{"id":86549,"date":"2026-09-23T12:18:51","date_gmt":"2026-09-23T19:18:51","guid":{"rendered":"https:\/\/drivesaversdatarecovery.com\/?p=86549"},"modified":"2026-09-24T08:50:25","modified_gmt":"2026-09-24T15:50:25","slug":"vmdk-data-recovery-after-an-akira-ransomware-attack","status":"publish","type":"post","link":"https:\/\/drivesaversdatarecovery.com\/nl-nl\/case-studies\/vmdk-data-recovery-after-an-akira-ransomware-attack\/","title":{"rendered":"VMDK Data Recovery After an Akira Ransomware Attack"},"content":{"rendered":"<div class=\"wpb-content-wrapper\"><div id=\"case-study-image-and-title\" class=\"vc_section blog-header-top-padding vc_custom_1743006484198 wpex-vc-full-width-section wpex-vc-full-width-section--centered wpex-relative wpex-vc_section-has-fill wpex-vc-reset-negative-margin\"><div class=\"vc_row wpb_row vc_row-fluid wpex-relative no-bottom-margins\"><div class=\"wpb_column vc_column_container vc_col-sm-12\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\">\n\t<div class=\"wpb_raw_code wpb_raw_html wpb_content_element\" >\n\t\t<div class=\"wpb_wrapper\">\n\t\t\t  <style>\n\n.vcex-video.wpex-bg-black {\n  border-radius: 15px;\n  overflow: hidden;\n}\n\n.vcex-video-inner video {\n  border-radius: 15px;\n}\n\n.case-study-video {\nborder-radius: 15px !important;\n}\n\n.cs-red-heading {\n      color: #EC0912;\nfont-weight: 600;\n    }\n.vcex-heading-inner {\nmargin-bottom:12px;\n}\n        .single-post-title {\n            display: none;\n        }\n    ul.meta {\n       display:none;\n        }\n\n.parent-div {\n  display: flex !important;       \/* Lay the items out in a row by default (desktop) *\/\n  flex-wrap: nowrap !important;   \/* Prevent wrapping on large screens *\/\n}\n\n\/* When the screen is below, say, 768px, wrap and make each child 50% width *\/\n@media (max-width: 768px) {\n  .parent-div {\n    flex-wrap: wrap !important;   \/* Allow wrapping on smaller screens (mobile) *\/\nfont-size: 15px !important;\n  }\n  .parent-div > div {\n    width: 50% !important;        \/* 2 columns (two items per row) *\/\n    box-sizing: border-box !important; \n  }\n.cs-quote-headshot {text-align: center;margin-bottom:13px;}\n.cs-quote-box {\n    margin-left: 30px;\n    margin-right: 30px;\n\n}\n.cs-quote-headshot-image {\nmax-width: 170px;\nmargin-bottom:13px;\nmargin: auto;\n}\n.cs-quote-nametitle {\ntext-align: center !important;\nalign-items: center !important;\n}\n\n}\n\n.cs-main-image-header .wpex-p-30 {\n    padding: 0 !important;\n    padding-left: 3% !important;\npadding-bottom: 3% !important;\n}\n\n.cs-main-image-header .wpex-items-center {\n    align-items: end !important;\n}\n\n@media screen and (max-width: 1300px) {\n    .cs-main-image-header .vcex-ib-content .vcex-ib-title {\n        font-size: 3.5vw !important;\n    }\n\n    .cs-main-image-header .vcex-ib-content .vcex-ib-caption {\n        font-size: 5.5vw !important;\n    }\n}\n\n.cs-main-image-header .vcex-ib-content {\n text-shadow: 0 0 10px #000; \n}\n\n.vc_custom_1743006484198 {\n    margin-top: -10px !important;\n    padding-bottom: 4% !important;\n    background-color: #000000 !important;\n}\n\n.case-study-image-and-title\n{\n    margin-top: -10px !important;\n    padding-bottom: 4% !important;\n    background-color: #000000 !important;\n}\n.blog-header-top-padding\n\n{\n    margin-top: -10px !important;\n    padding-bottom: 4% !important;\n    background-color: #000000 !important;\n}\n  <\/style>\n\n\t\t<\/div>\n\t<\/div>\n<\/div><\/div><\/div><\/div><div class=\"vc_row wpb_row vc_row-fluid vc_custom_1764869151897 wpex-relative no-bottom-margins\"><div class=\"wpb_column vc_column_container vc_col-sm-12\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\"><style>.vcex-image-banner.vcex_6ab567666aabd .vcex-ib-title{color:#fefefe;font-size:57px;font-family:'DM Sans', sans-serif;font-weight:600;}.vcex-image-banner.vcex_6ab567666aabd .vcex-ib-caption{color:#ffffff;font-size:45px;font-family:'DM Sans', sans-serif;font-weight:600;}<\/style><div class=\"vcex-module vcex-image-banner wpex-flex wpex-flex-col wpex-w-100 wpex-justify-center wpex-relative wpex-overflow-hidden wpex-bg-gray-900 wpex-text-white wpex-hover-text-white wpex-text-left wpex-rounded-md vcex-has-img-tag cs-main-image-header vcex_6ab567666aabd\"><img  src=\"https:\/\/drivesaversdatarecovery.com\/wp-content\/uploads\/2026\/09\/VMDK-Data-Recovery-After-an-Akira-Ransomware-Attack-Header-1-1.png\" class=\"vcex-ib-img wpex-block wpex-transition-all wpex-duration-500\" alt=\"\"><div class=\"vcex-ib-content-wrap wpex-w-100 wpex-transition-all wpex-duration-500 wpex-absolute wpex-inset-0 wpex-flex wpex-items-center wpex-p-30\"><div class=\"vcex-ib-content wpex-flex-grow wpex-mr-auto\"><h3 class=\"vcex-ib-title wpex-heading\">VMDK-dataherstel<\/h3><div class=\"vcex-ib-caption wpex-text-lg wpex-last-mb-0\">na een Akira-ransomware-aanval<\/div><\/div><\/div><\/div><div class=\"vcex-spacing wpex-w-100 wpex-clear\" style=\"height:35px;\"><\/div><\/div><\/div><\/div><\/div><div class=\"vc_row wpb_row vc_row-fluid parent-div wpex-relative\"><div class=\"wpb_column vc_column_container vc_col-sm-1\/5\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\">\n\t<div style=\"color:#ffffff;\" class=\"wpb_text_column has-custom-color wpex-child-inherit-color wpb_content_element\" >\n\t\t<div class=\"wpb_wrapper\">\n\t\t\t<p class=\"translation-block\"><strong>Omgeving:<\/strong><br>\n<span style=\"font-size: .8em\">VMware-omgeving geback-upt door Nakivo naar een Synology RS3621RPXs met 12 bays, RAID 5, BTRFS<\/span><\/p>\n\n\t\t<\/div>\n\t<\/div>\n<\/div><\/div><\/div><div class=\"wpb_column vc_column_container vc_col-sm-1\/5\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\">\n\t<div style=\"color:#ffffff;\" class=\"wpb_text_column has-custom-color wpex-child-inherit-color wpb_content_element\" >\n\t\t<div class=\"wpb_wrapper\">\n\t\t\t<p class=\"translation-block\"><strong>Aanval:<\/strong><br>\n<span style=\"font-size: 0.8em\"><span style=\"font-weight: 400\">Akira-ransomware<\/span><\/span><\/p>\n\n\t\t<\/div>\n\t<\/div>\n<\/div><\/div><\/div><div class=\"wpb_column vc_column_container vc_col-sm-1\/5\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\">\n\t<div style=\"color:#ffffff;\" class=\"wpb_text_column has-custom-color wpex-child-inherit-color wpb_content_element\" >\n\t\t<div class=\"wpb_wrapper\">\n\t\t\t<p class=\"translation-block\"><strong>Gegevens in gevaar:<\/strong><br>\n<span style=\"font-size: .8em\">Ongeveer 11 TB aan versleutelde back-ups van virtuele machines, de rest verwijderd<\/span><\/p>\n\n\t\t<\/div>\n\t<\/div>\n<\/div><\/div><\/div><div class=\"wpb_column vc_column_container vc_col-sm-1\/5\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\">\n\t<div style=\"color:#ffffff;\" class=\"wpb_text_column has-custom-color wpex-child-inherit-color wpb_content_element vc_custom_1790182117035\" >\n\t\t<div class=\"wpb_wrapper\">\n\t\t\t<p class=\"translation-block\"><strong>Complicatie:<\/strong><br>\n<span style=\"font-size: .8em\">Ongeveer 15 TB naar hetzelfde volume geschreven op de dag na de aanval<\/span><\/p>\n\n\t\t<\/div>\n\t<\/div>\n<\/div><\/div><\/div><div class=\"wpb_column vc_column_container vc_col-sm-1\/5\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\">\n\t<div style=\"color:#ffffff;\" class=\"wpb_text_column has-custom-color wpex-child-inherit-color wpb_content_element\" >\n\t\t<div class=\"wpb_wrapper\">\n\t\t\t<p class=\"translation-block\"><strong>Resultaat:<\/strong><br>\n<span style=\"font-size: .8em\">99,91 procent hersteld op de prioritaire databaseserver<\/span><\/p>\n\n\t\t<\/div>\n\t<\/div>\n<\/div><\/div><\/div><\/div><div class=\"vc_row wpb_row vc_row-fluid wpex-relative no-bottom-margins\"><div class=\"wpb_column vc_column_container vc_col-sm-12\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\">\n\t<div style=\"color:#ffffff;font-size:18px;\" class=\"wpb_text_column has-custom-color wpex-child-inherit-color wpb_content_element\" >\n\t\t<div class=\"wpb_wrapper\">\n\t\t\t<p>Een organisatie met meerdere vestigingen kreeg te maken met een Akira-ransomware-aanval die de toegang tot kritieke gevirtualiseerde systemen verstoorde en aanzienlijke delen van de productieomgeving in gevaar bracht. Ongeveer 11 TB aan back-ups van virtuele machines, opgeslagen in de Nakivo-repository van de klant, werden versleuteld. De resterende back-ups werden verwijderd.<\/p>\n\n\t\t<\/div>\n\t<\/div>\n<\/div><\/div><\/div><\/div><\/div><div id=\"case-study-blurb-and-scenario\" class=\"vc_section vc_custom_1772461320762 wpex-relative\"><div id=\"video\" class=\"vc_row wpb_row vc_row-fluid vc_row-o-content-middle vc_row-flex wpex-relative no-bottom-margins\"><div class=\"wpb_column vc_column_container vc_col-sm-12\" id=\"video\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\">\n\t<div style=\"color:#6f737e;font-size:18px;\" class=\"wpb_text_column has-custom-color wpex-child-inherit-color wpb_content_element\" >\n\t\t<div class=\"wpb_wrapper\">\n\t\t\t<p>Dezelfde aanval versleutelde ook de virtuele machines in productie, waardoor de organisatie niet meer beschikte over de gegevens die nodig waren om de bedrijfsvoering te herstellen.<\/p>\n<p>Binnen enkele dagen schakelde de organisatie haar cyberverzekeraar en een incident response-bedrijf in. Conventionele herstelmethoden brachten delen van de omgeving terug, maar konden meerdere prioritaire virtuele machines niet herstellen. Het incident response-bedrijf schaalde het probleem op naar DriveSavers Data Recovery om te bepalen of er nog bruikbare gegevens uit de getroffen opslag konden worden hersteld, en of beschadigde schijven van virtuele machines konden worden gereconstrueerd.<\/p>\n\n\t\t<\/div>\n\t<\/div>\n<\/div><\/div><\/div><\/div><\/div><div id=\"case-study-solution\" class=\"vc_section wpex-relative\"><div class=\"vc_row wpb_row vc_row-fluid vc_row-o-content-middle vc_row-flex wpex-relative no-bottom-margins\"><div class=\"wpb_column vc_column_container vc_col-sm-12\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\"><div class=\"vc_empty_space\"   style=\"height: 40px\"><span class=\"vc_empty_space_inner\"><\/span><\/div><style>.vcex-heading.vcex_6ab567666e8b3{color:#3e3d3e;font-size:35px;font-weight:400;}@media (max-width:1024px){.vcex-heading.vcex_6ab567666e8b3{font-size:25px;}}@media (max-width:959px){.vcex-heading.vcex_6ab567666e8b3{font-size:25px;}}@media (max-width:767px){.vcex-heading.vcex_6ab567666e8b3{font-size:25px;}}@media (max-width:479px){.vcex-heading.vcex_6ab567666e8b3{font-size:25px;}}<\/style><div class=\"vcex-heading vcex-heading-plain vcex-module wpex-heading wpex-text-2xl wpex-div vcex_6ab567666e8b3 translation-block\"><span class=\"vcex-heading-inner wpex-inline-block\">De situatie van <strong><span style=\"color: #e31f26\">gegevensverlies<\/span><\/strong><\/span><\/div>\n\t<div style=\"color:#6f737e;\" class=\"wpb_text_column has-custom-color wpex-child-inherit-color wpb_content_element\" >\n\t\t<div class=\"wpb_wrapper\">\n\t\t\t<p>Tegen de tijd dat de schijven bij DriveSavers aankwamen, was de ransomware-versleuteling niet langer het enige probleem.<\/p>\n<p>Technische analyse met onze eigen tool voor het herstellen van virtuele schijven identificeerde ongeveer 15 TB aan gegevens die de dag na de aanval naar het volume waren geschreven \u2014 nadat de Nakivo-back-ups al waren verwijderd. Die schrijfacties bleken ingrijpende gevolgen te hebben.<\/p>\n<p>Het verwijderen van een bestand op BTRFS wist de inhoud ervan niet. Bestandssystemen van dit type markeren de betreffende blokken doorgaans als beschikbaar voor hergebruik, terwijl de gegevens zelf op hun plaats blijven totdat er iets overheen wordt geschreven. De na de aanval uitgevoerde schrijfacties werden toegewezen aan blokken die de verwijderde back-ups eerder in beslag namen.<\/p>\n<p>Verdere technische analyse wees uit dat een aanzienlijk groter deel van de gerichte informatie, en mogelijk zelfs alles ervan, waarschijnlijk hersteld had kunnen worden als de getroffen opslag ongewijzigd was gebleven.<\/p>\n<p>Het volume dat bij DriveSavers aankwam, bevatte dus een mix van origineel intacte gegevens, door ransomware versleutelde gegevens, verwijderde en herverdeelde gegevens, nieuw geschreven informatie, beschadigde bestandssysteemstructuren en gedeeltelijk overschreven blokken. Ongeveer 3.600 bestanden, met een totaal van 16,1 TB, bleven actief, waarvan 99% VMware-virtuele schijven en snapshots waren waarvan de extensies waren herschreven naar .AKIRA.<\/p>\n<p>E\u00e9n kenmerk van de aanval verbeterde de vooruitzichten. Het bij dit incident gebruikte versleutelingsalgoritme versleutelde geen volledige bestanden. Het versleutelde ongeveer 15% van elk bestand in drie banden, wat zich op de grote VMDK's vertaalde naar ongeveer 5% front-end-versleuteling. Aanzienlijke delen van elke virtuele schijf bleven daardoor intact. Blok-niveau-analyse was nodig om die intacte gebieden te identificeren.<\/p>\n\n\t\t<\/div>\n\t<\/div>\n<\/div><\/div><\/div><\/div><\/div><div id=\"case-study-results\" class=\"vc_section vc_custom_1772464064344 wpex-vc-full-width-section wpex-vc-full-width-section--centered wpex-relative wpex-vc_section-has-fill wpex-vc-reset-negative-margin\"><div class=\"vc_row wpb_row vc_row-fluid vc_row-o-content-middle vc_row-flex wpex-relative no-bottom-margins\"><div class=\"wpb_column vc_column_container vc_col-sm-12\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\"><div class=\"vc_empty_space\"   style=\"height: 40px\"><span class=\"vc_empty_space_inner\"><\/span><\/div><style>.vcex-heading.vcex_6ab567666fc48{color:#3e3d3e;font-size:35px;font-weight:400;}@media (max-width:1024px){.vcex-heading.vcex_6ab567666fc48{font-size:25px;}}@media (max-width:959px){.vcex-heading.vcex_6ab567666fc48{font-size:25px;}}@media (max-width:767px){.vcex-heading.vcex_6ab567666fc48{font-size:25px;}}@media (max-width:479px){.vcex-heading.vcex_6ab567666fc48{font-size:25px;}}<\/style><div class=\"vcex-heading vcex-heading-plain vcex-module wpex-heading wpex-text-2xl wpex-div vcex_6ab567666fc48\"><span class=\"vcex-heading-inner wpex-inline-block\"><strong><span style=\"color: #e31f26\">The Recovery<\/span><\/strong> Process<\/span><\/div><div class=\"vc_empty_space\"   style=\"height: 20px\"><span class=\"vc_empty_space_inner\"><\/span><\/div><\/div><\/div><\/div><\/div><div class=\"vc_row wpb_row vc_row-fluid faq-accord-sec vc_custom_1790193320616 vc_row-o-content-middle vc_row-flex wpex-relative no-bottom-margins\"><div class=\"wpb_column vc_column_container vc_col-sm-12\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\"><div class=\"vc_tta-container\" data-vc-action=\"collapseAll\"><div class=\"vc_general vc_tta vc_tta-accordion vc_tta-color-grey vc_tta-style-total vc_tta-shape-rounded vc_tta-o-shape-group vc_tta-controls-align-default vc_tta-o-all-clickable  accord-column vc_custom_1746707767615\"><div class=\"vc_tta-panels-container\"><div class=\"vc_tta-panels\"><div class=\"vc_tta-panel vc_active faq-accord-title\" id=\"1716890254482-90592e71-20fa\" data-vc-content=\".vc_tta-panel-body\"><div class=\"vc_tta-panel-heading\"><h4 class=\"vc_tta-panel-title vc_tta-controls-icon-position-right\"><a href=\"#1716890254482-90592e71-20fa\" data-vc-accordion data-vc-container=\".vc_tta-container\"><span class=\"vc_tta-title-text\">Herstel op afstand ge\u00ebvalueerd en afgewezen<\/span><i class=\"vc_tta-controls-icon vc_tta-controls-icon-chevron\"><\/i><\/a><\/h4><\/div><div class=\"vc_tta-panel-body\"><div class=\"vc_row wpb_row vc_inner vc_row-fluid wpex-relative no-bottom-margins\"><div class=\"wpb_column vc_column_container vc_col-sm-12\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\">\n\t<div style=\"color:#6f737e;\" class=\"wpb_text_column has-custom-color wpex-child-inherit-color wpb_content_element vc_custom_1790193004599\" >\n\t\t<div class=\"wpb_wrapper\">\n\t\t\t<p>Een evaluatie op afstand bevestigde de omvang van het project en werd gebruikt om te bepalen of herstel op afstand kon worden voltooid of dat werk in het lab nodig was. Deze gegevens herstellen betekende het lezen van alle twaalf schijven op sectorniveau, inclusief gebieden waar het bestandssysteem niet langer naar verwees, en toegang op afstand tot een actieve NAS bereikt over het algemeen het logische volume in plaats van het onderliggende fysieke medium. Herstel op afstand was niet mogelijk. Een ingenieur haalde de schijven op de volgende zondagavond op bij San Francisco International Airport.<\/p>\n\n\t\t<\/div>\n\t<\/div>\n<\/div><\/div><\/div><\/div><\/div><\/div><div class=\"vc_tta-panel\" id=\"1716980310195-cf5120dd-63bf\" data-vc-content=\".vc_tta-panel-body\"><div class=\"vc_tta-panel-heading\"><h4 class=\"vc_tta-panel-title vc_tta-controls-icon-position-right\"><a href=\"#1716980310195-cf5120dd-63bf\" data-vc-accordion data-vc-container=\".vc_tta-container\"><span class=\"vc_tta-title-text\">Geen datahersteloperatie uitgevoerd op de originele schijven<\/span><i class=\"vc_tta-controls-icon vc_tta-controls-icon-chevron\"><\/i><\/a><\/h4><\/div><div class=\"vc_tta-panel-body\"><div class=\"vc_row wpb_row vc_inner vc_row-fluid wpex-relative no-bottom-margins\"><div class=\"wpb_column vc_column_container vc_col-sm-12\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\">\n\t<div style=\"color:#6f737e;\" class=\"wpb_text_column has-custom-color wpex-child-inherit-color wpb_content_element vc_custom_1790193010867\" >\n\t\t<div class=\"wpb_wrapper\">\n\t\t\t<p>Alle twaalf schijven werden binnen 24 uur na aankomst ge\u00efmaged, en elke volgende bewerking werd uitgevoerd op die images. De originele media bleven gedurende het hele proces in de staat waarin ze waren ontvangen, waardoor de bewijstoestand behouden bleef terwijl de analyse voortduurde.<\/p>\n\n\t\t<\/div>\n\t<\/div>\n<\/div><\/div><\/div><\/div><\/div><\/div><div class=\"vc_tta-panel\" id=\"1716892470635-67dc37f4-23f5\" data-vc-content=\".vc_tta-panel-body\"><div class=\"vc_tta-panel-heading\"><h4 class=\"vc_tta-panel-title vc_tta-controls-icon-position-right\"><a href=\"#1716892470635-67dc37f4-23f5\" data-vc-accordion data-vc-container=\".vc_tta-container\"><span class=\"vc_tta-title-text\">Extractie verliep parallel<\/span><i class=\"vc_tta-controls-icon vc_tta-controls-icon-chevron\"><\/i><\/a><\/h4><\/div><div class=\"vc_tta-panel-body\"><div class=\"vc_row wpb_row vc_inner vc_row-fluid wpex-relative no-bottom-margins\"><div class=\"wpb_column vc_column_container vc_col-sm-12\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\">\n\t<div style=\"color:#6f737e;\" class=\"wpb_text_column has-custom-color wpex-child-inherit-color wpb_content_element vc_custom_1790193018704\" >\n\t\t<div class=\"wpb_wrapper\">\n\t\t\t<p>Het scannen van ongeveer 120 TB, \u00e9\u00e9n image tegelijk, zou niet haalbaar zijn geweest. Ingenieurs verdeelden het werk in terabyte-bereiken en voerden tien scans tegelijkertijd uit, waardoor de doorvoersnelheid de grenzen van de hardware zelf bereikte. Vervolgens werd op een tweede systeem een tweede reeks images opgebouwd, zodat extracties tegelijkertijd op beide machines konden verlopen.<\/p>\n\n\t\t<\/div>\n\t<\/div>\n<\/div><\/div><\/div><\/div><\/div><\/div><div class=\"vc_tta-panel\" id=\"1716892533584-1defe13c-967c\" data-vc-content=\".vc_tta-panel-body\"><div class=\"vc_tta-panel-heading\"><h4 class=\"vc_tta-panel-title vc_tta-controls-icon-position-right\"><a href=\"#1716892533584-1defe13c-967c\" data-vc-accordion data-vc-container=\".vc_tta-container\"><span class=\"vc_tta-title-text\">De toewijzingskaart van het bestandssysteem vereiste handmatige reconstructie<\/span><i class=\"vc_tta-controls-icon vc_tta-controls-icon-chevron\"><\/i><\/a><\/h4><\/div><div class=\"vc_tta-panel-body\"><div class=\"vc_row wpb_row vc_inner vc_row-fluid wpex-relative no-bottom-margins\"><div class=\"wpb_column vc_column_container vc_col-sm-12\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\">\n\t<div style=\"color:#6f737e;\" class=\"wpb_text_column has-custom-color wpex-child-inherit-color wpb_content_element vc_custom_1790193024841\" >\n\t\t<div class=\"wpb_wrapper\">\n\t\t\t<p>Terwijl gegevens werden verwijderd, was BTRFS begonnen met het wissen van de laag die opgeslagen gegevens toewijst aan hun fysieke locaties. Ongeveer 7 TB van die kaart werd getroffen, wat onbruikbare output opleverde uit een verder leesbare opslag. Ingenieurs stelden vast dat de getroffen gebieden v\u00f3\u00f3r verwijdering aaneengesloten waren toegewezen, wat handmatige reconstructie mogelijk maakte. Het handmatig herbouwen van de kaart herstelde de toegang tot ongeveer 5 TB aan back-upgegevens die het bestandssysteem al had vrijgegeven.<\/p>\n\n\t\t<\/div>\n\t<\/div>\n<\/div><\/div><\/div><\/div><\/div><\/div><div class=\"vc_tta-panel\" id=\"1746706790263-0ece488a-c88d\" data-vc-content=\".vc_tta-panel-body\"><div class=\"vc_tta-panel-heading\"><h4 class=\"vc_tta-panel-title vc_tta-controls-icon-position-right\"><a href=\"#1746706790263-0ece488a-c88d\" data-vc-accordion data-vc-container=\".vc_tta-container\"><span class=\"vc_tta-title-text\">Virtuele schijven geanalyseerd op blokniveau<\/span><i class=\"vc_tta-controls-icon vc_tta-controls-icon-chevron\"><\/i><\/a><\/h4><\/div><div class=\"vc_tta-panel-body\"><div class=\"vc_row wpb_row vc_inner vc_row-fluid wpex-relative no-bottom-margins\"><div class=\"wpb_column vc_column_container vc_col-sm-12\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\">\n\t<div style=\"color:#6f737e;\" class=\"wpb_text_column has-custom-color wpex-child-inherit-color wpb_content_element vc_custom_1790193030834\" >\n\t\t<div class=\"wpb_wrapper\">\n\t\t\t<p>Een beschadigd VMDK-bestand is zelden simpelweg leesbaar of onleesbaar. Ingenieurs scheidden intacte gebieden van gebieden die versleuteld, beschadigd, gedeeltelijk overschreven of structureel beschadigd waren. De drie machines met de hoogste prioriteit hadden elk vijf of zes hersteldata, waarvan de meest recente kort v\u00f3\u00f3r de aanval was gemaakt, wat neerkwam op in totaal 35 VMDK-bestanden. Schade trof 3 tot 5% van elk van die bestanden. Bij \u00e9\u00e9n van de drie had de versleutelingssoftware de virtuele schijfbestanden helemaal niet bereikt.<\/p>\n\n\t\t<\/div>\n\t<\/div>\n<\/div><\/div><\/div><\/div><\/div><\/div><div class=\"vc_tta-panel\" id=\"1746706820873-e77dbc09-0a20\" data-vc-content=\".vc_tta-panel-body\"><div class=\"vc_tta-panel-heading\"><h4 class=\"vc_tta-panel-title vc_tta-controls-icon-position-right\"><a href=\"#1746706820873-e77dbc09-0a20\" data-vc-accordion data-vc-container=\".vc_tta-container\"><span class=\"vc_tta-title-text\">Gaten opvullen met productiegegevens bracht risico met zich mee<\/span><i class=\"vc_tta-controls-icon vc_tta-controls-icon-chevron\"><\/i><\/a><\/h4><\/div><div class=\"vc_tta-panel-body\"><div class=\"vc_row wpb_row vc_inner vc_row-fluid wpex-relative no-bottom-margins\"><div class=\"wpb_column vc_column_container vc_col-sm-12\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\">\n\t<div style=\"color:#6f737e;\" class=\"wpb_text_column has-custom-color wpex-child-inherit-color wpb_content_element vc_custom_1790193036872\" >\n\t\t<div class=\"wpb_wrapper\">\n\t\t\t<p>Waar back-upgegevens alleen een dataset niet dekten, voegden ingenieurs de onversleutelde gebieden van de productie-virtuele schijven samen. Deze aanpak was effectief, al vereiste ze voorzichtigheid. Twee van de drie prioritaire machines hadden ook snapshotbestanden, die geen \u00e9\u00e9n-op-\u00e9\u00e9n-relatie hebben met de gegevens die ze vertegenwoordigen. De structuren die de snapshotbestanden koppelden aan de gegevens die ze vertegenwoordigden, bevonden zich binnen de versleutelde gebieden. Het gebruik van de productie-virtuele schijven om gaten op te vullen kon daardoor oudere gegevens introduceren en corruptie veroorzaken die achteraf moeilijk te traceren zou zijn. Ingenieurs beoordeelden het risico per dataset in plaats van standaard samen te voegen.<\/p>\n\n\t\t<\/div>\n\t<\/div>\n<\/div><\/div><\/div><\/div><\/div><\/div><div class=\"vc_tta-panel\" id=\"1790012399261-c4054605-890c\" data-vc-content=\".vc_tta-panel-body\"><div class=\"vc_tta-panel-heading\"><h4 class=\"vc_tta-panel-title vc_tta-controls-icon-position-right\"><a href=\"#1790012399261-c4054605-890c\" data-vc-accordion data-vc-container=\".vc_tta-container\"><span class=\"vc_tta-title-text\">Levering afgestemd op de doelomgeving<\/span><i class=\"vc_tta-controls-icon vc_tta-controls-icon-chevron\"><\/i><\/a><\/h4><\/div><div class=\"vc_tta-panel-body\"><div class=\"vc_row wpb_row vc_inner vc_row-fluid wpex-relative no-bottom-margins\"><div class=\"wpb_column vc_column_container vc_col-sm-12\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\">\n\t<div style=\"color:#6f737e;\" class=\"wpb_text_column has-custom-color wpex-child-inherit-color wpb_content_element vc_custom_1790193043155\" >\n\t\t<div class=\"wpb_wrapper\">\n\t\t\t<p>DriveSavers werkte samen met het incident response-bedrijf en de klant om vooraf vast te stellen in welke omgeving de schijven opnieuw zouden worden ge\u00efmporteerd. Ge\u00ebxtraheerde gegevens op bestandsniveau werden eerst via het netwerk teruggeleverd, zodat de klant toegang had tot specifieke bestanden terwijl het overige werk doorging. Volledige VMDK-bestanden geschikt voor herimport volgden daarna.<\/p>\n\n\t\t<\/div>\n\t<\/div>\n<\/div><\/div><\/div><\/div><\/div><\/div><\/div><\/div><\/div><\/div><\/div><\/div><\/div><\/div><\/div><div class=\"vc_section vc_custom_1772464080847 vc_section-o-content-middle vc_section-flex wpex-vc-full-width-section wpex-vc-full-width-section--centered wpex-relative wpex-vc_section-has-fill wpex-vc-reset-negative-margin\"><div class=\"vc_row wpb_row vc_row-fluid vc_row-o-content-middle vc_row-flex wpex-relative no-bottom-margins\"><div class=\"wpb_column vc_column_container vc_col-sm-12\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\"><div class=\"vc_row wpb_row vc_inner vc_row-fluid wpex-relative\"><div class=\"wpb_column vc_column_container vc_col-sm-12\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\"><\/div><\/div><\/div><\/div><div class=\"vc_empty_space\"   style=\"height: 40px\"><span class=\"vc_empty_space_inner\"><\/span><\/div><style>.vcex-heading.vcex_6ab5676675292{color:#3e3d3e;font-size:35px;font-weight:400;}@media (max-width:1024px){.vcex-heading.vcex_6ab5676675292{font-size:25px;}}@media (max-width:959px){.vcex-heading.vcex_6ab5676675292{font-size:25px;}}@media (max-width:767px){.vcex-heading.vcex_6ab5676675292{font-size:25px;}}@media (max-width:479px){.vcex-heading.vcex_6ab5676675292{font-size:25px;}}<\/style><div class=\"vcex-heading vcex-heading-plain vcex-module wpex-heading wpex-text-2xl wpex-div vcex_6ab5676675292 translation-block\"><span class=\"vcex-heading-inner wpex-inline-block\"><strong><span style=\"color: #e31f26\">Resultaten: 99,91 procent<\/span><\/strong> op de prioritaire databaseserver<\/span><\/div><div class=\"vc_empty_space\"   style=\"height: 10px\"><span class=\"vc_empty_space_inner\"><\/span><\/div><div id=\"TABLE-ROW\" class=\"vc_row wpb_row vc_inner vc_row-fluid vc_custom_1790193294209 wpex-relative\"><div class=\"wpb_column vc_column_container vc_col-sm-12\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\">\n\t<div class=\"wpb_raw_code wpb_raw_html wpb_content_element\" >\n\t\t<div class=\"wpb_wrapper\">\n\t\t\t<!-- ===================== RecoverNow Dataset\/Result Table ===================== -->\n<!-- Paste this entire block into a WPBakery \"Raw HTML\" element.            -->\n\n<div class=\"rnptds-wrap\">\n  <div class=\"rnptds-table\" id=\"rnptdsTable\">\n\n    <!-- HEADER ROW -->\n    <div class=\"rnptds-row rnptds-header-row\">\n      <div class=\"rnptds-cell rnptds-head\">Dataset<\/div>\n      <div class=\"rnptds-cell rnptds-head\">Resultaat<\/div>\n    <\/div>\n\n    <div class=\"rnptds-row rnptds-shade\">\n      <div class=\"rnptds-cell rnptds-label\">VMDK's van de prioritaire databaseserver, alleen uit de back-uprepository<\/div>\n      <div class=\"rnptds-cell rnptds-value\">99,4 procent hersteld<\/div>\n    <\/div>\n\n    <div class=\"rnptds-row\">\n      <div class=\"rnptds-cell rnptds-label\">Dezelfde VMDK's, na het samenvoegen van productie-virtuele schijfgebieden<\/div>\n      <div class=\"rnptds-cell rnptds-value\">99,91 procent hersteld<\/div>\n    <\/div>\n\n    <div class=\"rnptds-row rnptds-shade\">\n      <div class=\"rnptds-cell rnptds-label\">10GB databasedumpbestand, geleverd<\/div>\n      <div class=\"rnptds-cell rnptds-value\">99,88 procent hersteld<\/div>\n    <\/div>\n\n    <div class=\"rnptds-row\">\n      <div class=\"rnptds-cell rnptds-label\">Hyper Backup-dataset, 3,12 TB verdeeld over 763.384 bestanden<\/div>\n      <div class=\"rnptds-cell rnptds-value\">3,03 TB intact, 86,74 GB beschadigd<\/div>\n    <\/div>\n\n  <\/div>\n<\/div>\n\n<style>\n  .rnptds-wrap {\n    --rnptds-line: #7a7a7a;\n    --rnptds-red: #E31F26;\n    --rnptds-label: #6F737E;\n    width: 100%;\n    overflow-x: auto;\n    -webkit-overflow-scrolling: touch;\n    box-sizing: border-box;\n    font-family: \"DM Sans\", sans-serif;\n  }\n  .rnptds-wrap * { box-sizing: border-box; }\n\n  .rnptds-table {\n    display: table;\n    width: 100%;\n    min-width: 500px;\n    border-collapse: separate;\n    border-spacing: 0;\n    border: 1px solid var(--rnptds-line);\n    border-radius: 15px;\n    overflow: hidden;\n  }\n\n  .rnptds-row {\n    display: table-row;\n  }\n\n  .rnptds-cell {\n    display: table-cell;\n    vertical-align: middle;\n    padding: 14px 18px;\n    border-bottom: 1px solid var(--rnptds-line);\n    border-right: 1px solid var(--rnptds-line);\n    text-align: left;\n    font-size: 18px;\n    font-family: \"DM Sans\", sans-serif;\n    background: transparent;\n  }\n\n  .rnptds-cell:last-child { border-right: none; }\n  .rnptds-row:last-child .rnptds-cell { border-bottom: none; }\n\n  .rnptds-cell:first-child { width: 62%; }\n\n  .rnptds-label { color: var(--rnptds-label); font-weight: 500; }\n  .rnptds-value { color: var(--rnptds-label); font-weight: 600; }\n\n  .rnptds-head {\n    background: transparent;\n    font-size: 20px;\n    font-weight: 700;\n    color: #e31f26;\n  }\n<\/style>\n\t\t<\/div>\n\t<\/div>\n<\/div><\/div><\/div><\/div><\/div><\/div><\/div><\/div><div class=\"vc_row wpb_row vc_row-fluid vc_row-o-content-middle vc_row-flex wpex-relative no-bottom-margins\"><div class=\"wpb_column vc_column_container vc_col-sm-12\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\"><div class=\"vc_empty_space\"   style=\"height: 20px\"><span class=\"vc_empty_space_inner\"><\/span><\/div>\n\t<div style=\"color:#6f737e;font-size:18px;\" class=\"wpb_text_column has-custom-color wpex-child-inherit-color wpb_content_element\" >\n\t\t<div class=\"wpb_wrapper\">\n\t\t\t<p>DriveSavers voerde de opdracht uit als zeven afzonderlijk afgebakende deelopdrachten, waarbij meerdere ingenieurs parallel werkten, zodat de meest prioritaire systemen konden worden bewerkt en geretourneerd v\u00f3\u00f3r de rest van de omgeving.<\/p>\n<p>DriveSavers heeft het incident response-bedrijf en de klant gedurende het hele traject erop gewezen dat niet kon worden gegarandeerd dat de gereconstrueerde VMDK's zouden opstarten. Ten minste \u00e9\u00e9n herstelde virtuele machine startte succesvol op. De rest werd geretourneerd als herstelde gegevens en gerepareerde schijven.<\/p>\n<p>Elke gerepareerde virtuele schijf ging vergezeld van een rapport op blokniveau dat aangaf welke gebieden van de schijf intact waren en welke onherstelbare schade vertoonden, met object-, bestands-, map- en byte-aantallen voor elk gebied. Voor technische teams die een omgeving herbouwen, biedt dit soort rapportage aanzienlijk meer informatie dan een simpele aanduiding van hersteld of niet hersteld. Het stelt beheerders in staat de kwaliteit van een herstelde image te beoordelen en te bepalen of aanvullend herstel op applicatieniveau, bestandsextractie of herbouw nodig is.<\/p>\n\n\t\t<\/div>\n\t<\/div>\n<div class=\"vc_empty_space\"   style=\"height: 20px\"><span class=\"vc_empty_space_inner\"><\/span><\/div><div style=\"border-color:#000000!important;\" class=\"vc_row wpb_row vc_inner vc_row-fluid vc_custom_1790186340921 vc_row-o-content-middle vc_row-flex wpex-relative wpex-vc_row-has-fill wpex-vc-reset-negative-margin\"><div class=\"wpb_column vc_column_container vc_col-sm-12 vc_col-xs-4\"><div class=\"vc_column-inner vc_custom_1727284399200\"><div class=\"wpb_wrapper\"><style>.vcex-icon-box.vcex_6ab567667725d .vcex-icon-box-content{color:#6f737e;}.vcex-icon-box.vcex_6ab567667725d .vcex-icon-box-icon{color:#ec0912;}<\/style><div class=\"vcex-module vcex-icon-box vcex-icon-box-one wpex-flex wpex-text-left vc_custom_1790186401531 vcex_6ab567667725d\"><div class=\"vcex-icon-box-symbol vcex-icon-box-symbol--icon wpex-flex-shrink-0 wpex-mr-20\"><div class=\"vcex-icon-box-icon wpex-items-center wpex-justify-center wpex-child-inherit-color wpex-text-center wpex-leading-none wpex-flex wpex-text-1\"><span class=\"wpex-flex wpex-icon--w wpex-icon wpex-icon--bidi\" aria-hidden=\"true\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" viewbox=\"0 0 448 512\"><path d=\"M0 216C0 149.7 53.7 96 120 96h8c17.7 0 32 14.3 32 32s-14.3 32-32 32h-8c-30.9 0-56 25.1-56 56v8h64c35.3 0 64 28.7 64 64v64c0 35.3-28.7 64-64 64H64c-35.3 0-64-28.7-64-64V320 288 216zm256 0c0-66.3 53.7-120 120-120h8c17.7 0 32 14.3 32 32s-14.3 32-32 32h-8c-30.9 0-56 25.1-56 56v8h64c35.3 0 64 28.7 64 64v64c0 35.3-28.7 64-64 64H320c-35.3 0-64-28.7-64-64V320 288 216z\"\/><\/svg><\/span><\/div><\/div><div class=\"vcex-icon-box-text wpex-flex-grow\"><div class=\"vcex-icon-box-content wpex-last-mb-0 wpex-clr\"><p><em>Laat het hele team alstublieft weten hoe dankbaar ik ben voor de hulp van iedereen bij dit project.<\/em><\/p>\n<p style=\"text-align: right\">\u2014 Chief Information Officer, klantorganisatie<\/p>\n<\/div><\/div><\/div><\/div><\/div><\/div><\/div><\/div><\/div><\/div><\/div><\/div><div id=\"case-study-takeaways\" class=\"vc_section vc_custom_1772464095377 vc_section-o-content-middle vc_section-flex wpex-vc-full-width-section wpex-vc-full-width-section--centered wpex-relative wpex-vc_section-has-fill wpex-vc-reset-negative-margin\"><div class=\"vc_row wpb_row vc_row-fluid vc_row-o-content-middle vc_row-flex wpex-relative no-bottom-margins\"><div class=\"wpb_column vc_column_container vc_col-sm-12\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\"><div class=\"vc_empty_space\"   style=\"height: 40px\"><span class=\"vc_empty_space_inner\"><\/span><\/div><style>.vcex-heading.vcex_6ab5676678563{color:#3e3d3e;font-size:35px;font-weight:400;}@media (max-width:1024px){.vcex-heading.vcex_6ab5676678563{font-size:25px;}}@media (max-width:959px){.vcex-heading.vcex_6ab5676678563{font-size:25px;}}@media (max-width:767px){.vcex-heading.vcex_6ab5676678563{font-size:25px;}}@media (max-width:479px){.vcex-heading.vcex_6ab5676678563{font-size:25px;}}<\/style><div class=\"vcex-heading vcex-heading-plain vcex-module wpex-heading wpex-text-2xl wpex-div vcex_6ab5676678563\"><span class=\"vcex-heading-inner wpex-inline-block\"><strong><span style=\"color: #e31f26\">Conclusie<\/span><\/strong><\/span><\/div>\n\t<div style=\"color:#6f737e;\" class=\"wpb_text_column has-custom-color wpex-child-inherit-color wpb_content_element\" >\n\t\t<div class=\"wpb_wrapper\">\n\t\t\t<p>Wanneer een back-uptoepassing een herstel niet kan voltooien, kunnen de onderliggende gegevens nog steeds op de opslag aanwezig zijn. Deze repository was versleuteld, geleegd en vervolgens overschreven voordat deze bij een herstelspecialist terechtkwam, en toch bracht reconstructie op blokniveau de systemen terug die het bedrijf het hardst nodig had.<\/p>\n<p>Het herstellen van gegevens van virtuele machines onder dergelijke omstandigheden vereist gespecialiseerde kennis, eigen tools en maatwerkontwikkeling voor het specifieke betrokken bestandssysteem. Wanneer ransomware tegelijkertijd productiesystemen en back-upinfrastructuur treft, kan gespecialiseerd ransomware-dataherstel een technische weg bieden die conventioneel herstel niet biedt.<\/p>\n\n\t\t<\/div>\n\t<\/div>\n<div class=\"vc_empty_space\"   style=\"height: 20px\"><span class=\"vc_empty_space_inner\"><\/span><\/div><\/div><\/div><\/div><\/div><div class=\"vc_row wpb_row vc_row-fluid vc_custom_1776873720672 wpex-relative wpex-vc_row-has-fill no-bottom-margins wpex-vc-reset-negative-margin\" style=\"border-color:#000000!important;\"><div class=\"wpb_column vc_column_container vc_col-sm-12 wpex-vc_col-has-fill\"><div class=\"vc_column-inner vc_custom_1760029818507\"><div class=\"wpb_wrapper\">\n\t<div style=\"color:#6f737e;\" class=\"wpb_text_column has-custom-color wpex-child-inherit-color wpb_content_element vc_custom_1790194379795\" >\n\t\t<div class=\"wpb_wrapper\">\n\t\t\t<p style=\"text-align: center;\" class=\"translation-block\"><strong>Staat u voor een vergelijkbare situatie? <a href=\"\/nl-nl\/contact\/\" target=\"_self\">Neem contact op met DriveSavers<\/a> via <a href=\"tel:+18882822227\" target=\"_self\">1 (888) 282-2227<\/a>.<\/strong><\/p>\n\n\t\t<\/div>\n\t<\/div>\n<\/div><\/div><\/div><\/div><\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"<p>DriveSavers herstelde 99,91% van een kritieke databaseserver nadat Akira-ransomware 11 TB aan VMware-back-ups op een Synology-NAS had versleuteld en verwijderd.<\/p>","protected":false},"author":53,"featured_media":86585,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"om_disable_all_campaigns":false,"inline_featured_image":false,"footnotes":""},"categories":[10559],"tags":[11458],"post_series":[],"class_list":["post-86549","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-case-studies","tag-crypto","entry","has-media"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v28.2 (Yoast SEO v28.5) - https:\/\/yoast.com\/product\/yoast-seo-premium-wordpress\/ -->\n<title>VMDK Data Recovery After an Akira Ransomware Attack<\/title>\n<meta name=\"description\" content=\"DriveSavers recovered 99.91% of a critical database server after Akira ransomware encrypted and deleted 11TB of VMware backups on a Synology NAS.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/drivesaversdatarecovery.com\/nl-nl\/case-studies\/vmdk-data-recovery-after-an-akira-ransomware-attack\/\" \/>\n<meta property=\"og:locale\" content=\"nl_NL\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"VMDK Data Recovery After an Akira Ransomware Attack\" \/>\n<meta property=\"og:description\" content=\"DriveSavers recovered 99.91% of a critical database server after Akira ransomware encrypted and deleted 11TB of VMware backups on a Synology NAS.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/drivesaversdatarecovery.com\/nl-nl\/case-studies\/vmdk-data-recovery-after-an-akira-ransomware-attack\/\" \/>\n<meta property=\"og:site_name\" content=\"DriveSavers Data Recovery Services\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/DriveSavers\" \/>\n<meta property=\"article:published_time\" content=\"2026-09-23T19:18:51+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-09-24T15:50:25+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/drivesaversdatarecovery.com\/wp-content\/uploads\/2026\/09\/VMDK-Data-Recovery-After-an-Akira-Ransomware-Attack1.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"627\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Andy Maus\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@drivesavers\" \/>\n<meta name=\"twitter:site\" content=\"@drivesavers\" \/>\n<meta name=\"twitter:label1\" content=\"Geschreven door\" \/>\n\t<meta name=\"twitter:data1\" content=\"Andy Maus\" \/>\n\t<meta name=\"twitter:label2\" content=\"Geschatte leestijd\" \/>\n\t<meta name=\"twitter:data2\" content=\"6 minuten\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"TechArticle\",\"@id\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/case-studies\\\/vmdk-data-recovery-after-an-akira-ransomware-attack\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/case-studies\\\/vmdk-data-recovery-after-an-akira-ransomware-attack\\\/\"},\"author\":{\"name\":\"Andy Maus\",\"@id\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/#\\\/schema\\\/person\\\/d294f7f00d1aee169b2910510fa7e092\"},\"headline\":\"VMDK Data Recovery After an Akira Ransomware Attack\",\"datePublished\":\"2026-09-23T19:18:51+00:00\",\"dateModified\":\"2026-09-24T15:50:25+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/case-studies\\\/vmdk-data-recovery-after-an-akira-ransomware-attack\\\/\"},\"wordCount\":3149,\"publisher\":{\"@id\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/case-studies\\\/vmdk-data-recovery-after-an-akira-ransomware-attack\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/VMDK-Data-Recovery-After-an-Akira-Ransomware-Attack1.png\",\"keywords\":[\"crypto\"],\"articleSection\":[\"Case Studies\"],\"inLanguage\":\"nl-NL\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/case-studies\\\/vmdk-data-recovery-after-an-akira-ransomware-attack\\\/\",\"url\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/case-studies\\\/vmdk-data-recovery-after-an-akira-ransomware-attack\\\/\",\"name\":\"VMDK Data Recovery After an Akira Ransomware Attack\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/case-studies\\\/vmdk-data-recovery-after-an-akira-ransomware-attack\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/case-studies\\\/vmdk-data-recovery-after-an-akira-ransomware-attack\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/VMDK-Data-Recovery-After-an-Akira-Ransomware-Attack1.png\",\"datePublished\":\"2026-09-23T19:18:51+00:00\",\"dateModified\":\"2026-09-24T15:50:25+00:00\",\"description\":\"DriveSavers recovered 99.91% of a critical database server after Akira ransomware encrypted and deleted 11TB of VMware backups on a Synology NAS.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/case-studies\\\/vmdk-data-recovery-after-an-akira-ransomware-attack\\\/#breadcrumb\"},\"inLanguage\":\"nl-NL\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/drivesaversdatarecovery.com\\\/case-studies\\\/vmdk-data-recovery-after-an-akira-ransomware-attack\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"nl-NL\",\"@id\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/case-studies\\\/vmdk-data-recovery-after-an-akira-ransomware-attack\\\/#primaryimage\",\"url\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/VMDK-Data-Recovery-After-an-Akira-Ransomware-Attack1.png\",\"contentUrl\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/VMDK-Data-Recovery-After-an-Akira-Ransomware-Attack1.png\",\"width\":1200,\"height\":627},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/case-studies\\\/vmdk-data-recovery-after-an-akira-ransomware-attack\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"DriveSavers\",\"item\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"VMDK Data Recovery After an Akira Ransomware Attack\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/#website\",\"url\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/\",\"name\":\"DriveSavers Data Recovery Services\",\"description\":\"The Worldwide Leader in Data Recovery\",\"publisher\":{\"@id\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"nl-NL\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/#organization\",\"name\":\"DriveSavers Data Recovery\",\"url\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"nl-NL\",\"@id\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/wp-content\\\/uploads\\\/2021\\\/08\\\/Logo-01.png\",\"contentUrl\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/wp-content\\\/uploads\\\/2021\\\/08\\\/Logo-01.png\",\"width\":1092,\"height\":1087,\"caption\":\"DriveSavers Data Recovery\"},\"image\":{\"@id\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/DriveSavers\",\"https:\\\/\\\/x.com\\\/drivesavers\",\"https:\\\/\\\/www.instagram.com\\\/drivesavers\\\/\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/drivesavers-data-recovery\\\/\",\"https:\\\/\\\/www.pinterest.com\\\/drivesavers\\\/\",\"https:\\\/\\\/www.youtube.com\\\/channel\\\/UCBlynLMdFWQgid-Gwm0zJ1A\",\"https:\\\/\\\/en.wikipedia.org\\\/wiki\\\/DriveSavers\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/#\\\/schema\\\/person\\\/d294f7f00d1aee169b2910510fa7e092\",\"name\":\"Andy Maus\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"nl-NL\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/d40862266d842cfd428c105a72654611de2d431617d5cf0d86aca1087aef2cd0?s=96&d=blank&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/d40862266d842cfd428c105a72654611de2d431617d5cf0d86aca1087aef2cd0?s=96&d=blank&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/d40862266d842cfd428c105a72654611de2d431617d5cf0d86aca1087aef2cd0?s=96&d=blank&r=g\",\"caption\":\"Andy Maus\"},\"description\":\"Andy Maus is Strategic Partnerships &amp; Cyber Recovery Services Leader at DriveSavers, leading initiatives that help organizations recover critical data following cyber incidents, ransomware attacks, and other security breaches. He joined DriveSavers in 2023 after more than two years at Arete Incident Response, where he introduced Data Recovery Services to the firm\u2019s restoration portfolio, expanded the technical operations team from 10 to over 70 specialists, and built strategic alliances with SentinelOne, Dell, and Presidio. Earlier, at Ontrack Data Recovery, he oversaw global sales, supporting complex data restorations for clients across 22 countries. With more than three decades in the technology industry\u2014including leadership roles at Dell, Mitel, and Level 3 Communications\u2014Andy brings deep experience in cyber incident response, data recovery methodologies, and large-scale technical operations.\",\"url\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/nl-nl\\\/author\\\/andy-maus\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"VMDK Data Recovery After an Akira Ransomware Attack","description":"DriveSavers herstelde 99,91% van een kritieke databaseserver nadat Akira-ransomware 11 TB aan VMware-back-ups op een Synology-NAS had versleuteld en verwijderd.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/drivesaversdatarecovery.com\/nl-nl\/case-studies\/vmdk-data-recovery-after-an-akira-ransomware-attack\/","og_locale":"nl_NL","og_type":"article","og_title":"VMDK Data Recovery After an Akira Ransomware Attack","og_description":"DriveSavers recovered 99.91% of a critical database server after Akira ransomware encrypted and deleted 11TB of VMware backups on a Synology NAS.","og_url":"https:\/\/drivesaversdatarecovery.com\/nl-nl\/case-studies\/vmdk-data-recovery-after-an-akira-ransomware-attack\/","og_site_name":"DriveSavers Data Recovery Services","article_publisher":"https:\/\/www.facebook.com\/DriveSavers","article_published_time":"2026-09-23T19:18:51+00:00","article_modified_time":"2026-09-24T15:50:25+00:00","og_image":[{"width":1200,"height":627,"url":"https:\/\/drivesaversdatarecovery.com\/wp-content\/uploads\/2026\/09\/VMDK-Data-Recovery-After-an-Akira-Ransomware-Attack1.png","type":"image\/png"}],"author":"Andy Maus","twitter_card":"summary_large_image","twitter_creator":"@drivesavers","twitter_site":"@drivesavers","twitter_misc":{"Geschreven door":"Andy Maus","Geschatte leestijd":"6 minuten"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"TechArticle","@id":"https:\/\/drivesaversdatarecovery.com\/case-studies\/vmdk-data-recovery-after-an-akira-ransomware-attack\/#article","isPartOf":{"@id":"https:\/\/drivesaversdatarecovery.com\/case-studies\/vmdk-data-recovery-after-an-akira-ransomware-attack\/"},"author":{"name":"Andy Maus","@id":"https:\/\/drivesaversdatarecovery.com\/#\/schema\/person\/d294f7f00d1aee169b2910510fa7e092"},"headline":"VMDK Data Recovery After an Akira Ransomware Attack","datePublished":"2026-09-23T19:18:51+00:00","dateModified":"2026-09-24T15:50:25+00:00","mainEntityOfPage":{"@id":"https:\/\/drivesaversdatarecovery.com\/case-studies\/vmdk-data-recovery-after-an-akira-ransomware-attack\/"},"wordCount":3149,"publisher":{"@id":"https:\/\/drivesaversdatarecovery.com\/#organization"},"image":{"@id":"https:\/\/drivesaversdatarecovery.com\/case-studies\/vmdk-data-recovery-after-an-akira-ransomware-attack\/#primaryimage"},"thumbnailUrl":"https:\/\/drivesaversdatarecovery.com\/wp-content\/uploads\/2026\/09\/VMDK-Data-Recovery-After-an-Akira-Ransomware-Attack1.png","keywords":["crypto"],"articleSection":["Case Studies"],"inLanguage":"nl-NL"},{"@type":"WebPage","@id":"https:\/\/drivesaversdatarecovery.com\/case-studies\/vmdk-data-recovery-after-an-akira-ransomware-attack\/","url":"https:\/\/drivesaversdatarecovery.com\/case-studies\/vmdk-data-recovery-after-an-akira-ransomware-attack\/","name":"VMDK Data Recovery After an Akira Ransomware Attack","isPartOf":{"@id":"https:\/\/drivesaversdatarecovery.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/drivesaversdatarecovery.com\/case-studies\/vmdk-data-recovery-after-an-akira-ransomware-attack\/#primaryimage"},"image":{"@id":"https:\/\/drivesaversdatarecovery.com\/case-studies\/vmdk-data-recovery-after-an-akira-ransomware-attack\/#primaryimage"},"thumbnailUrl":"https:\/\/drivesaversdatarecovery.com\/wp-content\/uploads\/2026\/09\/VMDK-Data-Recovery-After-an-Akira-Ransomware-Attack1.png","datePublished":"2026-09-23T19:18:51+00:00","dateModified":"2026-09-24T15:50:25+00:00","description":"DriveSavers herstelde 99,91% van een kritieke databaseserver nadat Akira-ransomware 11 TB aan VMware-back-ups op een Synology-NAS had versleuteld en verwijderd.","breadcrumb":{"@id":"https:\/\/drivesaversdatarecovery.com\/case-studies\/vmdk-data-recovery-after-an-akira-ransomware-attack\/#breadcrumb"},"inLanguage":"nl-NL","potentialAction":[{"@type":"ReadAction","target":["https:\/\/drivesaversdatarecovery.com\/case-studies\/vmdk-data-recovery-after-an-akira-ransomware-attack\/"]}]},{"@type":"ImageObject","inLanguage":"nl-NL","@id":"https:\/\/drivesaversdatarecovery.com\/case-studies\/vmdk-data-recovery-after-an-akira-ransomware-attack\/#primaryimage","url":"https:\/\/drivesaversdatarecovery.com\/wp-content\/uploads\/2026\/09\/VMDK-Data-Recovery-After-an-Akira-Ransomware-Attack1.png","contentUrl":"https:\/\/drivesaversdatarecovery.com\/wp-content\/uploads\/2026\/09\/VMDK-Data-Recovery-After-an-Akira-Ransomware-Attack1.png","width":1200,"height":627},{"@type":"BreadcrumbList","@id":"https:\/\/drivesaversdatarecovery.com\/case-studies\/vmdk-data-recovery-after-an-akira-ransomware-attack\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"DriveSavers","item":"https:\/\/drivesaversdatarecovery.com\/"},{"@type":"ListItem","position":2,"name":"VMDK Data Recovery After an Akira Ransomware Attack"}]},{"@type":"WebSite","@id":"https:\/\/drivesaversdatarecovery.com\/#website","url":"https:\/\/drivesaversdatarecovery.com\/","name":"DriveSavers diensten voor gegevensherstel","description":"The Worldwide Leader in Data Recovery","publisher":{"@id":"https:\/\/drivesaversdatarecovery.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/drivesaversdatarecovery.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"nl-NL"},{"@type":"Organization","@id":"https:\/\/drivesaversdatarecovery.com\/#organization","name":"DriveSavers Nederland","url":"https:\/\/drivesaversdatarecovery.com\/","logo":{"@type":"ImageObject","inLanguage":"nl-NL","@id":"https:\/\/drivesaversdatarecovery.com\/#\/schema\/logo\/image\/","url":"https:\/\/drivesaversdatarecovery.com\/wp-content\/uploads\/2021\/08\/Logo-01.png","contentUrl":"https:\/\/drivesaversdatarecovery.com\/wp-content\/uploads\/2021\/08\/Logo-01.png","width":1092,"height":1087,"caption":"DriveSavers Data Recovery"},"image":{"@id":"https:\/\/drivesaversdatarecovery.com\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/DriveSavers","https:\/\/x.com\/drivesavers","https:\/\/www.instagram.com\/drivesavers\/","https:\/\/www.linkedin.com\/company\/drivesavers-data-recovery\/","https:\/\/www.pinterest.com\/drivesavers\/","https:\/\/www.youtube.com\/channel\/UCBlynLMdFWQgid-Gwm0zJ1A","https:\/\/en.wikipedia.org\/wiki\/DriveSavers"]},{"@type":"Person","@id":"https:\/\/drivesaversdatarecovery.com\/#\/schema\/person\/d294f7f00d1aee169b2910510fa7e092","name":"Andy Maus","image":{"@type":"ImageObject","inLanguage":"nl-NL","@id":"https:\/\/secure.gravatar.com\/avatar\/d40862266d842cfd428c105a72654611de2d431617d5cf0d86aca1087aef2cd0?s=96&d=blank&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/d40862266d842cfd428c105a72654611de2d431617d5cf0d86aca1087aef2cd0?s=96&d=blank&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/d40862266d842cfd428c105a72654611de2d431617d5cf0d86aca1087aef2cd0?s=96&d=blank&r=g","caption":"Andy Maus"},"description":"Andy Maus is Strategic Partnerships &amp; Cyber Recovery Services Leader at DriveSavers, leading initiatives that help organizations recover critical data following cyber incidents, ransomware attacks, and other security breaches. He joined DriveSavers in 2023 after more than two years at Arete Incident Response, where he introduced Data Recovery Services to the firm\u2019s restoration portfolio, expanded the technical operations team from 10 to over 70 specialists, and built strategic alliances with SentinelOne, Dell, and Presidio. Earlier, at Ontrack Data Recovery, he oversaw global sales, supporting complex data restorations for clients across 22 countries. With more than three decades in the technology industry\u2014including leadership roles at Dell, Mitel, and Level 3 Communications\u2014Andy brings deep experience in cyber incident response, data recovery methodologies, and large-scale technical operations.","url":"https:\/\/drivesaversdatarecovery.com\/nl-nl\/author\/andy-maus\/"}]}},"_links":{"self":[{"href":"https:\/\/drivesaversdatarecovery.com\/nl-nl\/wp-json\/wp\/v2\/posts\/86549","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/drivesaversdatarecovery.com\/nl-nl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/drivesaversdatarecovery.com\/nl-nl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/drivesaversdatarecovery.com\/nl-nl\/wp-json\/wp\/v2\/users\/53"}],"replies":[{"embeddable":true,"href":"https:\/\/drivesaversdatarecovery.com\/nl-nl\/wp-json\/wp\/v2\/comments?post=86549"}],"version-history":[{"count":10,"href":"https:\/\/drivesaversdatarecovery.com\/nl-nl\/wp-json\/wp\/v2\/posts\/86549\/revisions"}],"predecessor-version":[{"id":86586,"href":"https:\/\/drivesaversdatarecovery.com\/nl-nl\/wp-json\/wp\/v2\/posts\/86549\/revisions\/86586"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/drivesaversdatarecovery.com\/nl-nl\/wp-json\/wp\/v2\/media\/86585"}],"wp:attachment":[{"href":"https:\/\/drivesaversdatarecovery.com\/nl-nl\/wp-json\/wp\/v2\/media?parent=86549"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/drivesaversdatarecovery.com\/nl-nl\/wp-json\/wp\/v2\/categories?post=86549"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/drivesaversdatarecovery.com\/nl-nl\/wp-json\/wp\/v2\/tags?post=86549"},{"taxonomy":"post_series","embeddable":true,"href":"https:\/\/drivesaversdatarecovery.com\/nl-nl\/wp-json\/wp\/v2\/post_series?post=86549"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}