{"id":86549,"date":"2026-09-23T12:18:51","date_gmt":"2026-09-23T19:18:51","guid":{"rendered":"https:\/\/drivesaversdatarecovery.com\/?p=86549"},"modified":"2026-09-24T08:50:25","modified_gmt":"2026-09-24T15:50:25","slug":"vmdk-data-recovery-after-an-akira-ransomware-attack","status":"publish","type":"post","link":"https:\/\/drivesaversdatarecovery.com\/es-mx\/case-studies\/vmdk-data-recovery-after-an-akira-ransomware-attack\/","title":{"rendered":"VMDK Data Recovery After an Akira Ransomware Attack"},"content":{"rendered":"<div class=\"wpb-content-wrapper\"><div id=\"case-study-image-and-title\" class=\"vc_section blog-header-top-padding vc_custom_1743006484198 wpex-vc-full-width-section wpex-vc-full-width-section--centered wpex-relative wpex-vc_section-has-fill wpex-vc-reset-negative-margin\"><div class=\"vc_row wpb_row vc_row-fluid wpex-relative no-bottom-margins\"><div class=\"wpb_column vc_column_container vc_col-sm-12\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\">\n\t<div class=\"wpb_raw_code wpb_raw_html wpb_content_element\" >\n\t\t<div class=\"wpb_wrapper\">\n\t\t\t  <style>\n\n.vcex-video.wpex-bg-black {\n  border-radius: 15px;\n  overflow: hidden;\n}\n\n.vcex-video-inner video {\n  border-radius: 15px;\n}\n\n.case-study-video {\nborder-radius: 15px !important;\n}\n\n.cs-red-heading {\n      color: #EC0912;\nfont-weight: 600;\n    }\n.vcex-heading-inner {\nmargin-bottom:12px;\n}\n        .single-post-title {\n            display: none;\n        }\n    ul.meta {\n       display:none;\n        }\n\n.parent-div {\n  display: flex !important;       \/* Lay the items out in a row by default (desktop) *\/\n  flex-wrap: nowrap !important;   \/* Prevent wrapping on large screens *\/\n}\n\n\/* When the screen is below, say, 768px, wrap and make each child 50% width *\/\n@media (max-width: 768px) {\n  .parent-div {\n    flex-wrap: wrap !important;   \/* Allow wrapping on smaller screens (mobile) *\/\nfont-size: 15px !important;\n  }\n  .parent-div > div {\n    width: 50% !important;        \/* 2 columns (two items per row) *\/\n    box-sizing: border-box !important; \n  }\n.cs-quote-headshot {text-align: center;margin-bottom:13px;}\n.cs-quote-box {\n    margin-left: 30px;\n    margin-right: 30px;\n\n}\n.cs-quote-headshot-image {\nmax-width: 170px;\nmargin-bottom:13px;\nmargin: auto;\n}\n.cs-quote-nametitle {\ntext-align: center !important;\nalign-items: center !important;\n}\n\n}\n\n.cs-main-image-header .wpex-p-30 {\n    padding: 0 !important;\n    padding-left: 3% !important;\npadding-bottom: 3% !important;\n}\n\n.cs-main-image-header .wpex-items-center {\n    align-items: end !important;\n}\n\n@media screen and (max-width: 1300px) {\n    .cs-main-image-header .vcex-ib-content .vcex-ib-title {\n        font-size: 3.5vw !important;\n    }\n\n    .cs-main-image-header .vcex-ib-content .vcex-ib-caption {\n        font-size: 5.5vw !important;\n    }\n}\n\n.cs-main-image-header .vcex-ib-content {\n text-shadow: 0 0 10px #000; \n}\n\n.vc_custom_1743006484198 {\n    margin-top: -10px !important;\n    padding-bottom: 4% !important;\n    background-color: #000000 !important;\n}\n\n.case-study-image-and-title\n{\n    margin-top: -10px !important;\n    padding-bottom: 4% !important;\n    background-color: #000000 !important;\n}\n.blog-header-top-padding\n\n{\n    margin-top: -10px !important;\n    padding-bottom: 4% !important;\n    background-color: #000000 !important;\n}\n  <\/style>\n\n\t\t<\/div>\n\t<\/div>\n<\/div><\/div><\/div><\/div><div class=\"vc_row wpb_row vc_row-fluid vc_custom_1764869151897 wpex-relative no-bottom-margins\"><div class=\"wpb_column vc_column_container vc_col-sm-12\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\"><style>.vcex-image-banner.vcex_6ab550d9449fa .vcex-ib-title{color:#fefefe;font-size:57px;font-family:'DM Sans', sans-serif;font-weight:600;}.vcex-image-banner.vcex_6ab550d9449fa .vcex-ib-caption{color:#ffffff;font-size:45px;font-family:'DM Sans', sans-serif;font-weight:600;}<\/style><div class=\"vcex-module vcex-image-banner wpex-flex wpex-flex-col wpex-w-100 wpex-justify-center wpex-relative wpex-overflow-hidden wpex-bg-gray-900 wpex-text-white wpex-hover-text-white wpex-text-left wpex-rounded-md vcex-has-img-tag cs-main-image-header vcex_6ab550d9449fa\"><img  src=\"https:\/\/drivesaversdatarecovery.com\/wp-content\/uploads\/2026\/09\/VMDK-Data-Recovery-After-an-Akira-Ransomware-Attack-Header-1-1.png\" class=\"vcex-ib-img wpex-block wpex-transition-all wpex-duration-500\" alt=\"\"><div class=\"vcex-ib-content-wrap wpex-w-100 wpex-transition-all wpex-duration-500 wpex-absolute wpex-inset-0 wpex-flex wpex-items-center wpex-p-30\"><div class=\"vcex-ib-content wpex-flex-grow wpex-mr-auto\"><h3 class=\"vcex-ib-title wpex-heading\">Recuperaci\u00f3n de datos VMDK<\/h3><div class=\"vcex-ib-caption wpex-text-lg wpex-last-mb-0\">tras un ataque de ransomware Akira<\/div><\/div><\/div><\/div><div class=\"vcex-spacing wpex-w-100 wpex-clear\" style=\"height:35px;\"><\/div><\/div><\/div><\/div><\/div><div class=\"vc_row wpb_row vc_row-fluid parent-div wpex-relative\"><div class=\"wpb_column vc_column_container vc_col-sm-1\/5\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\">\n\t<div style=\"color:#ffffff;\" class=\"wpb_text_column has-custom-color wpex-child-inherit-color wpb_content_element\" >\n\t\t<div class=\"wpb_wrapper\">\n\t\t\t<p class=\"translation-block\"><strong>Entorno:<\/strong><br>\n<span style=\"font-size: .8em\">Infraestructura VMware respaldada por Nakivo en un Synology RS3621RPXs de 12 bah\u00edas, RAID 5, BTRFS<\/span><\/p>\n\n\t\t<\/div>\n\t<\/div>\n<\/div><\/div><\/div><div class=\"wpb_column vc_column_container vc_col-sm-1\/5\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\">\n\t<div style=\"color:#ffffff;\" class=\"wpb_text_column has-custom-color wpex-child-inherit-color wpb_content_element\" >\n\t\t<div class=\"wpb_wrapper\">\n\t\t\t<p class=\"translation-block\"><strong>Ataque:<\/strong><br>\n<span style=\"font-size: 0.8em\"><span style=\"font-weight: 400\">Ransomware Akira<\/span><\/span><\/p>\n\n\t\t<\/div>\n\t<\/div>\n<\/div><\/div><\/div><div class=\"wpb_column vc_column_container vc_col-sm-1\/5\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\">\n\t<div style=\"color:#ffffff;\" class=\"wpb_text_column has-custom-color wpex-child-inherit-color wpb_content_element\" >\n\t\t<div class=\"wpb_wrapper\">\n\t\t\t<p class=\"translation-block\"><strong>Datos en riesgo:<\/strong><br>\n<span style=\"font-size: .8em\">Aproximadamente 11 TB de copias de seguridad de m\u00e1quinas virtuales cifradas, el resto eliminado<\/span><\/p>\n\n\t\t<\/div>\n\t<\/div>\n<\/div><\/div><\/div><div class=\"wpb_column vc_column_container vc_col-sm-1\/5\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\">\n\t<div style=\"color:#ffffff;\" class=\"wpb_text_column has-custom-color wpex-child-inherit-color wpb_content_element vc_custom_1790182117035\" >\n\t\t<div class=\"wpb_wrapper\">\n\t\t\t<p class=\"translation-block\"><strong>Complicaci\u00f3n:<\/strong><br>\n<span style=\"font-size: .8em\">Aproximadamente 15 TB escritos en el mismo volumen al d\u00eda siguiente del ataque<\/span><\/p>\n\n\t\t<\/div>\n\t<\/div>\n<\/div><\/div><\/div><div class=\"wpb_column vc_column_container vc_col-sm-1\/5\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\">\n\t<div style=\"color:#ffffff;\" class=\"wpb_text_column has-custom-color wpex-child-inherit-color wpb_content_element\" >\n\t\t<div class=\"wpb_wrapper\">\n\t\t\t<p class=\"translation-block\"><strong>Resultado:<\/strong><br>\n<span style=\"font-size: .8em\">99.91 % recuperado en el servidor de base de datos prioritario<\/span><\/p>\n\n\t\t<\/div>\n\t<\/div>\n<\/div><\/div><\/div><\/div><div class=\"vc_row wpb_row vc_row-fluid wpex-relative no-bottom-margins\"><div class=\"wpb_column vc_column_container vc_col-sm-12\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\">\n\t<div style=\"color:#ffffff;font-size:18px;\" class=\"wpb_text_column has-custom-color wpex-child-inherit-color wpb_content_element\" >\n\t\t<div class=\"wpb_wrapper\">\n\t\t\t<p>Una organizaci\u00f3n empresarial con m\u00faltiples sedes sufri\u00f3 un ataque de ransomware Akira que interrumpi\u00f3 el acceso a sistemas virtualizados cr\u00edticos y puso en riesgo partes significativas de su entorno de producci\u00f3n. Aproximadamente 11 TB de copias de seguridad de m\u00e1quinas virtuales almacenadas en el repositorio Nakivo del cliente quedaron cifrados. El resto de las copias de seguridad fueron eliminadas.<\/p>\n\n\t\t<\/div>\n\t<\/div>\n<\/div><\/div><\/div><\/div><\/div><div id=\"case-study-blurb-and-scenario\" class=\"vc_section vc_custom_1772461320762 wpex-relative\"><div id=\"video\" class=\"vc_row wpb_row vc_row-fluid vc_row-o-content-middle vc_row-flex wpex-relative no-bottom-margins\"><div class=\"wpb_column vc_column_container vc_col-sm-12\" id=\"video\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\">\n\t<div style=\"color:#6f737e;font-size:18px;\" class=\"wpb_text_column has-custom-color wpex-child-inherit-color wpb_content_element\" >\n\t\t<div class=\"wpb_wrapper\">\n\t\t\t<p>El mismo ataque cifr\u00f3 las m\u00e1quinas virtuales de producci\u00f3n, dejando a la organizaci\u00f3n sin los datos necesarios para restablecer sus operaciones comerciales.<\/p>\n<p>En cuesti\u00f3n de d\u00edas, la organizaci\u00f3n contact\u00f3 a su aseguradora cibern\u00e9tica y a una firma de respuesta a incidentes. Los m\u00e9todos de restauraci\u00f3n convencionales lograron recuperar partes del entorno, pero no pudieron restablecer varias m\u00e1quinas virtuales prioritarias. La firma de respuesta a incidentes escal\u00f3 el caso a DriveSavers Data Recovery para determinar si a\u00fan era posible recuperar datos utilizables del almacenamiento afectado, y si los discos de m\u00e1quinas virtuales da\u00f1ados pod\u00edan reconstruirse.<\/p>\n\n\t\t<\/div>\n\t<\/div>\n<\/div><\/div><\/div><\/div><\/div><div id=\"case-study-solution\" class=\"vc_section wpex-relative\"><div class=\"vc_row wpb_row vc_row-fluid vc_row-o-content-middle vc_row-flex wpex-relative no-bottom-margins\"><div class=\"wpb_column vc_column_container vc_col-sm-12\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\"><div class=\"vc_empty_space\"   style=\"height: 40px\"><span class=\"vc_empty_space_inner\"><\/span><\/div><style>.vcex-heading.vcex_6ab550d9484ca{color:#3e3d3e;font-size:35px;font-weight:400;}@media (max-width:1024px){.vcex-heading.vcex_6ab550d9484ca{font-size:25px;}}@media (max-width:959px){.vcex-heading.vcex_6ab550d9484ca{font-size:25px;}}@media (max-width:767px){.vcex-heading.vcex_6ab550d9484ca{font-size:25px;}}@media (max-width:479px){.vcex-heading.vcex_6ab550d9484ca{font-size:25px;}}<\/style><div class=\"vcex-heading vcex-heading-plain vcex-module wpex-heading wpex-text-2xl wpex-div vcex_6ab550d9484ca translation-block\"><span class=\"vcex-heading-inner wpex-inline-block\">La situaci\u00f3n de <strong><span style=\"color: #e31f26\">p\u00e9rdida de datos<\/span><\/strong><\/span><\/div>\n\t<div style=\"color:#6f737e;\" class=\"wpb_text_column has-custom-color wpex-child-inherit-color wpb_content_element\" >\n\t\t<div class=\"wpb_wrapper\">\n\t\t\t<p>Para cuando las unidades llegaron a DriveSavers, el cifrado del ransomware ya no era el \u00fanico problema.<\/p>\n<p>El an\u00e1lisis t\u00e9cnico realizado con nuestra herramienta propia de recuperaci\u00f3n de discos virtuales identific\u00f3 aproximadamente 15 TB de datos escritos en el volumen al d\u00eda siguiente del ataque, es decir, despu\u00e9s de que las copias de seguridad de Nakivo ya hab\u00edan sido eliminadas. Esas escrituras resultaron ser determinantes.<\/p>\n<p>Eliminar un archivo en BTRFS no borra su contenido. Los sistemas de archivos de este tipo suelen marcar los bloques afectados como disponibles para su reutilizaci\u00f3n, mientras que los datos en s\u00ed permanecen en su lugar hasta que se escribe algo sobre ellos. Las escrituras realizadas despu\u00e9s del ataque se asignaron a bloques que ocupaban las copias de seguridad eliminadas.<\/p>\n<p>Un an\u00e1lisis t\u00e9cnico m\u00e1s detallado indic\u00f3 que una parte considerablemente mayor de la informaci\u00f3n objetivo, y potencialmente toda ella, probablemente podr\u00eda haberse recuperado si el almacenamiento afectado hubiera permanecido sin cambios.<\/p>\n<p>El soporte que lleg\u00f3 a DriveSavers conten\u00eda, por lo tanto, una mezcla de datos originales intactos, datos cifrados por el ransomware, datos eliminados y reasignados, informaci\u00f3n reci\u00e9n escrita, estructuras de sistema de archivos da\u00f1adas, y bloques que hab\u00edan sido parcialmente sobrescritos. Aproximadamente 3,600 archivos, con un total de 16.1 TB, permanecieron activos, de los cuales el 99% eran discos virtuales de VMware e instant\u00e1neas con extensiones reescritas como .AKIRA.<\/p>\n<p>Una caracter\u00edstica del ataque mejor\u00f3 las perspectivas. El algoritmo de cifrado utilizado en este incidente no cifraba archivos completos. Cifraba aproximadamente el 15% de cada archivo en tres bandas, lo que en los VMDK de gran tama\u00f1o se traduc\u00eda en aproximadamente un 5% de cifrado en la parte inicial. Por lo tanto, regiones sustanciales de cada disco virtual permanecieron intactas. Fue necesario un an\u00e1lisis a nivel de bloque para identificar esas regiones intactas.<\/p>\n\n\t\t<\/div>\n\t<\/div>\n<\/div><\/div><\/div><\/div><\/div><div id=\"case-study-results\" class=\"vc_section vc_custom_1772464064344 wpex-vc-full-width-section wpex-vc-full-width-section--centered wpex-relative wpex-vc_section-has-fill wpex-vc-reset-negative-margin\"><div class=\"vc_row wpb_row vc_row-fluid vc_row-o-content-middle vc_row-flex wpex-relative no-bottom-margins\"><div class=\"wpb_column vc_column_container vc_col-sm-12\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\"><div class=\"vc_empty_space\"   style=\"height: 40px\"><span class=\"vc_empty_space_inner\"><\/span><\/div><style>.vcex-heading.vcex_6ab550d94969c{color:#3e3d3e;font-size:35px;font-weight:400;}@media (max-width:1024px){.vcex-heading.vcex_6ab550d94969c{font-size:25px;}}@media (max-width:959px){.vcex-heading.vcex_6ab550d94969c{font-size:25px;}}@media (max-width:767px){.vcex-heading.vcex_6ab550d94969c{font-size:25px;}}@media (max-width:479px){.vcex-heading.vcex_6ab550d94969c{font-size:25px;}}<\/style><div class=\"vcex-heading vcex-heading-plain vcex-module wpex-heading wpex-text-2xl wpex-div vcex_6ab550d94969c\"><span class=\"vcex-heading-inner wpex-inline-block\"><strong><span style=\"color: #e31f26\">The Recovery<\/span><\/strong> Process<\/span><\/div><div class=\"vc_empty_space\"   style=\"height: 20px\"><span class=\"vc_empty_space_inner\"><\/span><\/div><\/div><\/div><\/div><\/div><div class=\"vc_row wpb_row vc_row-fluid faq-accord-sec vc_custom_1790193320616 vc_row-o-content-middle vc_row-flex wpex-relative no-bottom-margins\"><div class=\"wpb_column vc_column_container vc_col-sm-12\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\"><div class=\"vc_tta-container\" data-vc-action=\"collapseAll\"><div class=\"vc_general vc_tta vc_tta-accordion vc_tta-color-grey vc_tta-style-total vc_tta-shape-rounded vc_tta-o-shape-group vc_tta-controls-align-default vc_tta-o-all-clickable  accord-column vc_custom_1746707767615\"><div class=\"vc_tta-panels-container\"><div class=\"vc_tta-panels\"><div class=\"vc_tta-panel vc_active faq-accord-title\" id=\"1716890254482-90592e71-20fa\" data-vc-content=\".vc_tta-panel-body\"><div class=\"vc_tta-panel-heading\"><h4 class=\"vc_tta-panel-title vc_tta-controls-icon-position-right\"><a href=\"#1716890254482-90592e71-20fa\" data-vc-accordion data-vc-container=\".vc_tta-container\"><span class=\"vc_tta-title-text\">Recuperaci\u00f3n remota evaluada y descartada<\/span><i class=\"vc_tta-controls-icon vc_tta-controls-icon-chevron\"><\/i><\/a><\/h4><\/div><div class=\"vc_tta-panel-body\"><div class=\"vc_row wpb_row vc_inner vc_row-fluid wpex-relative no-bottom-margins\"><div class=\"wpb_column vc_column_container vc_col-sm-12\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\">\n\t<div style=\"color:#6f737e;\" class=\"wpb_text_column has-custom-color wpex-child-inherit-color wpb_content_element vc_custom_1790193004599\" >\n\t\t<div class=\"wpb_wrapper\">\n\t\t\t<p>Una evaluaci\u00f3n remota confirm\u00f3 el alcance del proyecto y sirvi\u00f3 para determinar si la recuperaci\u00f3n pod\u00eda completarse de forma remota o requerir\u00eda trabajo en laboratorio. Recuperar estos datos implicaba leer las doce unidades a nivel de sector, incluidas las regiones que el sistema de archivos ya no referenciaba, y el acceso remoto a un NAS en funcionamiento generalmente alcanza el volumen l\u00f3gico en lugar del soporte f\u00edsico subyacente. La recuperaci\u00f3n remota no fue posible. Un ingeniero recogi\u00f3 las unidades en el Aeropuerto Internacional de San Francisco el domingo siguiente por la noche.<\/p>\n\n\t\t<\/div>\n\t<\/div>\n<\/div><\/div><\/div><\/div><\/div><\/div><div class=\"vc_tta-panel\" id=\"1716980310195-cf5120dd-63bf\" data-vc-content=\".vc_tta-panel-body\"><div class=\"vc_tta-panel-heading\"><h4 class=\"vc_tta-panel-title vc_tta-controls-icon-position-right\"><a href=\"#1716980310195-cf5120dd-63bf\" data-vc-accordion data-vc-container=\".vc_tta-container\"><span class=\"vc_tta-title-text\">No se realiz\u00f3 ninguna operaci\u00f3n de recuperaci\u00f3n de datos en las unidades originales<\/span><i class=\"vc_tta-controls-icon vc_tta-controls-icon-chevron\"><\/i><\/a><\/h4><\/div><div class=\"vc_tta-panel-body\"><div class=\"vc_row wpb_row vc_inner vc_row-fluid wpex-relative no-bottom-margins\"><div class=\"wpb_column vc_column_container vc_col-sm-12\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\">\n\t<div style=\"color:#6f737e;\" class=\"wpb_text_column has-custom-color wpex-child-inherit-color wpb_content_element vc_custom_1790193010867\" >\n\t\t<div class=\"wpb_wrapper\">\n\t\t\t<p>Las doce unidades fueron duplicadas en im\u00e1genes dentro de las 24 horas posteriores a su llegada, y todas las operaciones posteriores se ejecutaron sobre esas im\u00e1genes. Los soportes originales permanecieron tal como se recibieron durante todo el proceso, lo que permiti\u00f3 preservar el estado probatorio mientras avanzaba el an\u00e1lisis.<\/p>\n\n\t\t<\/div>\n\t<\/div>\n<\/div><\/div><\/div><\/div><\/div><\/div><div class=\"vc_tta-panel\" id=\"1716892470635-67dc37f4-23f5\" data-vc-content=\".vc_tta-panel-body\"><div class=\"vc_tta-panel-heading\"><h4 class=\"vc_tta-panel-title vc_tta-controls-icon-position-right\"><a href=\"#1716892470635-67dc37f4-23f5\" data-vc-accordion data-vc-container=\".vc_tta-container\"><span class=\"vc_tta-title-text\">Extracci\u00f3n realizada en paralelo<\/span><i class=\"vc_tta-controls-icon vc_tta-controls-icon-chevron\"><\/i><\/a><\/h4><\/div><div class=\"vc_tta-panel-body\"><div class=\"vc_row wpb_row vc_inner vc_row-fluid wpex-relative no-bottom-margins\"><div class=\"wpb_column vc_column_container vc_col-sm-12\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\">\n\t<div style=\"color:#6f737e;\" class=\"wpb_text_column has-custom-color wpex-child-inherit-color wpb_content_element vc_custom_1790193018704\" >\n\t\t<div class=\"wpb_wrapper\">\n\t\t\t<p>Escanear aproximadamente 120 TB de una sola imagen a la vez no habr\u00eda sido viable. Los ingenieros dividieron el trabajo en rangos de un terabyte y ejecutaron diez an\u00e1lisis de forma simult\u00e1nea, lo que llev\u00f3 el rendimiento a los l\u00edmites propios del hardware. Posteriormente, se construy\u00f3 un segundo conjunto de im\u00e1genes en un segundo sistema, de modo que las extracciones pudieran realizarse en ambas m\u00e1quinas de forma simult\u00e1nea.<\/p>\n\n\t\t<\/div>\n\t<\/div>\n<\/div><\/div><\/div><\/div><\/div><\/div><div class=\"vc_tta-panel\" id=\"1716892533584-1defe13c-967c\" data-vc-content=\".vc_tta-panel-body\"><div class=\"vc_tta-panel-heading\"><h4 class=\"vc_tta-panel-title vc_tta-controls-icon-position-right\"><a href=\"#1716892533584-1defe13c-967c\" data-vc-accordion data-vc-container=\".vc_tta-container\"><span class=\"vc_tta-title-text\">El mapa de asignaci\u00f3n del sistema de archivos requiri\u00f3 reconstrucci\u00f3n manual<\/span><i class=\"vc_tta-controls-icon vc_tta-controls-icon-chevron\"><\/i><\/a><\/h4><\/div><div class=\"vc_tta-panel-body\"><div class=\"vc_row wpb_row vc_inner vc_row-fluid wpex-relative no-bottom-margins\"><div class=\"wpb_column vc_column_container vc_col-sm-12\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\">\n\t<div style=\"color:#6f737e;\" class=\"wpb_text_column has-custom-color wpex-child-inherit-color wpb_content_element vc_custom_1790193024841\" >\n\t\t<div class=\"wpb_wrapper\">\n\t\t\t<p>A medida que se eliminaban los datos, BTRFS hab\u00eda comenzado a borrar la capa que asigna los datos almacenados a sus ubicaciones f\u00edsicas. Aproximadamente 7 TB de ese mapa se vieron afectados, lo que produc\u00eda resultados inutilizables a partir de un almacenamiento por lo dem\u00e1s legible. Los ingenieros determinaron que las regiones afectadas hab\u00edan sido asignadas de forma contigua antes de la eliminaci\u00f3n, lo que hizo posible la reconstrucci\u00f3n manual. Reconstruir el mapa a mano restaur\u00f3 el acceso a aproximadamente 5 TB de datos de respaldo que el sistema de archivos ya hab\u00eda liberado.<\/p>\n\n\t\t<\/div>\n\t<\/div>\n<\/div><\/div><\/div><\/div><\/div><\/div><div class=\"vc_tta-panel\" id=\"1746706790263-0ece488a-c88d\" data-vc-content=\".vc_tta-panel-body\"><div class=\"vc_tta-panel-heading\"><h4 class=\"vc_tta-panel-title vc_tta-controls-icon-position-right\"><a href=\"#1746706790263-0ece488a-c88d\" data-vc-accordion data-vc-container=\".vc_tta-container\"><span class=\"vc_tta-title-text\">Discos virtuales analizados a nivel de bloque<\/span><i class=\"vc_tta-controls-icon vc_tta-controls-icon-chevron\"><\/i><\/a><\/h4><\/div><div class=\"vc_tta-panel-body\"><div class=\"vc_row wpb_row vc_inner vc_row-fluid wpex-relative no-bottom-margins\"><div class=\"wpb_column vc_column_container vc_col-sm-12\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\">\n\t<div style=\"color:#6f737e;\" class=\"wpb_text_column has-custom-color wpex-child-inherit-color wpb_content_element vc_custom_1790193030834\" >\n\t\t<div class=\"wpb_wrapper\">\n\t\t\t<p>Un archivo VMDK da\u00f1ado rara vez es simplemente legible o ilegible. Los ingenieros separaron las regiones intactas de aquellas que estaban cifradas, da\u00f1adas, parcialmente sobrescritas o estructuralmente comprometidas. Las tres m\u00e1quinas de mayor prioridad contaban cada una con cinco o seis puntos de restauraci\u00f3n, el m\u00e1s reciente tomado poco antes del ataque, para un total de 35 archivos VMDK. El da\u00f1o afect\u00f3 entre el 3 % y el 5 % de cada uno de esos archivos. En una de las tres, el cifrador no hab\u00eda llegado a alcanzar en absoluto los archivos de disco virtual.<\/p>\n\n\t\t<\/div>\n\t<\/div>\n<\/div><\/div><\/div><\/div><\/div><\/div><div class=\"vc_tta-panel\" id=\"1746706820873-e77dbc09-0a20\" data-vc-content=\".vc_tta-panel-body\"><div class=\"vc_tta-panel-heading\"><h4 class=\"vc_tta-panel-title vc_tta-controls-icon-position-right\"><a href=\"#1746706820873-e77dbc09-0a20\" data-vc-accordion data-vc-container=\".vc_tta-container\"><span class=\"vc_tta-title-text\">Completar los vac\u00edos con datos de producci\u00f3n implicaba un riesgo<\/span><i class=\"vc_tta-controls-icon vc_tta-controls-icon-chevron\"><\/i><\/a><\/h4><\/div><div class=\"vc_tta-panel-body\"><div class=\"vc_row wpb_row vc_inner vc_row-fluid wpex-relative no-bottom-margins\"><div class=\"wpb_column vc_column_container vc_col-sm-12\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\">\n\t<div style=\"color:#6f737e;\" class=\"wpb_text_column has-custom-color wpex-child-inherit-color wpb_content_element vc_custom_1790193036872\" >\n\t\t<div class=\"wpb_wrapper\">\n\t\t\t<p>Cuando los datos de respaldo por s\u00ed solos no cubr\u00edan un conjunto de datos, los ingenieros incorporaron las regiones no cifradas de los discos virtuales de producci\u00f3n. Este enfoque result\u00f3 eficaz, aunque exig\u00eda cautela. Dos de las tres m\u00e1quinas prioritarias tambi\u00e9n contaban con archivos de instant\u00e1neas, que no tienen una relaci\u00f3n uno a uno con los datos que representan. Las estructuras que asociaban los archivos de instant\u00e1neas con los datos que representaban se encontraban dentro de las regiones cifradas. Por lo tanto, usar los discos virtuales de producci\u00f3n para completar los vac\u00edos pod\u00eda introducir datos m\u00e1s antiguos y generar da\u00f1os dif\u00edciles de rastrear posteriormente. Los ingenieros evaluaron el riesgo de cada conjunto de datos en lugar de combinar por defecto.<\/p>\n\n\t\t<\/div>\n\t<\/div>\n<\/div><\/div><\/div><\/div><\/div><\/div><div class=\"vc_tta-panel\" id=\"1790012399261-c4054605-890c\" data-vc-content=\".vc_tta-panel-body\"><div class=\"vc_tta-panel-heading\"><h4 class=\"vc_tta-panel-title vc_tta-controls-icon-position-right\"><a href=\"#1790012399261-c4054605-890c\" data-vc-accordion data-vc-container=\".vc_tta-container\"><span class=\"vc_tta-title-text\">Entrega dise\u00f1ada para el entorno de destino<\/span><i class=\"vc_tta-controls-icon vc_tta-controls-icon-chevron\"><\/i><\/a><\/h4><\/div><div class=\"vc_tta-panel-body\"><div class=\"vc_row wpb_row vc_inner vc_row-fluid wpex-relative no-bottom-margins\"><div class=\"wpb_column vc_column_container vc_col-sm-12\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\">\n\t<div style=\"color:#6f737e;\" class=\"wpb_text_column has-custom-color wpex-child-inherit-color wpb_content_element vc_custom_1790193043155\" >\n\t\t<div class=\"wpb_wrapper\">\n\t\t\t<p>DriveSavers colabor\u00f3 con la firma de respuesta a incidentes y con el cliente para establecer de antemano en qu\u00e9 entorno se importar\u00edan los discos. Los datos extra\u00eddos a nivel de archivo se devolvieron primero a trav\u00e9s de la red, de modo que el cliente pudiera acceder a archivos espec\u00edficos mientras continuaba el resto del trabajo. A continuaci\u00f3n, se entregaron los archivos VMDK completos, listos para su reimportaci\u00f3n.<\/p>\n\n\t\t<\/div>\n\t<\/div>\n<\/div><\/div><\/div><\/div><\/div><\/div><\/div><\/div><\/div><\/div><\/div><\/div><\/div><\/div><\/div><div class=\"vc_section vc_custom_1772464080847 vc_section-o-content-middle vc_section-flex wpex-vc-full-width-section wpex-vc-full-width-section--centered wpex-relative wpex-vc_section-has-fill wpex-vc-reset-negative-margin\"><div class=\"vc_row wpb_row vc_row-fluid vc_row-o-content-middle vc_row-flex wpex-relative no-bottom-margins\"><div class=\"wpb_column vc_column_container vc_col-sm-12\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\"><div class=\"vc_row wpb_row vc_inner vc_row-fluid wpex-relative\"><div class=\"wpb_column vc_column_container vc_col-sm-12\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\"><\/div><\/div><\/div><\/div><div class=\"vc_empty_space\"   style=\"height: 40px\"><span class=\"vc_empty_space_inner\"><\/span><\/div><style>.vcex-heading.vcex_6ab550d94eaa5{color:#3e3d3e;font-size:35px;font-weight:400;}@media (max-width:1024px){.vcex-heading.vcex_6ab550d94eaa5{font-size:25px;}}@media (max-width:959px){.vcex-heading.vcex_6ab550d94eaa5{font-size:25px;}}@media (max-width:767px){.vcex-heading.vcex_6ab550d94eaa5{font-size:25px;}}@media (max-width:479px){.vcex-heading.vcex_6ab550d94eaa5{font-size:25px;}}<\/style><div class=\"vcex-heading vcex-heading-plain vcex-module wpex-heading wpex-text-2xl wpex-div vcex_6ab550d94eaa5 translation-block\"><span class=\"vcex-heading-inner wpex-inline-block\"><strong><span style=\"color: #e31f26\">Resultados: 99.91 %<\/span><\/strong> en el servidor de base de datos prioritario<\/span><\/div><div class=\"vc_empty_space\"   style=\"height: 10px\"><span class=\"vc_empty_space_inner\"><\/span><\/div><div id=\"TABLE-ROW\" class=\"vc_row wpb_row vc_inner vc_row-fluid vc_custom_1790193294209 wpex-relative\"><div class=\"wpb_column vc_column_container vc_col-sm-12\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\">\n\t<div class=\"wpb_raw_code wpb_raw_html wpb_content_element\" >\n\t\t<div class=\"wpb_wrapper\">\n\t\t\t<!-- ===================== RecoverNow Dataset\/Result Table ===================== -->\n<!-- Paste this entire block into a WPBakery \"Raw HTML\" element.            -->\n\n<div class=\"rnptds-wrap\">\n  <div class=\"rnptds-table\" id=\"rnptdsTable\">\n\n    <!-- HEADER ROW -->\n    <div class=\"rnptds-row rnptds-header-row\">\n      <div class=\"rnptds-cell rnptds-head\">Conjunto de datos<\/div>\n      <div class=\"rnptds-cell rnptds-head\">Resultado<\/div>\n    <\/div>\n\n    <div class=\"rnptds-row rnptds-shade\">\n      <div class=\"rnptds-cell rnptds-label\">VMDK del servidor de base de datos prioritario, solo del repositorio de respaldo<\/div>\n      <div class=\"rnptds-cell rnptds-value\">99.4 % recuperado<\/div>\n    <\/div>\n\n    <div class=\"rnptds-row\">\n      <div class=\"rnptds-cell rnptds-label\">Los mismos VMDK, despu\u00e9s de combinar las regiones de disco virtual de producci\u00f3n<\/div>\n      <div class=\"rnptds-cell rnptds-value\">99.91 % recuperado<\/div>\n    <\/div>\n\n    <div class=\"rnptds-row rnptds-shade\">\n      <div class=\"rnptds-cell rnptds-label\">Archivo de volcado de base de datos de 10 GB, entregado<\/div>\n      <div class=\"rnptds-cell rnptds-value\">99.88 % recuperado<\/div>\n    <\/div>\n\n    <div class=\"rnptds-row\">\n      <div class=\"rnptds-cell rnptds-label\">Ensemble de donn\u00e9es Hyper Backup, 3,12 To r\u00e9partis sur 763 384 fichiers<\/div>\n      <div class=\"rnptds-cell rnptds-value\">3.03 TB en buen estado, 86.74 GB da\u00f1ados<\/div>\n    <\/div>\n\n  <\/div>\n<\/div>\n\n<style>\n  .rnptds-wrap {\n    --rnptds-line: #7a7a7a;\n    --rnptds-red: #E31F26;\n    --rnptds-label: #6F737E;\n    width: 100%;\n    overflow-x: auto;\n    -webkit-overflow-scrolling: touch;\n    box-sizing: border-box;\n    font-family: \"DM Sans\", sans-serif;\n  }\n  .rnptds-wrap * { box-sizing: border-box; }\n\n  .rnptds-table {\n    display: table;\n    width: 100%;\n    min-width: 500px;\n    border-collapse: separate;\n    border-spacing: 0;\n    border: 1px solid var(--rnptds-line);\n    border-radius: 15px;\n    overflow: hidden;\n  }\n\n  .rnptds-row {\n    display: table-row;\n  }\n\n  .rnptds-cell {\n    display: table-cell;\n    vertical-align: middle;\n    padding: 14px 18px;\n    border-bottom: 1px solid var(--rnptds-line);\n    border-right: 1px solid var(--rnptds-line);\n    text-align: left;\n    font-size: 18px;\n    font-family: \"DM Sans\", sans-serif;\n    background: transparent;\n  }\n\n  .rnptds-cell:last-child { border-right: none; }\n  .rnptds-row:last-child .rnptds-cell { border-bottom: none; }\n\n  .rnptds-cell:first-child { width: 62%; }\n\n  .rnptds-label { color: var(--rnptds-label); font-weight: 500; }\n  .rnptds-value { color: var(--rnptds-label); font-weight: 600; }\n\n  .rnptds-head {\n    background: transparent;\n    font-size: 20px;\n    font-weight: 700;\n    color: #e31f26;\n  }\n<\/style>\n\t\t<\/div>\n\t<\/div>\n<\/div><\/div><\/div><\/div><\/div><\/div><\/div><\/div><div class=\"vc_row wpb_row vc_row-fluid vc_row-o-content-middle vc_row-flex wpex-relative no-bottom-margins\"><div class=\"wpb_column vc_column_container vc_col-sm-12\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\"><div class=\"vc_empty_space\"   style=\"height: 20px\"><span class=\"vc_empty_space_inner\"><\/span><\/div>\n\t<div style=\"color:#6f737e;font-size:18px;\" class=\"wpb_text_column has-custom-color wpex-child-inherit-color wpb_content_element\" >\n\t\t<div class=\"wpb_wrapper\">\n\t\t\t<p>DriveSavers llev\u00f3 a cabo el proyecto dividi\u00e9ndolo en siete subproyectos con alcances definidos por separado, con varios ingenieros trabajando en paralelo, de modo que los sistemas de mayor prioridad pudieran procesarse y entregarse antes que el resto del entorno.<\/p>\n<p>DriveSavers advirti\u00f3 a lo largo del proceso tanto a la firma de respuesta a incidentes como al cliente que no se pod\u00eda garantizar que los VMDK reconstruidos arrancaran. Al menos una m\u00e1quina virtual recuperada arranc\u00f3 correctamente. El resto se entreg\u00f3 como datos recuperados y discos reparados.<\/p>\n<p>Cada disco virtual reparado se entreg\u00f3 junto con un informe a nivel de bloque que identificaba qu\u00e9 regiones del disco estaban en buen estado y cu\u00e1les presentaban da\u00f1os irrecuperables, con recuentos de objetos, archivos, directorios y bytes para cada una. Para los equipos t\u00e9cnicos que reconstruyen un entorno, este tipo de informe ofrece considerablemente m\u00e1s informaci\u00f3n que una simple designaci\u00f3n de \"recuperado\" o \"no recuperado\". Permite a los administradores evaluar la calidad de una imagen recuperada y determinar si se necesita recuperaci\u00f3n adicional a nivel de aplicaci\u00f3n, extracci\u00f3n de archivos o reconstrucci\u00f3n.<\/p>\n\n\t\t<\/div>\n\t<\/div>\n<div class=\"vc_empty_space\"   style=\"height: 20px\"><span class=\"vc_empty_space_inner\"><\/span><\/div><div style=\"border-color:#000000!important;\" class=\"vc_row wpb_row vc_inner vc_row-fluid vc_custom_1790186340921 vc_row-o-content-middle vc_row-flex wpex-relative wpex-vc_row-has-fill wpex-vc-reset-negative-margin\"><div class=\"wpb_column vc_column_container vc_col-sm-12 vc_col-xs-4\"><div class=\"vc_column-inner vc_custom_1727284399200\"><div class=\"wpb_wrapper\"><style>.vcex-icon-box.vcex_6ab550d950849 .vcex-icon-box-content{color:#6f737e;}.vcex-icon-box.vcex_6ab550d950849 .vcex-icon-box-icon{color:#ec0912;}<\/style><div class=\"vcex-module vcex-icon-box vcex-icon-box-one wpex-flex wpex-text-left vc_custom_1790186401531 vcex_6ab550d950849\"><div class=\"vcex-icon-box-symbol vcex-icon-box-symbol--icon wpex-flex-shrink-0 wpex-mr-20\"><div class=\"vcex-icon-box-icon wpex-items-center wpex-justify-center wpex-child-inherit-color wpex-text-center wpex-leading-none wpex-flex wpex-text-1\"><span class=\"wpex-flex wpex-icon--w wpex-icon wpex-icon--bidi\" aria-hidden=\"true\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" viewbox=\"0 0 448 512\"><path d=\"M0 216C0 149.7 53.7 96 120 96h8c17.7 0 32 14.3 32 32s-14.3 32-32 32h-8c-30.9 0-56 25.1-56 56v8h64c35.3 0 64 28.7 64 64v64c0 35.3-28.7 64-64 64H64c-35.3 0-64-28.7-64-64V320 288 216zm256 0c0-66.3 53.7-120 120-120h8c17.7 0 32 14.3 32 32s-14.3 32-32 32h-8c-30.9 0-56 25.1-56 56v8h64c35.3 0 64 28.7 64 64v64c0 35.3-28.7 64-64 64H320c-35.3 0-64-28.7-64-64V320 288 216z\"\/><\/svg><\/span><\/div><\/div><div class=\"vcex-icon-box-text wpex-flex-grow\"><div class=\"vcex-icon-box-content wpex-last-mb-0 wpex-clr\"><p><em>Por favor, transmita a todo el equipo lo agradecido que estoy por la ayuda de todos en este proyecto.<\/em><\/p>\n<p style=\"text-align: right\">\u2014 Director de Informaci\u00f3n, organizaci\u00f3n del cliente<\/p>\n<\/div><\/div><\/div><\/div><\/div><\/div><\/div><\/div><\/div><\/div><\/div><\/div><div id=\"case-study-takeaways\" class=\"vc_section vc_custom_1772464095377 vc_section-o-content-middle vc_section-flex wpex-vc-full-width-section wpex-vc-full-width-section--centered wpex-relative wpex-vc_section-has-fill wpex-vc-reset-negative-margin\"><div class=\"vc_row wpb_row vc_row-fluid vc_row-o-content-middle vc_row-flex wpex-relative no-bottom-margins\"><div class=\"wpb_column vc_column_container vc_col-sm-12\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\"><div class=\"vc_empty_space\"   style=\"height: 40px\"><span class=\"vc_empty_space_inner\"><\/span><\/div><style>.vcex-heading.vcex_6ab550d951a43{color:#3e3d3e;font-size:35px;font-weight:400;}@media (max-width:1024px){.vcex-heading.vcex_6ab550d951a43{font-size:25px;}}@media (max-width:959px){.vcex-heading.vcex_6ab550d951a43{font-size:25px;}}@media (max-width:767px){.vcex-heading.vcex_6ab550d951a43{font-size:25px;}}@media (max-width:479px){.vcex-heading.vcex_6ab550d951a43{font-size:25px;}}<\/style><div class=\"vcex-heading vcex-heading-plain vcex-module wpex-heading wpex-text-2xl wpex-div vcex_6ab550d951a43\"><span class=\"vcex-heading-inner wpex-inline-block\"><strong><span style=\"color: #e31f26\">Conclusi\u00f3n<\/span><\/strong><\/span><\/div>\n\t<div style=\"color:#6f737e;\" class=\"wpb_text_column has-custom-color wpex-child-inherit-color wpb_content_element\" >\n\t\t<div class=\"wpb_wrapper\">\n\t\t\t<p>Cuando una aplicaci\u00f3n de respaldo no puede completar una restauraci\u00f3n, es posible que los datos subyacentes sigan presentes en el almacenamiento. Este repositorio hab\u00eda sido cifrado, vaciado y luego sobrescrito antes de llegar a un especialista en recuperaci\u00f3n, y aun as\u00ed la reconstrucci\u00f3n a nivel de bloque logr\u00f3 devolver los sistemas que la empresa m\u00e1s necesitaba.<\/p>\n<p>Recuperar datos de m\u00e1quinas virtuales en esas condiciones requiere conocimientos especializados, herramientas propias y desarrollo personalizado adaptado al sistema de archivos espec\u00edfico en cuesti\u00f3n. Cuando el ransomware afecta simult\u00e1neamente los sistemas de producci\u00f3n y la infraestructura de respaldo, la recuperaci\u00f3n especializada de datos por ransomware puede ofrecer una v\u00eda t\u00e9cnica donde la restauraci\u00f3n convencional no lo logra.<\/p>\n\n\t\t<\/div>\n\t<\/div>\n<div class=\"vc_empty_space\"   style=\"height: 20px\"><span class=\"vc_empty_space_inner\"><\/span><\/div><\/div><\/div><\/div><\/div><div class=\"vc_row wpb_row vc_row-fluid vc_custom_1776873720672 wpex-relative wpex-vc_row-has-fill no-bottom-margins wpex-vc-reset-negative-margin\" style=\"border-color:#000000!important;\"><div class=\"wpb_column vc_column_container vc_col-sm-12 wpex-vc_col-has-fill\"><div class=\"vc_column-inner vc_custom_1760029818507\"><div class=\"wpb_wrapper\">\n\t<div style=\"color:#6f737e;\" class=\"wpb_text_column has-custom-color wpex-child-inherit-color wpb_content_element vc_custom_1790194379795\" >\n\t\t<div class=\"wpb_wrapper\">\n\t\t\t<p style=\"text-align: center;\" class=\"translation-block\"><strong>\u00bfEnfrenta una situaci\u00f3n similar? <a href=\"\/es-mx\/contact\/\" target=\"_self\">Comun\u00edquese con DriveSavers<\/a> al <a href=\"tel:+18882822227\" target=\"_self\">1 (888) 282-2227<\/a>.<\/strong><\/p>\n\n\t\t<\/div>\n\t<\/div>\n<\/div><\/div><\/div><\/div><\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"<p>DriveSavers recuper\u00f3 el 99.91 % de un servidor de base de datos cr\u00edtico despu\u00e9s de que el ransomware Akira cifrara y eliminara 11 TB de copias de seguridad de VMware en un NAS Synology.<\/p>","protected":false},"author":53,"featured_media":86585,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"om_disable_all_campaigns":false,"inline_featured_image":false,"footnotes":""},"categories":[10559],"tags":[11458],"post_series":[],"class_list":["post-86549","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-case-studies","tag-crypto","entry","has-media"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v28.2 (Yoast SEO v28.5) - https:\/\/yoast.com\/product\/yoast-seo-premium-wordpress\/ -->\n<title>VMDK Data Recovery After an Akira Ransomware Attack<\/title>\n<meta name=\"description\" content=\"DriveSavers recovered 99.91% of a critical database server after Akira ransomware encrypted and deleted 11TB of VMware backups on a Synology NAS.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/drivesaversdatarecovery.com\/es-mx\/case-studies\/vmdk-data-recovery-after-an-akira-ransomware-attack\/\" \/>\n<meta property=\"og:locale\" content=\"es_MX\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"VMDK Data Recovery After an Akira Ransomware Attack\" \/>\n<meta property=\"og:description\" content=\"DriveSavers recovered 99.91% of a critical database server after Akira ransomware encrypted and deleted 11TB of VMware backups on a Synology NAS.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/drivesaversdatarecovery.com\/es-mx\/case-studies\/vmdk-data-recovery-after-an-akira-ransomware-attack\/\" \/>\n<meta property=\"og:site_name\" content=\"DriveSavers Data Recovery Services\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/DriveSavers\" \/>\n<meta property=\"article:published_time\" content=\"2026-09-23T19:18:51+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-09-24T15:50:25+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/drivesaversdatarecovery.com\/wp-content\/uploads\/2026\/09\/VMDK-Data-Recovery-After-an-Akira-Ransomware-Attack1.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"627\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Andy Maus\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@drivesavers\" \/>\n<meta name=\"twitter:site\" content=\"@drivesavers\" \/>\n<meta name=\"twitter:label1\" content=\"Escrito por\" \/>\n\t<meta name=\"twitter:data1\" content=\"Andy Maus\" \/>\n\t<meta name=\"twitter:label2\" content=\"Tiempo de lectura\" \/>\n\t<meta name=\"twitter:data2\" content=\"6 minutos\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"TechArticle\",\"@id\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/case-studies\\\/vmdk-data-recovery-after-an-akira-ransomware-attack\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/case-studies\\\/vmdk-data-recovery-after-an-akira-ransomware-attack\\\/\"},\"author\":{\"name\":\"Andy Maus\",\"@id\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/#\\\/schema\\\/person\\\/d294f7f00d1aee169b2910510fa7e092\"},\"headline\":\"VMDK Data Recovery After an Akira Ransomware Attack\",\"datePublished\":\"2026-09-23T19:18:51+00:00\",\"dateModified\":\"2026-09-24T15:50:25+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/case-studies\\\/vmdk-data-recovery-after-an-akira-ransomware-attack\\\/\"},\"wordCount\":3149,\"publisher\":{\"@id\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/case-studies\\\/vmdk-data-recovery-after-an-akira-ransomware-attack\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/VMDK-Data-Recovery-After-an-Akira-Ransomware-Attack1.png\",\"keywords\":[\"crypto\"],\"articleSection\":[\"Case Studies\"],\"inLanguage\":\"es\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/case-studies\\\/vmdk-data-recovery-after-an-akira-ransomware-attack\\\/\",\"url\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/case-studies\\\/vmdk-data-recovery-after-an-akira-ransomware-attack\\\/\",\"name\":\"VMDK Data Recovery After an Akira Ransomware Attack\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/case-studies\\\/vmdk-data-recovery-after-an-akira-ransomware-attack\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/case-studies\\\/vmdk-data-recovery-after-an-akira-ransomware-attack\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/VMDK-Data-Recovery-After-an-Akira-Ransomware-Attack1.png\",\"datePublished\":\"2026-09-23T19:18:51+00:00\",\"dateModified\":\"2026-09-24T15:50:25+00:00\",\"description\":\"DriveSavers recovered 99.91% of a critical database server after Akira ransomware encrypted and deleted 11TB of VMware backups on a Synology NAS.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/case-studies\\\/vmdk-data-recovery-after-an-akira-ransomware-attack\\\/#breadcrumb\"},\"inLanguage\":\"es\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/drivesaversdatarecovery.com\\\/case-studies\\\/vmdk-data-recovery-after-an-akira-ransomware-attack\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"es\",\"@id\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/case-studies\\\/vmdk-data-recovery-after-an-akira-ransomware-attack\\\/#primaryimage\",\"url\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/VMDK-Data-Recovery-After-an-Akira-Ransomware-Attack1.png\",\"contentUrl\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/VMDK-Data-Recovery-After-an-Akira-Ransomware-Attack1.png\",\"width\":1200,\"height\":627},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/case-studies\\\/vmdk-data-recovery-after-an-akira-ransomware-attack\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"DriveSavers\",\"item\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"VMDK Data Recovery After an Akira Ransomware Attack\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/#website\",\"url\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/\",\"name\":\"DriveSavers Data Recovery Services\",\"description\":\"The Worldwide Leader in Data Recovery\",\"publisher\":{\"@id\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"es\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/#organization\",\"name\":\"DriveSavers Data Recovery\",\"url\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"es\",\"@id\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/wp-content\\\/uploads\\\/2021\\\/08\\\/Logo-01.png\",\"contentUrl\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/wp-content\\\/uploads\\\/2021\\\/08\\\/Logo-01.png\",\"width\":1092,\"height\":1087,\"caption\":\"DriveSavers Data Recovery\"},\"image\":{\"@id\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/DriveSavers\",\"https:\\\/\\\/x.com\\\/drivesavers\",\"https:\\\/\\\/www.instagram.com\\\/drivesavers\\\/\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/drivesavers-data-recovery\\\/\",\"https:\\\/\\\/www.pinterest.com\\\/drivesavers\\\/\",\"https:\\\/\\\/www.youtube.com\\\/channel\\\/UCBlynLMdFWQgid-Gwm0zJ1A\",\"https:\\\/\\\/en.wikipedia.org\\\/wiki\\\/DriveSavers\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/#\\\/schema\\\/person\\\/d294f7f00d1aee169b2910510fa7e092\",\"name\":\"Andy Maus\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"es\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/d40862266d842cfd428c105a72654611de2d431617d5cf0d86aca1087aef2cd0?s=96&d=blank&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/d40862266d842cfd428c105a72654611de2d431617d5cf0d86aca1087aef2cd0?s=96&d=blank&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/d40862266d842cfd428c105a72654611de2d431617d5cf0d86aca1087aef2cd0?s=96&d=blank&r=g\",\"caption\":\"Andy Maus\"},\"description\":\"Andy Maus is Strategic Partnerships &amp; Cyber Recovery Services Leader at DriveSavers, leading initiatives that help organizations recover critical data following cyber incidents, ransomware attacks, and other security breaches. He joined DriveSavers in 2023 after more than two years at Arete Incident Response, where he introduced Data Recovery Services to the firm\u2019s restoration portfolio, expanded the technical operations team from 10 to over 70 specialists, and built strategic alliances with SentinelOne, Dell, and Presidio. Earlier, at Ontrack Data Recovery, he oversaw global sales, supporting complex data restorations for clients across 22 countries. With more than three decades in the technology industry\u2014including leadership roles at Dell, Mitel, and Level 3 Communications\u2014Andy brings deep experience in cyber incident response, data recovery methodologies, and large-scale technical operations.\",\"url\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/es-mx\\\/author\\\/andy-maus\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"VMDK Data Recovery After an Akira Ransomware Attack","description":"DriveSavers recuper\u00f3 el 99.91 % de un servidor de base de datos cr\u00edtico despu\u00e9s de que el ransomware Akira cifrara y eliminara 11 TB de copias de seguridad de VMware en un NAS Synology.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/drivesaversdatarecovery.com\/es-mx\/case-studies\/vmdk-data-recovery-after-an-akira-ransomware-attack\/","og_locale":"es_MX","og_type":"article","og_title":"VMDK Data Recovery After an Akira Ransomware Attack","og_description":"DriveSavers recovered 99.91% of a critical database server after Akira ransomware encrypted and deleted 11TB of VMware backups on a Synology NAS.","og_url":"https:\/\/drivesaversdatarecovery.com\/es-mx\/case-studies\/vmdk-data-recovery-after-an-akira-ransomware-attack\/","og_site_name":"DriveSavers Data Recovery Services","article_publisher":"https:\/\/www.facebook.com\/DriveSavers","article_published_time":"2026-09-23T19:18:51+00:00","article_modified_time":"2026-09-24T15:50:25+00:00","og_image":[{"width":1200,"height":627,"url":"https:\/\/drivesaversdatarecovery.com\/wp-content\/uploads\/2026\/09\/VMDK-Data-Recovery-After-an-Akira-Ransomware-Attack1.png","type":"image\/png"}],"author":"Andy Maus","twitter_card":"summary_large_image","twitter_creator":"@drivesavers","twitter_site":"@drivesavers","twitter_misc":{"Escrito por":"Andy Maus","Tiempo de lectura":"6 minutos"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"TechArticle","@id":"https:\/\/drivesaversdatarecovery.com\/case-studies\/vmdk-data-recovery-after-an-akira-ransomware-attack\/#article","isPartOf":{"@id":"https:\/\/drivesaversdatarecovery.com\/case-studies\/vmdk-data-recovery-after-an-akira-ransomware-attack\/"},"author":{"name":"Andy Maus","@id":"https:\/\/drivesaversdatarecovery.com\/#\/schema\/person\/d294f7f00d1aee169b2910510fa7e092"},"headline":"VMDK Data Recovery After an Akira Ransomware Attack","datePublished":"2026-09-23T19:18:51+00:00","dateModified":"2026-09-24T15:50:25+00:00","mainEntityOfPage":{"@id":"https:\/\/drivesaversdatarecovery.com\/case-studies\/vmdk-data-recovery-after-an-akira-ransomware-attack\/"},"wordCount":3149,"publisher":{"@id":"https:\/\/drivesaversdatarecovery.com\/#organization"},"image":{"@id":"https:\/\/drivesaversdatarecovery.com\/case-studies\/vmdk-data-recovery-after-an-akira-ransomware-attack\/#primaryimage"},"thumbnailUrl":"https:\/\/drivesaversdatarecovery.com\/wp-content\/uploads\/2026\/09\/VMDK-Data-Recovery-After-an-Akira-Ransomware-Attack1.png","keywords":["crypto"],"articleSection":["Case Studies"],"inLanguage":"es"},{"@type":"WebPage","@id":"https:\/\/drivesaversdatarecovery.com\/case-studies\/vmdk-data-recovery-after-an-akira-ransomware-attack\/","url":"https:\/\/drivesaversdatarecovery.com\/case-studies\/vmdk-data-recovery-after-an-akira-ransomware-attack\/","name":"VMDK Data Recovery After an Akira Ransomware Attack","isPartOf":{"@id":"https:\/\/drivesaversdatarecovery.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/drivesaversdatarecovery.com\/case-studies\/vmdk-data-recovery-after-an-akira-ransomware-attack\/#primaryimage"},"image":{"@id":"https:\/\/drivesaversdatarecovery.com\/case-studies\/vmdk-data-recovery-after-an-akira-ransomware-attack\/#primaryimage"},"thumbnailUrl":"https:\/\/drivesaversdatarecovery.com\/wp-content\/uploads\/2026\/09\/VMDK-Data-Recovery-After-an-Akira-Ransomware-Attack1.png","datePublished":"2026-09-23T19:18:51+00:00","dateModified":"2026-09-24T15:50:25+00:00","description":"DriveSavers recuper\u00f3 el 99.91 % de un servidor de base de datos cr\u00edtico despu\u00e9s de que el ransomware Akira cifrara y eliminara 11 TB de copias de seguridad de VMware en un NAS Synology.","breadcrumb":{"@id":"https:\/\/drivesaversdatarecovery.com\/case-studies\/vmdk-data-recovery-after-an-akira-ransomware-attack\/#breadcrumb"},"inLanguage":"es","potentialAction":[{"@type":"ReadAction","target":["https:\/\/drivesaversdatarecovery.com\/case-studies\/vmdk-data-recovery-after-an-akira-ransomware-attack\/"]}]},{"@type":"ImageObject","inLanguage":"es","@id":"https:\/\/drivesaversdatarecovery.com\/case-studies\/vmdk-data-recovery-after-an-akira-ransomware-attack\/#primaryimage","url":"https:\/\/drivesaversdatarecovery.com\/wp-content\/uploads\/2026\/09\/VMDK-Data-Recovery-After-an-Akira-Ransomware-Attack1.png","contentUrl":"https:\/\/drivesaversdatarecovery.com\/wp-content\/uploads\/2026\/09\/VMDK-Data-Recovery-After-an-Akira-Ransomware-Attack1.png","width":1200,"height":627},{"@type":"BreadcrumbList","@id":"https:\/\/drivesaversdatarecovery.com\/case-studies\/vmdk-data-recovery-after-an-akira-ransomware-attack\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"DriveSavers","item":"https:\/\/drivesaversdatarecovery.com\/"},{"@type":"ListItem","position":2,"name":"VMDK Data Recovery After an Akira Ransomware Attack"}]},{"@type":"WebSite","@id":"https:\/\/drivesaversdatarecovery.com\/#website","url":"https:\/\/drivesaversdatarecovery.com\/","name":"Servicios de recuperaci\u00f3n de datos de DriveSavers","description":"The Worldwide Leader in Data Recovery","publisher":{"@id":"https:\/\/drivesaversdatarecovery.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/drivesaversdatarecovery.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"es"},{"@type":"Organization","@id":"https:\/\/drivesaversdatarecovery.com\/#organization","name":"DriveSavers M\u00e9xico","url":"https:\/\/drivesaversdatarecovery.com\/","logo":{"@type":"ImageObject","inLanguage":"es","@id":"https:\/\/drivesaversdatarecovery.com\/#\/schema\/logo\/image\/","url":"https:\/\/drivesaversdatarecovery.com\/wp-content\/uploads\/2021\/08\/Logo-01.png","contentUrl":"https:\/\/drivesaversdatarecovery.com\/wp-content\/uploads\/2021\/08\/Logo-01.png","width":1092,"height":1087,"caption":"DriveSavers Data Recovery"},"image":{"@id":"https:\/\/drivesaversdatarecovery.com\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/DriveSavers","https:\/\/x.com\/drivesavers","https:\/\/www.instagram.com\/drivesavers\/","https:\/\/www.linkedin.com\/company\/drivesavers-data-recovery\/","https:\/\/www.pinterest.com\/drivesavers\/","https:\/\/www.youtube.com\/channel\/UCBlynLMdFWQgid-Gwm0zJ1A","https:\/\/en.wikipedia.org\/wiki\/DriveSavers"]},{"@type":"Person","@id":"https:\/\/drivesaversdatarecovery.com\/#\/schema\/person\/d294f7f00d1aee169b2910510fa7e092","name":"Andy Maus","image":{"@type":"ImageObject","inLanguage":"es","@id":"https:\/\/secure.gravatar.com\/avatar\/d40862266d842cfd428c105a72654611de2d431617d5cf0d86aca1087aef2cd0?s=96&d=blank&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/d40862266d842cfd428c105a72654611de2d431617d5cf0d86aca1087aef2cd0?s=96&d=blank&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/d40862266d842cfd428c105a72654611de2d431617d5cf0d86aca1087aef2cd0?s=96&d=blank&r=g","caption":"Andy Maus"},"description":"Andy Maus is Strategic Partnerships &amp; Cyber Recovery Services Leader at DriveSavers, leading initiatives that help organizations recover critical data following cyber incidents, ransomware attacks, and other security breaches. He joined DriveSavers in 2023 after more than two years at Arete Incident Response, where he introduced Data Recovery Services to the firm\u2019s restoration portfolio, expanded the technical operations team from 10 to over 70 specialists, and built strategic alliances with SentinelOne, Dell, and Presidio. Earlier, at Ontrack Data Recovery, he oversaw global sales, supporting complex data restorations for clients across 22 countries. With more than three decades in the technology industry\u2014including leadership roles at Dell, Mitel, and Level 3 Communications\u2014Andy brings deep experience in cyber incident response, data recovery methodologies, and large-scale technical operations.","url":"https:\/\/drivesaversdatarecovery.com\/es-mx\/author\/andy-maus\/"}]}},"_links":{"self":[{"href":"https:\/\/drivesaversdatarecovery.com\/es-mx\/wp-json\/wp\/v2\/posts\/86549","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/drivesaversdatarecovery.com\/es-mx\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/drivesaversdatarecovery.com\/es-mx\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/drivesaversdatarecovery.com\/es-mx\/wp-json\/wp\/v2\/users\/53"}],"replies":[{"embeddable":true,"href":"https:\/\/drivesaversdatarecovery.com\/es-mx\/wp-json\/wp\/v2\/comments?post=86549"}],"version-history":[{"count":10,"href":"https:\/\/drivesaversdatarecovery.com\/es-mx\/wp-json\/wp\/v2\/posts\/86549\/revisions"}],"predecessor-version":[{"id":86586,"href":"https:\/\/drivesaversdatarecovery.com\/es-mx\/wp-json\/wp\/v2\/posts\/86549\/revisions\/86586"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/drivesaversdatarecovery.com\/es-mx\/wp-json\/wp\/v2\/media\/86585"}],"wp:attachment":[{"href":"https:\/\/drivesaversdatarecovery.com\/es-mx\/wp-json\/wp\/v2\/media?parent=86549"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/drivesaversdatarecovery.com\/es-mx\/wp-json\/wp\/v2\/categories?post=86549"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/drivesaversdatarecovery.com\/es-mx\/wp-json\/wp\/v2\/tags?post=86549"},{"taxonomy":"post_series","embeddable":true,"href":"https:\/\/drivesaversdatarecovery.com\/es-mx\/wp-json\/wp\/v2\/post_series?post=86549"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}