spacing wpex-w-100 wpex-clear\" style=\"height:35px;\"><\/div><\/div><\/div><\/div><\/div><div class=\"vc_row wpb_row vc_row-fluid parent-div wpex-relative\"><div class=\"wpb_column vc_column_container vc_col-sm-1\/5\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\">\n\t<div style=\"color:#ffffff;\" class=\"wpb_text_column has-custom-color wpex-child-inherit-color wpb_content_element\" >\n\t\t<div class=\"wpb_wrapper\">\n\t\t\t<p class=\"translation-block\"><strong>Umgebung:<\/strong><br>\n<span style=\"font-size: .8em\">VMware-Umgebung, gesichert von Nakivo auf einem 12-Bay-Synology RS3621RPXs, RAID 5, BTRFS<\/span><\/p>\n\n\t\t<\/div>\n\t<\/div>\n<\/div><\/div><\/div><div class=\"wpb_column vc_column_container vc_col-sm-1\/5\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\">\n\t<div style=\"color:#ffffff;\" class=\"wpb_text_column has-custom-color wpex-child-inherit-color wpb_content_element\" >\n\t\t<div class=\"wpb_wrapper\">\n\t\t\t<p class=\"translation-block\"><strong>Angriff:<\/strong><br>\n<span style=\"font-size: 0.8em\"><span style=\"font-weight: 400\">Akira-Ransomware<\/span><\/span><\/p>\n\n\t\t<\/div>\n\t<\/div>\n<\/div><\/div><\/div><div class=\"wpb_column vc_column_container vc_col-sm-1\/5\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\">\n\t<div style=\"color:#ffffff;\" class=\"wpb_text_column has-custom-color wpex-child-inherit-color wpb_content_element\" >\n\t\t<div class=\"wpb_wrapper\">\n\t\t\t<p class=\"translation-block\"><strong>Gef\u00e4hrdete Daten:<\/strong><br>\n<span style=\"font-size: .8em\">Etwa 11 TB an verschl\u00fcsselten Backups virtueller Maschinen, der restliche Teil gel\u00f6scht<\/span><\/p>\n\n\t\t<\/div>\n\t<\/div>\n<\/div><\/div><\/div><div class=\"wpb_column vc_column_container vc_col-sm-1\/5\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\">\n\t<div style=\"color:#ffffff;\" class=\"wpb_text_column has-custom-color wpex-child-inherit-color wpb_content_element vc_custom_1790182117035\" >\n\t\t<div class=\"wpb_wrapper\">\n\t\t\t<p class=\"translation-block\"><strong>Komplikation:<\/strong><br>\n<span style=\"font-size: .8em\">Rund 15 TB, die am Tag nach dem Angriff auf dasselbe Volume geschrieben wurden<\/span><\/p>\n\n\t\t<\/div>\n\t<\/div>\n<\/div><\/div><\/div><div class=\"wpb_column vc_column_container vc_col-sm-1\/5\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\">\n\t<div style=\"color:#ffffff;\" class=\"wpb_text_column has-custom-color wpex-child-inherit-color wpb_content_element\" >\n\t\t<div class=\"wpb_wrapper\">\n\t\t\t<p class=\"translation-block\"><strong>Ergebnis:<\/strong><br>\n<span style=\"font-size: .8em\">99,91 Prozent auf dem priorit\u00e4ren Datenbankserver wiederhergestellt<\/span><\/p>\n\n\t\t<\/div>\n\t<\/div>\n<\/div><\/div><\/div><\/div><div class=\"vc_row wpb_row vc_row-fluid wpex-relative no-bottom-margins\"><div class=\"wpb_column vc_column_container vc_col-sm-12\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\">\n\t<div style=\"color:#ffffff;font-size:18px;\" class=\"wpb_text_column has-custom-color wpex-child-inherit-color wpb_content_element\" >\n\t\t<div class=\"wpb_wrapper\">\n\t\t\t<p>Eine standort\u00fcbergreifend t\u00e4tige Unternehmensorganisation wurde von einem Akira-Ransomware-Angriff getroffen, der den Zugriff auf kritische virtualisierte Systeme st\u00f6rte und erhebliche Teile ihrer Produktionsumgebung gef\u00e4hrdete. Rund 11 TB an Backups virtueller Maschinen, die im Nakivo-Repository des Kunden gespeichert waren, wurden verschl\u00fcsselt. Die verbleibenden Backups wurden gel\u00f6scht.<\/p>\n\n\t\t<\/div>\n\t<\/div>\n<\/div><\/div><\/div><\/div><\/div><div id=\"case-study-blurb-and-scenario\" class=\"vc_section vc_custom_1772461320762 wpex-relative\"><div id=\"video\" class=\"vc_row wpb_row vc_row-fluid vc_row-o-content-middle vc_row-flex wpex-relative no-bottom-margins\"><div class=\"wpb_column vc_column_container vc_col-sm-12\" id=\"video\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\">\n\t<div style=\"color:#6f737e;font-size:18px;\" class=\"wpb_text_column has-custom-color wpex-child-inherit-color wpb_content_element\" >\n\t\t<div class=\"wpb_wrapper\">\n\t\t\t<p>Derselbe Angriff verschl\u00fcsselte auch die produktiven virtuellen Maschinen und lie\u00df die Organisation ohne die Daten zur\u00fcck, die f\u00fcr die Wiederherstellung des Gesch\u00e4ftsbetriebs ben\u00f6tigt wurden.<\/p>\n<p>Innerhalb weniger Tage zog die Organisation ihren Cyberversicherer sowie ein Incident-Response-Unternehmen hinzu. Konventionelle Wiederherstellungsmethoden konnten Teile der Umgebung zur\u00fcckholen, versagten jedoch bei mehreren priorit\u00e4ren virtuellen Maschinen. Das Incident-Response-Unternehmen wandte sich daraufhin an DriveSavers Data Recovery, um zu kl\u00e4ren, ob sich noch nutzbare Daten aus dem betroffenen Speicher gewinnen lie\u00dfen und ob sich die besch\u00e4digten Festplatten der virtuellen Maschinen rekonstruieren lie\u00dfen.<\/p>\n\n\t\t<\/div>\n\t<\/div>\n<\/div><\/div><\/div><\/div><\/div><div id=\"case-study-solution\" class=\"vc_section wpex-relative\"><div class=\"vc_row wpb_row vc_row-fluid vc_row-o-content-middle vc_row-flex wpex-relative no-bottom-margins\"><div class=\"wpb_column vc_column_container vc_col-sm-12\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\"><div class=\"vc_empty_space\"   style=\"height: 40px\"><span class=\"vc_empty_space_inner\"><\/span><\/div><style>.vcex-heading.vcex_6ab56867d949f{color:#3e3d3e;font-size:35px;font-weight:400;}@media (max-width:1024px){.vcex-heading.vcex_6ab56867d949f{font-size:25px;}}@media (max-width:959px){.vcex-heading.vcex_6ab56867d949f{font-size:25px;}}@media (max-width:767px){.vcex-heading.vcex_6ab56867d949f{font-size:25px;}}@media (max-width:479px){.vcex-heading.vcex_6ab56867d949f{font-size:25px;}}<\/style><div class=\"vcex-heading vcex-heading-plain vcex-module wpex-heading wpex-text-2xl wpex-div vcex_6ab56867d949f translation-block\"><span class=\"vcex-heading-inner wpex-inline-block\">Die Situation des <strong><span style=\"color: #e31f26\">Datenverlusts<\/span><\/strong><\/span><\/div>\n\t<div style=\"color:#6f737e;\" class=\"wpb_text_column has-custom-color wpex-child-inherit-color wpb_content_element\" >\n\t\t<div class=\"wpb_wrapper\">\n\t\t\t<p>Als die Laufwerke bei DriveSavers eintrafen, war die Ransomware-Verschl\u00fcsselung nicht mehr das einzige Problem.<\/p>\n<p>Die technische Analyse mithilfe unseres propriet\u00e4ren Tools zur Wiederherstellung virtueller Festplatten identifizierte rund 15 TB an Daten, die am Tag nach dem Angriff auf das Volume geschrieben wurden \u2013 nachdem die Nakivo-Backups bereits gel\u00f6scht worden waren. Diese Schreibvorg\u00e4nge erwiesen sich als folgenreich.<\/p>\n<p>Das L\u00f6schen einer Datei auf BTRFS l\u00f6scht nicht deren Inhalt. Dateisysteme dieser Art markieren die betroffenen Bl\u00f6cke in der Regel als zur Wiederverwendung verf\u00fcgbar, w\u00e4hrend die Daten selbst an Ort und Stelle verbleiben, bis etwas dar\u00fcber geschrieben wird. Die nach dem Angriff durchgef\u00fchrten Schreibvorg\u00e4nge wurden den Bl\u00f6cken zugewiesen, die die gel\u00f6schten Backups zuvor belegt hatten.<\/p>\n<p>Eine weitergehende technische Analyse ergab, dass ein wesentlich gr\u00f6\u00dferer Teil der betroffenen Informationen \u2013 potenziell sogar die gesamten Daten \u2013 h\u00f6chstwahrscheinlich h\u00e4tte wiederhergestellt werden k\u00f6nnen, wenn der betroffene Speicher unver\u00e4ndert geblieben w\u00e4re.<\/p>\n<p>Das bei DriveSavers eingetroffene Volume enthielt somit eine Mischung aus urspr\u00fcnglich intakten Daten, durch Ransomware verschl\u00fcsselten Daten, gel\u00f6schten und neu zugewiesenen Daten, neu geschriebenen Informationen, besch\u00e4digten Dateisystemstrukturen sowie teilweise \u00fcberschriebenen Bl\u00f6cken. Etwa 3.600 Dateien mit einer Gesamtgr\u00f6\u00dfe von 16,1 TB blieben aktiv, wobei 99 % davon VMware-Festplatten und Snapshots waren, deren Dateiendungen in \u201e.AKIRA\" umgeschrieben worden waren.<\/p>\n<p>Ein Merkmal des Angriffs verbesserte die Aussichten. Der bei diesem Vorfall verwendete Verschl\u00fcsselungsalgorithmus verschl\u00fcsselte keine kompletten Dateien. Er verschl\u00fcsselte etwa 15 % jeder Datei in drei B\u00e4ndern, was sich bei den gro\u00dfen VMDKs als etwa 5-prozentige Frontend-Verschl\u00fcsselung darstellte. Erhebliche Bereiche jeder virtuellen Festplatte blieben daher intakt. Eine Analyse auf Blockebene war erforderlich, um diese intakten Bereiche zu identifizieren.<\/p>\n\n\t\t<\/div>\n\t<\/div>\n<\/div><\/div><\/div><\/div><\/div><div id=\"case-study-results\" class=\"vc_section vc_custom_1772464064344 wpex-vc-full-width-section wpex-vc-full-width-section--centered wpex-relative wpex-vc_section-has-fill wpex-vc-reset-negative-margin\"><div class=\"vc_row wpb_row vc_row-fluid vc_row-o-content-middle vc_row-flex wpex-relative no-bottom-margins\"><div class=\"wpb_column vc_column_container vc_col-sm-12\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\"><div class=\"vc_empty_space\"   style=\"height: 40px\"><span class=\"vc_empty_space_inner\"><\/span><\/div><style>.vcex-heading.vcex_6ab56867da7e3{color:#3e3d3e;font-size:35px;font-weight:400;}@media (max-width:1024px){.vcex-heading.vcex_6ab56867da7e3{font-size:25px;}}@media (max-width:959px){.vcex-heading.vcex_6ab56867da7e3{font-size:25px;}}@media (max-width:767px){.vcex-heading.vcex_6ab56867da7e3{font-size:25px;}}@media (max-width:479px){.vcex-heading.vcex_6ab56867da7e3{font-size:25px;}}<\/style><div class=\"vcex-heading vcex-heading-plain vcex-module wpex-heading wpex-text-2xl wpex-div vcex_6ab56867da7e3\"><span class=\"vcex-heading-inner wpex-inline-block\"><strong><span style=\"color: #e31f26\">The Recovery<\/span><\/strong> Process<\/span><\/div><div class=\"vc_empty_space\"   style=\"height: 20px\"><span class=\"vc_empty_space_inner\"><\/span><\/div><\/div><\/div><\/div><\/div><div class=\"vc_row wpb_row vc_row-fluid faq-accord-sec vc_custom_1790193320616 vc_row-o-content-middle vc_row-flex wpex-relative no-bottom-margins\"><div class=\"wpb_column vc_column_container vc_col-sm-12\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\"><div class=\"vc_tta-container\" data-vc-action=\"collapseAll\"><div class=\"vc_general vc_tta vc_tta-accordion vc_tta-color-grey vc_tta-style-total vc_tta-shape-rounded vc_tta-o-shape-group vc_tta-controls-align-default vc_tta-o-all-clickable  accord-column vc_custom_1746707767615\"><div class=\"vc_tta-panels-container\"><div class=\"vc_tta-panels\"><div class=\"vc_tta-panel vc_active faq-accord-title\" id=\"1716890254482-90592e71-20fa\" data-vc-content=\".vc_tta-panel-body\"><div class=\"vc_tta-panel-heading\"><h4 class=\"vc_tta-panel-title vc_tta-controls-icon-position-right\"><a href=\"#1716890254482-90592e71-20fa\" data-vc-accordion data-vc-container=\".vc_tta-container\"><span class=\"vc_tta-title-text\">Fernwiederherstellung gepr\u00fcft und verworfen<\/span><i class=\"vc_tta-controls-icon vc_tta-controls-icon-chevron\"><\/i><\/a><\/h4><\/div><div class=\"vc_tta-panel-body\"><div class=\"vc_row wpb_row vc_inner vc_row-fluid wpex-relative no-bottom-margins\"><div class=\"wpb_column vc_column_container vc_col-sm-12\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\">\n\t<div style=\"color:#6f737e;\" class=\"wpb_text_column has-custom-color wpex-child-inherit-color wpb_content_element vc_custom_1790193004599\" >\n\t\t<div class=\"wpb_wrapper\">\n\t\t\t<p>Eine Remote-Bewertung best\u00e4tigte den Projektumfang und diente dazu, festzustellen, ob die Wiederherstellung aus der Ferne durchgef\u00fchrt werden konnte oder Laborarbeit erforderlich war. Die Wiederherstellung dieser Daten bedeutete, alle zw\u00f6lf Laufwerke auf Sektorebene auszulesen, einschlie\u00dflich Bereiche, auf die das Dateisystem nicht mehr verwies \u2013 ein Fernzugriff auf ein laufendes NAS erreicht in der Regel jedoch das logische Volume und nicht das zugrunde liegende physische Medium. Eine Fernwiederherstellung war daher nicht m\u00f6glich. Ein Ingenieur holte die Laufwerke am darauffolgenden Sonntagabend am San Francisco International Airport ab.<\/p>\n\n\t\t<\/div>\n\t<\/div>\n<\/div><\/div><\/div><\/div><\/div><\/div><div class=\"vc_tta-panel\" id=\"1716980310195-cf5120dd-63bf\" data-vc-content=\".vc_tta-panel-body\"><div class=\"vc_tta-panel-heading\"><h4 class=\"vc_tta-panel-title vc_tta-controls-icon-position-right\"><a href=\"#1716980310195-cf5120dd-63bf\" data-vc-accordion data-vc-container=\".vc_tta-container\"><span class=\"vc_tta-title-text\">Auf den Originallaufwerken wurde keine Datenrettungsoperation durchgef\u00fchrt<\/span><i class=\"vc_tta-controls-icon vc_tta-controls-icon-chevron\"><\/i><\/a><\/h4><\/div><div class=\"vc_tta-panel-body\"><div class=\"vc_row wpb_row vc_inner vc_row-fluid wpex-relative no-bottom-margins\"><div class=\"wpb_column vc_column_container vc_col-sm-12\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\">\n\t<div style=\"color:#6f737e;\" class=\"wpb_text_column has-custom-color wpex-child-inherit-color wpb_content_element vc_custom_1790193010867\" >\n\t\t<div class=\"wpb_wrapper\">\n\t\t\t<p>Alle zw\u00f6lf Laufwerke wurden innerhalb von 24 Stunden nach Ankunft abgebildet (imaged), und jede nachfolgende Operation wurde an diesen Images durchgef\u00fchrt. Die Originalmedien blieben w\u00e4hrend des gesamten Vorgangs im Anlieferungszustand, wodurch der beweisrelevante Zustand w\u00e4hrend der laufenden Analyse erhalten blieb.<\/p>\n\n\t\t<\/div>\n\t<\/div>\n<\/div><\/div><\/div><\/div><\/div><\/div><div class=\"vc_tta-panel\" id=\"1716892470635-67dc37f4-23f5\" data-vc-content=\".vc_tta-panel-body\"><div class=\"vc_tta-panel-heading\"><h4 class=\"vc_tta-panel-title vc_tta-controls-icon-position-right\"><a href=\"#1716892470635-67dc37f4-23f5\" data-vc-accordion data-vc-container=\".vc_tta-container\"><span class=\"vc_tta-title-text\">Die Extraktion lief parallel<\/span><i class=\"vc_tta-controls-icon vc_tta-controls-icon-chevron\"><\/i><\/a><\/h4><\/div><div class=\"vc_tta-panel-body\"><div class=\"vc_row wpb_row vc_inner vc_row-fluid wpex-relative no-bottom-margins\"><div class=\"wpb_column vc_column_container vc_col-sm-12\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\">\n\t<div style=\"color:#6f737e;\" class=\"wpb_text_column has-custom-color wpex-child-inherit-color wpb_content_element vc_custom_1790193018704\" >\n\t\t<div class=\"wpb_wrapper\">\n\t\t\t<p>Rund 120 TB nacheinander, jeweils ein Image nach dem anderen, zu scannen, w\u00e4re nicht praktikabel gewesen. Die Ingenieure teilten die Arbeit in Terabyte-Bereiche auf und f\u00fchrten zehn Scans gleichzeitig durch, wodurch der Durchsatz an die Grenzen der Hardware selbst stie\u00df. Anschlie\u00dfend wurde ein zweiter Satz Images auf einem zweiten System erstellt, sodass die Extraktionen gleichzeitig auf beiden Maschinen fortgesetzt werden konnten.<\/p>\n\n\t\t<\/div>\n\t<\/div>\n<\/div><\/div><\/div><\/div><\/div><\/div><div class=\"vc_tta-panel\" id=\"1716892533584-1defe13c-967c\" data-vc-content=\".vc_tta-panel-body\"><div class=\"vc_tta-panel-heading\"><h4 class=\"vc_tta-panel-title vc_tta-controls-icon-position-right\"><a href=\"#1716892533584-1defe13c-967c\" data-vc-accordion data-vc-container=\".vc_tta-container\"><span class=\"vc_tta-title-text\">Die Dateisystem-Zuordnungstabelle musste manuell rekonstruiert werden<\/span><i class=\"vc_tta-controls-icon vc_tta-controls-icon-chevron\"><\/i><\/a><\/h4><\/div><div class=\"vc_tta-panel-body\"><div class=\"vc_row wpb_row vc_inner vc_row-fluid wpex-relative no-bottom-margins\"><div class=\"wpb_column vc_column_container vc_col-sm-12\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\">\n\t<div style=\"color:#6f737e;\" class=\"wpb_text_column has-custom-color wpex-child-inherit-color wpb_content_element vc_custom_1790193024841\" >\n\t\t<div class=\"wpb_wrapper\">\n\t\t\t<p>W\u00e4hrend Daten gel\u00f6scht wurden, hatte BTRFS damit begonnen, die Ebene zu l\u00f6schen, die gespeicherte Daten ihren physischen Speicherorten zuordnet. Rund 7 TB dieser Zuordnungstabelle waren betroffen, was aus ansonsten lesbarem Speicher unbrauchbare Ausgaben erzeugte. Die Ingenieure stellten fest, dass die betroffenen Bereiche vor der L\u00f6schung zusammenh\u00e4ngend zugewiesen worden waren, was eine manuelle Rekonstruktion erm\u00f6glichte. Der handgef\u00fchrte Wiederaufbau der Zuordnungstabelle stellte den Zugriff auf rund 5 TB an Backup-Daten wieder her, die das Dateisystem bereits freigegeben hatte.<\/p>\n\n\t\t<\/div>\n\t<\/div>\n<\/div><\/div><\/div><\/div><\/div><\/div><div class=\"vc_tta-panel\" id=\"1746706790263-0ece488a-c88d\" data-vc-content=\".vc_tta-panel-body\"><div class=\"vc_tta-panel-heading\"><h4 class=\"vc_tta-panel-title vc_tta-controls-icon-position-right\"><a href=\"#1746706790263-0ece488a-c88d\" data-vc-accordion data-vc-container=\".vc_tta-container\"><span class=\"vc_tta-title-text\">Virtuelle Festplatten auf Blockebene analysiert<\/span><i class=\"vc_tta-controls-icon vc_tta-controls-icon-chevron\"><\/i><\/a><\/h4><\/div><div class=\"vc_tta-panel-body\"><div class=\"vc_row wpb_row vc_inner vc_row-fluid wpex-relative no-bottom-margins\"><div class=\"wpb_column vc_column_container vc_col-sm-12\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\">\n\t<div style=\"color:#6f737e;\" class=\"wpb_text_column has-custom-color wpex-child-inherit-color wpb_content_element vc_custom_1790193030834\" >\n\t\t<div class=\"wpb_wrapper\">\n\t\t\t<p>Eine besch\u00e4digte VMDK-Datei ist selten einfach lesbar oder unlesbar. Die Ingenieure trennten intakte Bereiche von solchen, die verschl\u00fcsselt, besch\u00e4digt, teilweise \u00fcberschrieben oder strukturell gesch\u00e4digt waren. Die drei Maschinen mit der h\u00f6chsten Priorit\u00e4t hatten jeweils f\u00fcnf oder sechs Wiederherstellungspunkte, wobei der aktuellste kurz vor dem Angriff erstellt worden war, was insgesamt 35 VMDK-Dateien ergab. Die Besch\u00e4digung betraf 3 bis 5 % jeder dieser Dateien. Bei einer der drei Maschinen hatte die Verschl\u00fcsselungssoftware die virtuellen Festplattendateien \u00fcberhaupt nicht erreicht.<\/p>\n\n\t\t<\/div>\n\t<\/div>\n<\/div><\/div><\/div><\/div><\/div><\/div><div class=\"vc_tta-panel\" id=\"1746706820873-e77dbc09-0a20\" data-vc-content=\".vc_tta-panel-body\"><div class=\"vc_tta-panel-heading\"><h4 class=\"vc_tta-panel-title vc_tta-controls-icon-position-right\"><a href=\"#1746706820873-e77dbc09-0a20\" data-vc-accordion data-vc-container=\".vc_tta-container\"><span class=\"vc_tta-title-text\">Das F\u00fcllen von L\u00fccken mit Produktionsdaten war mit Risiken verbunden<\/span><i class=\"vc_tta-controls-icon vc_tta-controls-icon-chevron\"><\/i><\/a><\/h4><\/div><div class=\"vc_tta-panel-body\"><div class=\"vc_row wpb_row vc_inner vc_row-fluid wpex-relative no-bottom-margins\"><div class=\"wpb_column vc_column_container vc_col-sm-12\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\">\n\t<div style=\"color:#6f737e;\" class=\"wpb_text_column has-custom-color wpex-child-inherit-color wpb_content_element vc_custom_1790193036872\" >\n\t\t<div class=\"wpb_wrapper\">\n\t\t\t<p>Wo Backup-Daten allein einen Datensatz nicht abdeckten, integrierten die Ingenieure die unverschl\u00fcsselten Bereiche der produktiven virtuellen Festplatten. Dieser Ansatz war wirksam, erforderte jedoch Vorsicht. Zwei der drei priorit\u00e4ren Maschinen verf\u00fcgten zudem \u00fcber Snapshot-Dateien, die zu den von ihnen repr\u00e4sentierten Daten in keiner Eins-zu-eins-Beziehung stehen. Die Strukturen, die die Snapshot-Dateien den von ihnen repr\u00e4sentierten Daten zuordneten, befanden sich in den verschl\u00fcsselten Bereichen. Die Verwendung der produktiven virtuellen Festplatten zum F\u00fcllen von L\u00fccken konnte daher \u00e4ltere Daten einbringen und zu Besch\u00e4digungen f\u00fchren, die sich im Nachhinein nur schwer nachvollziehen lie\u00dfen. Die Ingenieure bewerteten das Risiko f\u00fcr jeden Datensatz individuell, anstatt standardm\u00e4\u00dfig zusammenzuf\u00fchren.<\/p>\n\n\t\t<\/div>\n\t<\/div>\n<\/div><\/div><\/div><\/div><\/div><\/div><div class=\"vc_tta-panel\" id=\"1790012399261-c4054605-890c\" data-vc-content=\".vc_tta-panel-body\"><div class=\"vc_tta-panel-heading\"><h4 class=\"vc_tta-panel-title vc_tta-controls-icon-position-right\"><a href=\"#1790012399261-c4054605-890c\" data-vc-accordion data-vc-container=\".vc_tta-container\"><span class=\"vc_tta-title-text\">\u00dcbergabe, abgestimmt auf die Zielumgebung<\/span><i class=\"vc_tta-controls-icon vc_tta-controls-icon-chevron\"><\/i><\/a><\/h4><\/div><div class=\"vc_tta-panel-body\"><div class=\"vc_row wpb_row vc_inner vc_row-fluid wpex-relative no-bottom-margins\"><div class=\"wpb_column vc_column_container vc_col-sm-12\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\">\n\t<div style=\"color:#6f737e;\" class=\"wpb_text_column has-custom-color wpex-child-inherit-color wpb_content_element vc_custom_1790193043155\" >\n\t\t<div class=\"wpb_wrapper\">\n\t\t\t<p>DriveSavers arbeitete mit dem Incident-Response-Unternehmen und dem Kunden zusammen, um im Voraus festzulegen, in welche Umgebung die Laufwerke reimportiert werden sollten. Die extrahierten Daten auf Dateiebene wurden zun\u00e4chst \u00fcber das Netzwerk zur\u00fcckgeliefert, sodass der Kunde auf bestimmte Dateien zugreifen konnte, w\u00e4hrend die \u00fcbrigen Arbeiten fortgesetzt wurden. Anschlie\u00dfend folgten vollst\u00e4ndige, f\u00fcr den Reimport geeignete VMDK-Dateien.<\/p>\n\n\t\t<\/div>\n\t<\/div>\n<\/div><\/div><\/div><\/div><\/div><\/div><\/div><\/div><\/div><\/div><\/div><\/div><\/div><\/div><\/div><div class=\"vc_section vc_custom_1772464080847 vc_section-o-content-middle vc_section-flex wpex-vc-full-width-section wpex-vc-full-width-section--centered wpex-relative wpex-vc_section-has-fill wpex-vc-reset-negative-margin\"><div class=\"vc_row wpb_row vc_row-fluid vc_row-o-content-middle vc_row-flex wpex-relative no-bottom-margins\"><div class=\"wpb_column vc_column_container vc_col-sm-12\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\"><div class=\"vc_row wpb_row vc_inner vc_row-fluid wpex-relative\"><div class=\"wpb_column vc_column_container vc_col-sm-12\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\"><\/div><\/div><\/div><\/div><div class=\"vc_empty_space\"   style=\"height: 40px\"><span class=\"vc_empty_space_inner\"><\/span><\/div><style>.vcex-heading.vcex_6ab56867dff5b{color:#3e3d3e;font-size:35px;font-weight:400;}@media (max-width:1024px){.vcex-heading.vcex_6ab56867dff5b{font-size:25px;}}@media (max-width:959px){.vcex-heading.vcex_6ab56867dff5b{font-size:25px;}}@media (max-width:767px){.vcex-heading.vcex_6ab56867dff5b{font-size:25px;}}@media (max-width:479px){.vcex-heading.vcex_6ab56867dff5b{font-size:25px;}}<\/style><div class=\"vcex-heading vcex-heading-plain vcex-module wpex-heading wpex-text-2xl wpex-div vcex_6ab56867dff5b translation-block\"><span class=\"vcex-heading-inner wpex-inline-block\"><strong><span style=\"color: #e31f26\">Ergebnisse: 99,91 Prozent<\/span><\/strong> auf dem priorit\u00e4ren Datenbankserver<\/span><\/div><div class=\"vc_empty_space\"   style=\"height: 10px\"><span class=\"vc_empty_space_inner\"><\/span><\/div><div id=\"TABLE-ROW\" class=\"vc_row wpb_row vc_inner vc_row-fluid vc_custom_1790193294209 wpex-relative\"><div class=\"wpb_column vc_column_container vc_col-sm-12\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\">\n\t<div class=\"wpb_raw_code wpb_raw_html wpb_content_element\" >\n\t\t<div class=\"wpb_wrapper\">\n\t\t\t<!-- ===================== RecoverNow Dataset\/Result Table ===================== -->\n<!-- Paste this entire block into a WPBakery \"Raw HTML\" element.            -->\n\n<div class=\"rnptds-wrap\">\n  <div class=\"rnptds-table\" id=\"rnptdsTable\">\n\n    <!-- HEADER ROW -->\n    <div class=\"rnptds-row rnptds-header-row\">\n      <div class=\"rnptds-cell rnptds-head\">Datensatz<\/div>\n      <div class=\"rnptds-cell rnptds-head\">Ergebnis<\/div>\n    <\/div>\n\n    <div class=\"rnptds-row rnptds-shade\">\n      <div class=\"rnptds-cell rnptds-label\">VMDKs des priorit\u00e4ren Datenbankservers, allein aus dem Backup-Repository<\/div>\n      <div class=\"rnptds-cell rnptds-value\">99,4 Prozent wiederhergestellt<\/div>\n    <\/div>\n\n    <div class=\"rnptds-row\">\n      <div class=\"rnptds-cell rnptds-label\">Dieselben VMDKs, nach dem Zusammenf\u00fchren der produktiven virtuellen Festplattenbereiche<\/div>\n      <div class=\"rnptds-cell rnptds-value\">99,91 Prozent wiederhergestellt<\/div>\n    <\/div>\n\n    <div class=\"rnptds-row rnptds-shade\">\n      <div class=\"rnptds-cell rnptds-label\">10-GB-Datenbank-Dump-Datei, geliefert<\/div>\n      <div class=\"rnptds-cell rnptds-value\">99,88 Prozent wiederhergestellt<\/div>\n    <\/div>\n\n    <div class=\"rnptds-row\">\n      <div class=\"rnptds-cell rnptds-label\">Hyper-Backup-Datensatz, 3,12 TB \u00fcber 763.384 Dateien<\/div>\n      <div class=\"rnptds-cell rnptds-value\">99,4 Prozent wiederhergestellt<\/div>\n    <\/div>\n\n  <\/div>\n<\/div>\n\n<style>\n  .rnptds-wrap {\n    --rnptds-line: #7a7a7a;\n    --rnptds-red: #E31F26;\n    --rnptds-label: #6F737E;\n    width: 100%;\n    overflow-x: auto;\n    -webkit-overflow-scrolling: touch;\n    box-sizing: border-box;\n    font-family: \"DM Sans\", sans-serif;\n  }\n  .rnptds-wrap * { box-sizing: border-box; }\n\n  .rnptds-table {\n    display: table;\n    width: 100%;\n    min-width: 500px;\n    border-collapse: separate;\n    border-spacing: 0;\n    border: 1px solid var(--rnptds-line);\n    border-radius: 15px;\n    overflow: hidden;\n  }\n\n  .rnptds-row {\n    display: table-row;\n  }\n\n  .rnptds-cell {\n    display: table-cell;\n    vertical-align: middle;\n    padding: 14px 18px;\n    border-bottom: 1px solid var(--rnptds-line);\n    border-right: 1px solid var(--rnptds-line);\n    text-align: left;\n    font-size: 18px;\n    font-family: \"DM Sans\", sans-serif;\n    background: transparent;\n  }\n\n  .rnptds-cell:last-child { border-right: none; }\n  .rnptds-row:last-child .rnptds-cell { border-bottom: none; }\n\n  .rnptds-cell:first-child { width: 62%; }\n\n  .rnptds-label { color: var(--rnptds-label); font-weight: 500; }\n  .rnptds-value { color: var(--rnptds-label); font-weight: 600; }\n\n  .rnptds-head {\n    background: transparent;\n    font-size: 20px;\n    font-weight: 700;\n    color: #e31f26;\n  }\n<\/style>\n\t\t<\/div>\n\t<\/div>\n<\/div><\/div><\/div><\/div><\/div><\/div><\/div><\/div><div class=\"vc_row wpb_row vc_row-fluid vc_row-o-content-middle vc_row-flex wpex-relative no-bottom-margins\"><div class=\"wpb_column vc_column_container vc_col-sm-12\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\"><div class=\"vc_empty_space\"   style=\"height: 20px\"><span class=\"vc_empty_space_inner\"><\/span><\/div>\n\t<div style=\"color:#6f737e;font-size:18px;\" class=\"wpb_text_column has-custom-color wpex-child-inherit-color wpb_content_element\" >\n\t\t<div class=\"wpb_wrapper\">\n\t\t\t<p>DriveSavers f\u00fchrte den Auftrag als sieben separat abgegrenzte Teilauftr\u00e4ge durch, an denen mehrere Ingenieure parallel arbeiteten, sodass die h\u00f6chstpriorit\u00e4ren Systeme bearbeitet und zur\u00fcckgeliefert werden konnten, bevor der Rest der Umgebung folgte.<\/p>\n<p>DriveSavers wies das Incident-Response-Unternehmen und den Kunden w\u00e4hrend des gesamten Verlaufs darauf hin, dass f\u00fcr die rekonstruierten VMDKs keine Garantie f\u00fcr einen erfolgreichen Bootvorgang \u00fcbernommen werden konnte. Mindestens eine wiederhergestellte virtuelle Maschine konnte erfolgreich gestartet werden. Die \u00fcbrigen wurden als wiederhergestellte Daten und reparierte Festplatten zur\u00fcckgeliefert.<\/p>\n<p>Jede reparierte virtuelle Festplatte wurde von einem Bericht auf Blockebene begleitet, der auswies, welche Bereiche der Festplatte intakt waren und welche nicht wiederherstellbare Sch\u00e4den aufwiesen, mit Objekt-, Datei-, Verzeichnis- und Byte-Zahlen f\u00fcr jeden Bereich. F\u00fcr technische Teams, die eine Umgebung wiederaufbauen, liefert diese Art der Berichterstattung erheblich mehr Informationen als eine einfache Kennzeichnung als wiederhergestellt oder nicht wiederhergestellt. Sie erm\u00f6glicht es Administratoren, die Qualit\u00e4t eines wiederhergestellten Images zu beurteilen und festzustellen, ob eine zus\u00e4tzliche Wiederherstellung auf Anwendungsebene, eine Dateiextraktion oder ein Wiederaufbau erforderlich ist.<\/p>\n\n\t\t<\/div>\n\t<\/div>\n<div class=\"vc_empty_space\"   style=\"height: 20px\"><span class=\"vc_empty_space_inner\"><\/span><\/div><div style=\"border-color:#000000!important;\" class=\"vc_row wpb_row vc_inner vc_row-fluid vc_custom_1790186340921 vc_row-o-content-middle vc_row-flex wpex-relative wpex-vc_row-has-fill wpex-vc-reset-negative-margin\"><div class=\"wpb_column vc_column_container vc_col-sm-12 vc_col-xs-4\"><div class=\"vc_column-inner vc_custom_1727284399200\"><div class=\"wpb_wrapper\"><style>.vcex-icon-box.vcex_6ab56867e1f28 .vcex-icon-box-content{color:#6f737e;}.vcex-icon-box.vcex_6ab56867e1f28 .vcex-icon-box-icon{color:#ec0912;}<\/style><div class=\"vcex-module vcex-icon-box vcex-icon-box-one wpex-flex wpex-text-left vc_custom_1790186401531 vcex_6ab56867e1f28\"><div class=\"vcex-icon-box-symbol vcex-icon-box-symbol--icon wpex-flex-shrink-0 wpex-mr-20\"><div class=\"vcex-icon-box-icon wpex-items-center wpex-justify-center wpex-child-inherit-color wpex-text-center wpex-leading-none wpex-flex wpex-text-1\"><span class=\"wpex-flex wpex-icon--w wpex-icon wpex-icon--bidi\" aria-hidden=\"true\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" viewbox=\"0 0 448 512\"><path d=\"M0 216C0 149.7 53.7 96 120 96h8c17.7 0 32 14.3 32 32s-14.3 32-32 32h-8c-30.9 0-56 25.1-56 56v8h64c35.3 0 64 28.7 64 64v64c0 35.3-28.7 64-64 64H64c-35.3 0-64-28.7-64-64V320 288 216zm256 0c0-66.3 53.7-120 120-120h8c17.7 0 32 14.3 32 32s-14.3 32-32 32h-8c-30.9 0-56 25.1-56 56v8h64c35.3 0 64 28.7 64 64v64c0 35.3-28.7 64-64 64H320c-35.3 0-64-28.7-64-64V320 288 216z\"\/><\/svg><\/span><\/div><\/div><div class=\"vcex-icon-box-text wpex-flex-grow\"><div class=\"vcex-icon-box-content wpex-last-mb-0 wpex-clr\"><p><em>Bitte richten Sie dem gesamten Team aus, wie sehr ich die Unterst\u00fctzung aller bei diesem Projekt zu sch\u00e4tzen wei\u00df.<\/em><\/p>\n<p style=\"text-align: right\">\u2014 Chief Information Officer, Kundenorganisation<\/p>\n<\/div><\/div><\/div><\/div><\/div><\/div><\/div><\/div><\/div><\/div><\/div><\/div><div id=\"case-study-takeaways\" class=\"vc_section vc_custom_1772464095377 vc_section-o-content-middle vc_section-flex wpex-vc-full-width-section wpex-vc-full-width-section--centered wpex-relative wpex-vc_section-has-fill wpex-vc-reset-negative-margin\"><div class=\"vc_row wpb_row vc_row-fluid vc_row-o-content-middle vc_row-flex wpex-relative no-bottom-margins\"><div class=\"wpb_column vc_column_container vc_col-sm-12\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\"><div class=\"vc_empty_space\"   style=\"height: 40px\"><span class=\"vc_empty_space_inner\"><\/span><\/div><style>.vcex-heading.vcex_6ab56867e3307{color:#3e3d3e;font-size:35px;font-weight:400;}@media (max-width:1024px){.vcex-heading.vcex_6ab56867e3307{font-size:25px;}}@media (max-width:959px){.vcex-heading.vcex_6ab56867e3307{font-size:25px;}}@media (max-width:767px){.vcex-heading.vcex_6ab56867e3307{font-size:25px;}}@media (max-width:479px){.vcex-heading.vcex_6ab56867e3307{font-size:25px;}}<\/style><div class=\"vcex-heading vcex-heading-plain vcex-module wpex-heading wpex-text-2xl wpex-div vcex_6ab56867e3307\"><span class=\"vcex-heading-inner wpex-inline-block\"><strong><span style=\"color: #e31f26\">Fazit<\/span><\/strong><\/span><\/div>\n\t<div style=\"color:#6f737e;\" class=\"wpb_text_column has-custom-color wpex-child-inherit-color wpb_content_element\" >\n\t\t<div class=\"wpb_wrapper\">\n\t\t\t<p>Wenn eine Backup-Anwendung eine Wiederherstellung nicht abschlie\u00dfen kann, k\u00f6nnen die zugrunde liegenden Daten dennoch auf dem Speicher vorhanden sein. Dieses Repository war verschl\u00fcsselt, geleert und anschlie\u00dfend \u00fcberschrieben worden, bevor es \u00fcberhaupt einen Wiederherstellungsspezialisten erreichte \u2013 und dennoch lieferte die Rekonstruktion auf Blockebene die Systeme zur\u00fcck, die das Unternehmen am dringendsten ben\u00f6tigte.<\/p>\n<p>Die Wiederherstellung von Daten virtueller Maschinen unter solchen Bedingungen erfordert spezialisiertes Fachwissen, propriet\u00e4re Tools und eine speziell auf das betreffende Dateisystem zugeschnittene Entwicklung. Wenn Ransomware gleichzeitig Produktionssysteme und Backup-Infrastruktur trifft, kann eine spezialisierte Ransomware-Datenrettung einen technischen Weg er\u00f6ffnen, den herk\u00f6mmliche Wiederherstellungsmethoden nicht bieten k\u00f6nnen.<\/p>\n\n\t\t<\/div>\n\t<\/div>\n<div class=\"vc_empty_space\"   style=\"height: 20px\"><span class=\"vc_empty_space_inner\"><\/span><\/div><\/div><\/div><\/div><\/div><div class=\"vc_row wpb_row vc_row-fluid vc_custom_1776873720672 wpex-relative wpex-vc_row-has-fill no-bottom-margins wpex-vc-reset-negative-margin\" style=\"border-color:#000000!important;\"><div class=\"wpb_column vc_column_container vc_col-sm-12 wpex-vc_col-has-fill\"><div class=\"vc_column-inner vc_custom_1760029818507\"><div class=\"wpb_wrapper\">\n\t<div style=\"color:#6f737e;\" class=\"wpb_text_column has-custom-color wpex-child-inherit-color wpb_content_element vc_custom_1790194379795\" >\n\t\t<div class=\"wpb_wrapper\">\n\t\t\t<p style=\"text-align: center;\" class=\"translation-block\"><strong>Stehen Sie vor einer \u00e4hnlichen Situation? <a href=\"\/de-de\/contact\/\" target=\"_self\">Wenden Sie sich an DriveSavers<\/a> unter <a href=\"tel:+18882822227\" target=\"_self\">1 (888) 282-2227<\/a>.<\/strong><\/p>\n\n\t\t<\/div>\n\t<\/div>\n<\/div><\/div><\/div><\/div><\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"<p>DriveSavers stellte 99,91 % eines kritischen Datenbankservers wieder her, nachdem die Ransomware Akira 11 TB an VMware-Backups auf einem Synology-NAS verschl\u00fcsselt und gel\u00f6scht hatte.<\/p>","protected":false},"author":53,"featured_media":86585,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"om_disable_all_campaigns":false,"inline_featured_image":false,"footnotes":""},"categories":[10559],"tags":[11458],"post_series":[],"class_list":["post-86549","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-case-studies","tag-crypto","entry","has-media"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v28.2 (Yoast SEO v28.5) - https:\/\/yoast.com\/product\/yoast-seo-premium-wordpress\/ -->\n<title>VMDK Data Recovery After an Akira Ransomware Attack<\/title>\n<meta name=\"description\" content=\"DriveSavers recovered 99.91% of a critical database server after Akira ransomware encrypted and deleted 11TB of VMware backups on a Synology NAS.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/drivesaversdatarecovery.com\/de-de\/case-studies\/vmdk-data-recovery-after-an-akira-ransomware-attack\/\" \/>\n<meta property=\"og:locale\" content=\"de_DE\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"VMDK Data Recovery After an Akira Ransomware Attack\" \/>\n<meta property=\"og:description\" content=\"DriveSavers recovered 99.91% of a critical database server after Akira ransomware encrypted and deleted 11TB of VMware backups on a Synology NAS.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/drivesaversdatarecovery.com\/de-de\/case-studies\/vmdk-data-recovery-after-an-akira-ransomware-attack\/\" \/>\n<meta property=\"og:site_name\" content=\"DriveSavers Data Recovery Services\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/DriveSavers\" \/>\n<meta property=\"article:published_time\" content=\"2026-09-23T19:18:51+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-09-24T15:50:25+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/drivesaversdatarecovery.com\/wp-content\/uploads\/2026\/09\/VMDK-Data-Recovery-After-an-Akira-Ransomware-Attack1.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"627\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Andy Maus\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@drivesavers\" \/>\n<meta name=\"twitter:site\" content=\"@drivesavers\" \/>\n<meta name=\"twitter:label1\" content=\"Verfasst von\" \/>\n\t<meta name=\"twitter:data1\" content=\"Andy Maus\" \/>\n\t<meta name=\"twitter:label2\" content=\"Gesch\u00e4tzte Lesezeit\" \/>\n\t<meta name=\"twitter:data2\" content=\"6\u00a0Minuten\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"TechArticle\",\"@id\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/case-studies\\\/vmdk-data-recovery-after-an-akira-ransomware-attack\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/case-studies\\\/vmdk-data-recovery-after-an-akira-ransomware-attack\\\/\"},\"author\":{\"name\":\"Andy Maus\",\"@id\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/#\\\/schema\\\/person\\\/d294f7f00d1aee169b2910510fa7e092\"},\"headline\":\"VMDK Data Recovery After an Akira Ransomware Attack\",\"datePublished\":\"2026-09-23T19:18:51+00:00\",\"dateModified\":\"2026-09-24T15:50:25+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/case-studies\\\/vmdk-data-recovery-after-an-akira-ransomware-attack\\\/\"},\"wordCount\":3149,\"publisher\":{\"@id\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/case-studies\\\/vmdk-data-recovery-after-an-akira-ransomware-attack\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/VMDK-Data-Recovery-After-an-Akira-Ransomware-Attack1.png\",\"keywords\":[\"crypto\"],\"articleSection\":[\"Case Studies\"],\"inLanguage\":\"de\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/case-studies\\\/vmdk-data-recovery-after-an-akira-ransomware-attack\\\/\",\"url\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/case-studies\\\/vmdk-data-recovery-after-an-akira-ransomware-attack\\\/\",\"name\":\"VMDK Data Recovery After an Akira Ransomware Attack\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/case-studies\\\/vmdk-data-recovery-after-an-akira-ransomware-attack\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/case-studies\\\/vmdk-data-recovery-after-an-akira-ransomware-attack\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/VMDK-Data-Recovery-After-an-Akira-Ransomware-Attack1.png\",\"datePublished\":\"2026-09-23T19:18:51+00:00\",\"dateModified\":\"2026-09-24T15:50:25+00:00\",\"description\":\"DriveSavers recovered 99.91% of a critical database server after Akira ransomware encrypted and deleted 11TB of VMware backups on a Synology NAS.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/case-studies\\\/vmdk-data-recovery-after-an-akira-ransomware-attack\\\/#breadcrumb\"},\"inLanguage\":\"de\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/drivesaversdatarecovery.com\\\/case-studies\\\/vmdk-data-recovery-after-an-akira-ransomware-attack\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"de\",\"@id\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/case-studies\\\/vmdk-data-recovery-after-an-akira-ransomware-attack\\\/#primaryimage\",\"url\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/VMDK-Data-Recovery-After-an-Akira-Ransomware-Attack1.png\",\"contentUrl\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/VMDK-Data-Recovery-After-an-Akira-Ransomware-Attack1.png\",\"width\":1200,\"height\":627},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/case-studies\\\/vmdk-data-recovery-after-an-akira-ransomware-attack\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"DriveSavers\",\"item\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"VMDK Data Recovery After an Akira Ransomware Attack\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/#website\",\"url\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/\",\"name\":\"DriveSavers Data Recovery Services\",\"description\":\"The Worldwide Leader in Data Recovery\",\"publisher\":{\"@id\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"de\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/#organization\",\"name\":\"DriveSavers Data Recovery\",\"url\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"de\",\"@id\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/wp-content\\\/uploads\\\/2021\\\/08\\\/Logo-01.png\",\"contentUrl\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/wp-content\\\/uploads\\\/2021\\\/08\\\/Logo-01.png\",\"width\":1092,\"height\":1087,\"caption\":\"DriveSavers Data Recovery\"},\"image\":{\"@id\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/DriveSavers\",\"https:\\\/\\\/x.com\\\/drivesavers\",\"https:\\\/\\\/www.instagram.com\\\/drivesavers\\\/\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/drivesavers-data-recovery\\\/\",\"https:\\\/\\\/www.pinterest.com\\\/drivesavers\\\/\",\"https:\\\/\\\/www.youtube.com\\\/channel\\\/UCBlynLMdFWQgid-Gwm0zJ1A\",\"https:\\\/\\\/en.wikipedia.org\\\/wiki\\\/DriveSavers\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/#\\\/schema\\\/person\\\/d294f7f00d1aee169b2910510fa7e092\",\"name\":\"Andy Maus\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"de\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/d40862266d842cfd428c105a72654611de2d431617d5cf0d86aca1087aef2cd0?s=96&d=blank&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/d40862266d842cfd428c105a72654611de2d431617d5cf0d86aca1087aef2cd0?s=96&d=blank&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/d40862266d842cfd428c105a72654611de2d431617d5cf0d86aca1087aef2cd0?s=96&d=blank&r=g\",\"caption\":\"Andy Maus\"},\"description\":\"Andy Maus is Strategic Partnerships &amp; Cyber Recovery Services Leader at DriveSavers, leading initiatives that help organizations recover critical data following cyber incidents, ransomware attacks, and other security breaches. He joined DriveSavers in 2023 after more than two years at Arete Incident Response, where he introduced Data Recovery Services to the firm\u2019s restoration portfolio, expanded the technical operations team from 10 to over 70 specialists, and built strategic alliances with SentinelOne, Dell, and Presidio. Earlier, at Ontrack Data Recovery, he oversaw global sales, supporting complex data restorations for clients across 22 countries. With more than three decades in the technology industry\u2014including leadership roles at Dell, Mitel, and Level 3 Communications\u2014Andy brings deep experience in cyber incident response, data recovery methodologies, and large-scale technical operations.\",\"url\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/de-de\\\/author\\\/andy-maus\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"VMDK Data Recovery After an Akira Ransomware Attack","description":"DriveSavers stellte 99,91 % eines kritischen Datenbankservers wieder her, nachdem die Ransomware Akira 11 TB an VMware-Backups auf einem Synology-NAS verschl\u00fcsselt und gel\u00f6scht hatte.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/drivesaversdatarecovery.com\/de-de\/case-studies\/vmdk-data-recovery-after-an-akira-ransomware-attack\/","og_locale":"de_DE","og_type":"article","og_title":"VMDK Data Recovery After an Akira Ransomware Attack","og_description":"DriveSavers recovered 99.91% of a critical database server after Akira ransomware encrypted and deleted 11TB of VMware backups on a Synology NAS.","og_url":"https:\/\/drivesaversdatarecovery.com\/de-de\/case-studies\/vmdk-data-recovery-after-an-akira-ransomware-attack\/","og_site_name":"DriveSavers Data Recovery Services","article_publisher":"https:\/\/www.facebook.com\/DriveSavers","article_published_time":"2026-09-23T19:18:51+00:00","article_modified_time":"2026-09-24T15:50:25+00:00","og_image":[{"width":1200,"height":627,"url":"https:\/\/drivesaversdatarecovery.com\/wp-content\/uploads\/2026\/09\/VMDK-Data-Recovery-After-an-Akira-Ransomware-Attack1.png","type":"image\/png"}],"author":"Andy Maus","twitter_card":"summary_large_image","twitter_creator":"@drivesavers","twitter_site":"@drivesavers","twitter_misc":{"Verfasst von":"Andy Maus","Gesch\u00e4tzte Lesezeit":"6\u00a0Minuten"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"TechArticle","@id":"https:\/\/drivesaversdatarecovery.com\/case-studies\/vmdk-data-recovery-after-an-akira-ransomware-attack\/#article","isPartOf":{"@id":"https:\/\/drivesaversdatarecovery.com\/case-studies\/vmdk-data-recovery-after-an-akira-ransomware-attack\/"},"author":{"name":"Andy Maus","@id":"https:\/\/drivesaversdatarecovery.com\/#\/schema\/person\/d294f7f00d1aee169b2910510fa7e092"},"headline":"VMDK Data Recovery After an Akira Ransomware Attack","datePublished":"2026-09-23T19:18:51+00:00","dateModified":"2026-09-24T15:50:25+00:00","mainEntityOfPage":{"@id":"https:\/\/drivesaversdatarecovery.com\/case-studies\/vmdk-data-recovery-after-an-akira-ransomware-attack\/"},"wordCount":3149,"publisher":{"@id":"https:\/\/drivesaversdatarecovery.com\/#organization"},"image":{"@id":"https:\/\/drivesaversdatarecovery.com\/case-studies\/vmdk-data-recovery-after-an-akira-ransomware-attack\/#primaryimage"},"thumbnailUrl":"https:\/\/drivesaversdatarecovery.com\/wp-content\/uploads\/2026\/09\/VMDK-Data-Recovery-After-an-Akira-Ransomware-Attack1.png","keywords":["crypto"],"articleSection":["Case Studies"],"inLanguage":"de"},{"@type":"WebPage","@id":"https:\/\/drivesaversdatarecovery.com\/case-studies\/vmdk-data-recovery-after-an-akira-ransomware-attack\/","url":"https:\/\/drivesaversdatarecovery.com\/case-studies\/vmdk-data-recovery-after-an-akira-ransomware-attack\/","name":"VMDK Data Recovery After an Akira Ransomware Attack","isPartOf":{"@id":"https:\/\/drivesaversdatarecovery.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/drivesaversdatarecovery.com\/case-studies\/vmdk-data-recovery-after-an-akira-ransomware-attack\/#primaryimage"},"image":{"@id":"https:\/\/drivesaversdatarecovery.com\/case-studies\/vmdk-data-recovery-after-an-akira-ransomware-attack\/#primaryimage"},"thumbnailUrl":"https:\/\/drivesaversdatarecovery.com\/wp-content\/uploads\/2026\/09\/VMDK-Data-Recovery-After-an-Akira-Ransomware-Attack1.png","datePublished":"2026-09-23T19:18:51+00:00","dateModified":"2026-09-24T15:50:25+00:00","description":"DriveSavers stellte 99,91 % eines kritischen Datenbankservers wieder her, nachdem die Ransomware Akira 11 TB an VMware-Backups auf einem Synology-NAS verschl\u00fcsselt und gel\u00f6scht hatte.","breadcrumb":{"@id":"https:\/\/drivesaversdatarecovery.com\/case-studies\/vmdk-data-recovery-after-an-akira-ransomware-attack\/#breadcrumb"},"inLanguage":"de","potentialAction":[{"@type":"ReadAction","target":["https:\/\/drivesaversdatarecovery.com\/case-studies\/vmdk-data-recovery-after-an-akira-ransomware-attack\/"]}]},{"@type":"ImageObject","inLanguage":"de","@id":"https:\/\/drivesaversdatarecovery.com\/case-studies\/vmdk-data-recovery-after-an-akira-ransomware-attack\/#primaryimage","url":"https:\/\/drivesaversdatarecovery.com\/wp-content\/uploads\/2026\/09\/VMDK-Data-Recovery-After-an-Akira-Ransomware-Attack1.png","contentUrl":"https:\/\/drivesaversdatarecovery.com\/wp-content\/uploads\/2026\/09\/VMDK-Data-Recovery-After-an-Akira-Ransomware-Attack1.png","width":1200,"height":627},{"@type":"BreadcrumbList","@id":"https:\/\/drivesaversdatarecovery.com\/case-studies\/vmdk-data-recovery-after-an-akira-ransomware-attack\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"DriveSavers","item":"https:\/\/drivesaversdatarecovery.com\/"},{"@type":"ListItem","position":2,"name":"VMDK Data Recovery After an Akira Ransomware Attack"}]},{"@type":"WebSite","@id":"https:\/\/drivesaversdatarecovery.com\/#website","url":"https:\/\/drivesaversdatarecovery.com\/","name":"DriveSavers Datenrettungsdienste","description":"The Worldwide Leader in Data Recovery","publisher":{"@id":"https:\/\/drivesaversdatarecovery.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/drivesaversdatarecovery.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"de"},{"@type":"Organization","@id":"https:\/\/drivesaversdatarecovery.com\/#organization","name":"DriveSavers Deutschland","url":"https:\/\/drivesaversdatarecovery.com\/","logo":{"@type":"ImageObject","inLanguage":"de","@id":"https:\/\/drivesaversdatarecovery.com\/#\/schema\/logo\/image\/","url":"https:\/\/drivesaversdatarecovery.com\/wp-content\/uploads\/2021\/08\/Logo-01.png","contentUrl":"https:\/\/drivesaversdatarecovery.com\/wp-content\/uploads\/2021\/08\/Logo-01.png","width":1092,"height":1087,"caption":"DriveSavers Data Recovery"},"image":{"@id":"https:\/\/drivesaversdatarecovery.com\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/DriveSavers","https:\/\/x.com\/drivesavers","https:\/\/www.instagram.com\/drivesavers\/","https:\/\/www.linkedin.com\/company\/drivesavers-data-recovery\/","https:\/\/www.pinterest.com\/drivesavers\/","https:\/\/www.youtube.com\/channel\/UCBlynLMdFWQgid-Gwm0zJ1A","https:\/\/en.wikipedia.org\/wiki\/DriveSavers"]},{"@type":"Person","@id":"https:\/\/drivesaversdatarecovery.com\/#\/schema\/person\/d294f7f00d1aee169b2910510fa7e092","name":"Andy Maus","image":{"@type":"ImageObject","inLanguage":"de","@id":"https:\/\/secure.gravatar.com\/avatar\/d40862266d842cfd428c105a72654611de2d431617d5cf0d86aca1087aef2cd0?s=96&d=blank&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/d40862266d842cfd428c105a72654611de2d431617d5cf0d86aca1087aef2cd0?s=96&d=blank&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/d40862266d842cfd428c105a72654611de2d431617d5cf0d86aca1087aef2cd0?s=96&d=blank&r=g","caption":"Andy Maus"},"description":"Andy Maus is Strategic Partnerships &amp; Cyber Recovery Services Leader at DriveSavers, leading initiatives that help organizations recover critical data following cyber incidents, ransomware attacks, and other security breaches. He joined DriveSavers in 2023 after more than two years at Arete Incident Response, where he introduced Data Recovery Services to the firm\u2019s restoration portfolio, expanded the technical operations team from 10 to over 70 specialists, and built strategic alliances with SentinelOne, Dell, and Presidio. Earlier, at Ontrack Data Recovery, he oversaw global sales, supporting complex data restorations for clients across 22 countries. With more than three decades in the technology industry\u2014including leadership roles at Dell, Mitel, and Level 3 Communications\u2014Andy brings deep experience in cyber incident response, data recovery methodologies, and large-scale technical operations.","url":"https:\/\/drivesaversdatarecovery.com\/de-de\/author\/andy-maus\/"}]}},"_links":{"self":[{"href":"https:\/\/drivesaversdatarecovery.com\/de-de\/wp-json\/wp\/v2\/posts\/86549","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/drivesaversdatarecovery.com\/de-de\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/drivesaversdatarecovery.com\/de-de\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/drivesaversdatarecovery.com\/de-de\/wp-json\/wp\/v2\/users\/53"}],"replies":[{"embeddable":true,"href":"https:\/\/drivesaversdatarecovery.com\/de-de\/wp-json\/wp\/v2\/comments?post=86549"}],"version-history":[{"count":10,"href":"https:\/\/drivesaversdatarecovery.com\/de-de\/wp-json\/wp\/v2\/posts\/86549\/revisions"}],"predecessor-version":[{"id":86586,"href":"https:\/\/drivesaversdatarecovery.com\/de-de\/wp-json\/wp\/v2\/posts\/86549\/revisions\/86586"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/drivesaversdatarecovery.com\/de-de\/wp-json\/wp\/v2\/media\/86585"}],"wp:attachment":[{"href":"https:\/\/drivesaversdatarecovery.com\/de-de\/wp-json\/wp\/v2\/media?parent=86549"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/drivesaversdatarecovery.com\/de-de\/wp-json\/wp\/v2\/categories?post=86549"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/drivesaversdatarecovery.com\/de-de\/wp-json\/wp\/v2\/tags?post=86549"},{"taxonomy":"post_series","embeddable":true,"href":"https:\/\/drivesaversdatarecovery.com\/de-de\/wp-json\/wp\/v2\/post_series?post=86549"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}