Recovering Critical Municipal Data Without Paying a Ransom
Recovering Critical Municipal Data
Client:
Municipality
Environment:
Dell, Synology, and TrueNAS storage with Veeam backups
Recovery Challenges:
Deleted backups, partial overwriting, factory reset, and file-system damage
Results:
Ten backup datasets recovered, including a 34TB file-server backup; six additional application backups recovered at 99–100%
A municipality faced a ransomware demand with its production virtual machines encrypted and multiple backup systems compromised. The backups intended to provide a way back had been deleted, partially overwritten, or left inaccessible. Recovering the municipality’s critical data without paying the ransom required finding usable data within that damaged backup infrastructure.
DriveSavers recovered a 34TB file-server backup, access-control data, two web-server virtual disks, and six additional application backups. The municipality ultimately confirmed that all needed data had been recovered, providing an alternative to paying the attackers.
The attack affected both production storage and several layers of backups. Virtual machines on a Dell SAN were encrypted, while the systems holding backup data presented different obstacles to recovery.
A Dell server running Veeam remained accessible, but its 20TB backup volume could not be opened normally. Remote evaluation found that approximately 33% of the volume had been overwritten with zeros.
An eight-drive TrueNAS system holding backup copies showed an empty file system after its contents were deleted. A 24-drive Synology had been factory reset. Another Synology contained surviving Veeam backup files, but missing components prevented successful imports.
The municipality had multiple potential recovery sources, but no straightforward path to restoring its critical data. Engineers needed to determine what remained on the underlying storage and which sources could yield the backups the customer needed.
DriveSavers reviewed the environment with the municipality and its incident response provider, identifying which systems could be evaluated remotely and which required laboratory examination. The municipality established its priorities so engineers could focus first on its most important datasets.
Data was delivered in stages through electronic transfers and shipped storage devices as the recovery progressed. The municipality confirmed that all needed data had been successfully recovered without paying the ransom.
The path to recovery lay in backup data that survived the attack but was no longer accessible through normal restoration methods. Finding and extracting that data required work across multiple storage platforms, RAID configurations, and file systems.
By working through damaged backup systems and prioritizing the municipality’s most critical data, DriveSavers recovered everything the customer identified as needed, turning compromised backups into a path forward after the attack.
Facing a similar situation? Contact DriveSavers at 1 (888) 282-2227.
English (United States) 
English (Australia) 
French (France) 
English (UK) 
French (Canada) 
English (Canada) 
Spanish (Mexico) 
German 
Dutch 
Italian 
Finnish 
Polish 
Norwegian 
Swedish 
Danish 
Spanish (Spain) 
Chinese 
Japanese 
German (Austria)