Recovering Critical Municipal Data Without Paying a Ransom
Recovering Critical Municipal Data Without Paying a Ransom
Client:
Municipality
Environment:
One Dell PowerEdge RAID and one Dell SAN; two Synology NAS and a TrueNAS storage with Veeam backups
Recovery Challenges:
Deleted backups, partial overwriting, factory reset, and file-system damage
Results:
Ten backup datasets recovered, including a 34TB file-server backup; six additional application backups recovered at 99–100%
Following an INC.ransomware attack, a municipality faced a ransom demand with its production virtual machines encrypted and multiple backup systems compromised. The backups intended to provide a path to restoring business operations had been deleted, partially overwritten, and were inaccessible. Recovering the municipality’s critical data without paying the ransom required finding usable operational data within that damaged backup infrastructure.
DriveSavers recovered a 34TB file-server backup, access-control data, two web-server virtual disks, and six additional application backups. The municipality ultimately confirmed that all needed data had been recovered, providing an alternative to paying the attackers.
The Data Loss Situation
The attack affected both production storage and several layers of backups. Virtual machines on a Dell SAN were encrypted, while the systems holding backup data presented different obstacles to recovery.
A Dell PowerEdge server running Veeam remained accessible, but its 20TB backup volume could not be opened normally. Remote evaluation found that approximately 33% of the volume had been overwritten with zeros.
An eight-drive TrueNAS system holding backup copies showed an empty file system after its contents were deleted. A 24-drive Synology had been factory reset. Another, separate Synology contained surviving Veeam backup files, but missing core components prevented successful imports.
Given these different systems the municipality had multiple potential recovery sources, but no straightforward path to restoring its critical data. Engineers needed to determine what remained on the underlying storage and which sources could yield the backups the customer needed.
Recovery Process
DriveSavers reviewed the environment with the municipality and its incident response provider, identifying which systems could be evaluated remotely and which required laboratory examination. The municipality established its priorities so engineers could focus first on its most important datasets.
Recovery Results
Data was delivered in stages through electronic transfers and shipped storage devices as the recovery progressed. The municipality confirmed that all needed data had been successfully recovered without paying the ransom.
Recovery Summary
The path to recovery lay in backup data that survived the attack but was no longer accessible through normal restoration methods. Finding and extracting that data required work across multiple storage platforms, RAID configurations, and file systems.
By working through damaged backup systems and prioritizing the municipality’s most critical data, DriveSavers recovered everything the customer identified as needed, turning compromised backups into a path forward after the attack.
Facing a similar situation? Contact DriveSavers at 1 (888) 282-2227.
English (United States) 
English (Australia) 
French (France) 
English (UK) 
French (Canada) 
English (Canada) 
Spanish (Mexico) 
German 
Dutch 
Italian 
Finnish 
Polish 
Norwegian 
Swedish 
Danish 
Spanish (Spain) 
Chinese 
Japanese 
German (Austria)